From efeedfecaa4aa9fd8b4d46eeb023c55c1af34b0b Mon Sep 17 00:00:00 2001 From: Sean Dolbec Date: Mon, 9 Nov 2026 22:03:52 -0500 Subject: [PATCH] ci: sep-source: cancel superseded runs and use a read-only token The SEP source checks start a new source, rust-build and kunit run on every pull_request event, but unlike the device tree and host test workflows they have no concurrency group. A PR that is pushed again, or that receives two events for one head, keeps every earlier run going: in the last 100 runs ten heads were checked twice at the same SHA, and each kunit job builds a kernel and boots it in QEMU. Use the same per-PR concurrency group with cancel-in-progress as dt-checks.yml and host-tests.yml, and the same read-only contents permission. No job reads anything beyond the checkout. Assisted-by: LLM Signed-off-by: Sean Dolbec --- .github/workflows/sep-source.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/sep-source.yml b/.github/workflows/sep-source.yml index 8cae0dcf9d679..2d7bb0368164c 100644 --- a/.github/workflows/sep-source.yml +++ b/.github/workflows/sep-source.yml @@ -12,6 +12,13 @@ on: - 'tools/aurora-sep/**' - '.github/workflows/sep-source.yml' +permissions: + contents: read + +concurrency: + group: sep-source-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: source: runs-on: ubuntu-latest