From 6120a5ee40e53e614b242cb9c9f7bf2e0bbf74bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roland=20B=C3=BCrgi?=
 <6334612+rbuergi@users.noreply.github.com>
Date: Tue, 8 Sep 2026 15:57:18 +0200
Subject: [PATCH] ci: one live run per PR ref on chart-gate, clients,
 hosting-operator and homebrew
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four PR-triggered workflows carried no concurrency block, so a push to a PR branch never
cancelled the run it superseded — measured 2026-09-08 while auditing why superseded runs were
not self-killing. Same group shape as dotnet-test.yml: main and the merge queue keyed per commit
(never cancelled), every other ref cancels in progress.
---
 .github/workflows/chart-gate.yml       | 6 ++++++
 .github/workflows/clients.yml          | 6 ++++++
 .github/workflows/homebrew.yml         | 6 ++++++
 .github/workflows/hosting-operator.yml | 6 ++++++
 4 files changed, 24 insertions(+)

diff --git a/.github/workflows/chart-gate.yml b/.github/workflows/chart-gate.yml
index 6a8d7661dc..8697653096 100644
--- a/.github/workflows/chart-gate.yml
+++ b/.github/workflows/chart-gate.yml
@@ -49,6 +49,12 @@ on:
 permissions:
   contents: read
 
+# One live run per ref: a newer push to the same PR branch cancels the run it supersedes; main and
+# the merge queue never cancel (each main push is its own group, keyed on the commit).
+concurrency:
+  group: chart-gate-${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   invariants:
     name: Chart invariants
diff --git a/.github/workflows/clients.yml b/.github/workflows/clients.yml
index 465ababb3f..14e95dfd82 100644
--- a/.github/workflows/clients.yml
+++ b/.github/workflows/clients.yml
@@ -72,6 +72,12 @@ on:
       - ".github/workflows/clients.yml"
       - "src/MeshWeaver.Mesh.Contract/Protos/**"
 
+# One live run per ref: a newer push to the same PR branch cancels the run it supersedes; main and
+# the merge queue never cancel (each main push is its own group, keyed on the commit).
+concurrency:
+  group: clients-${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   python-sdk:
     name: "meshweaver (Python test)"
diff --git a/.github/workflows/homebrew.yml b/.github/workflows/homebrew.yml
index 6b20de3d4f..7c4e0db689 100644
--- a/.github/workflows/homebrew.yml
+++ b/.github/workflows/homebrew.yml
@@ -48,6 +48,12 @@ permissions:
 env:
   TAP_REPO: Systemorph/homebrew-memex
 
+# One live run per ref: a newer push to the same PR branch cancels the run it supersedes; main and
+# the merge queue never cancel (each main push is its own group, keyed on the commit).
+concurrency:
+  group: homebrew-${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   install:
     name: brew install + test (macOS)
diff --git a/.github/workflows/hosting-operator.yml b/.github/workflows/hosting-operator.yml
index b076ac5a10..ffc56b0580 100644
--- a/.github/workflows/hosting-operator.yml
+++ b/.github/workflows/hosting-operator.yml
@@ -27,6 +27,12 @@ on:
 permissions:
   contents: read
 
+# One live run per ref: a newer push to the same PR branch cancels the run it supersedes; main and
+# the merge queue never cancel (each main push is its own group, keyed on the commit).
+concurrency:
+  group: hosting-operator-${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   scripts:
     name: Operator scripts (shellcheck + behaviour)