fix(ci): keep flake-sync to one open pull request

.github/workflows/flake-sync.yml

@@ -31,6 +31,16 @@ permissions:
   contents: write
   pull-requests: write
 
+# One sync at a time. The fixed branch stops a merge batch opening a
+# pull request per push, but two overlapping runs would still race to
+# write it, and the loser is not always the older one: an older main
+# event could win and leave the open pull request describing a stale
+# lockfile. Cancelling in flight is right here because the newest event
+# subsumes the older one, so an older computation has no value.
+concurrency:
+  group: flake-sync
+  cancel-in-progress: true
+
 jobs:
   sync:
     runs-on: ubuntu-latest
@@ -120,15 +130,36 @@ jobs:
           # auto-merges once ci.yml goes green.
           git config user.email "noreply@adastracomputing.com"
           git config user.name "ahd-flake-sync"
-          BRANCH="bot/flake-sync-${{ github.run_id }}"
-          git checkout -b "$BRANCH"
+          # One branch, reused. A run id in the name opened a fresh pull
+          # request per run, so a batch of merges produced one sync pull
+          # request per push for the same drift: seven merges on 26 July
+          # left five, of which one landed and the rest went stale and
+          # conflicted. Force-pushing a fixed branch updates the open
+          # pull request instead of adding another.
+          BRANCH="bot/flake-sync"
+          git checkout -B "$BRANCH"
           git add flake.nix
           git commit -m "chore(flake): sync version + npmDepsHash [skip-flake-sync]
 
           Auto-generated by .github/workflows/flake-sync.yml.
           - version:     ${{ steps.current.outputs.cur_version }} -> ${{ steps.compute.outputs.pkg_version }}
           - npmDepsHash: ${{ steps.current.outputs.cur_hash }} -> ${{ steps.compute.outputs.new_hash }}"
-          git push -u origin "$BRANCH"
+          git push -u --force-with-lease origin "$BRANCH"
+
+          # Reuse the open pull request if there is one; --delete-branch
+          # on merge means there usually is not.
+          PR_NUMBER="$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')"
+          if [ -n "$PR_NUMBER" ]; then
+            echo "updating open sync pull request #$PR_NUMBER"
+            gh pr edit "$PR_NUMBER" \
+              --body "Auto-generated by flake-sync.yml. Merges automatically once CI passes.
+
+          - version: \`${{ steps.current.outputs.cur_version }}\` -> \`${{ steps.compute.outputs.pkg_version }}\`
+          - npmDepsHash: \`${{ steps.current.outputs.cur_hash }}\` -> \`${{ steps.compute.outputs.new_hash }}\`"
+            gh pr merge "$PR_NUMBER" --auto --squash --delete-branch
+            exit 0
+          fi
+
           gh pr create --base main --head "$BRANCH" \
             --title "chore(flake): sync version + npmDepsHash [skip-flake-sync]" \
             --body "Auto-generated by flake-sync.yml. Merges automatically once CI passes.