From 03e55a8e6a3226435e4ddd112505c31a59eec5c2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 11 Jul 2026 12:20:49 +0100 Subject: [PATCH] ci(codeql): don't cancel superseded runs of a required scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL is a REQUIRED code-scanning tool in the estate branch rulesets — a result must upload for the head commit before merge. With cancel-in-progress: true a re-push cancels the in-flight scan, which uploads nothing, leaving branch protection stuck "expecting 1 result from CodeQL for " forever (the ghost check that blocks estate PRs for hours/days). Queue instead of cancel so the latest commit always completes + uploads. This is the canonical template; consumer repos inherit it on next sync. --- .github/workflows/codeql.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b86233b4..8b603f4a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -14,13 +14,19 @@ on: # cut only changes the scheduled-baseline cadence. - cron: '0 6 1 * *' -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. +# Estate guardrail: serialise superseded runs so re-pushes / rebased PR +# updates do not pile up against the shared account-wide Actions pool. +# +# cancel-in-progress is DELIBERATELY false: CodeQL is a REQUIRED +# code-scanning tool in the estate branch rulesets (a result must upload +# for the head commit before a PR can merge). A cancelled run uploads +# nothing, leaving branch protection stuck "expecting 1 result from CodeQL +# for " indefinitely — the ghost check that blocks PRs for hours/days. +# Queue rather than cancel so the latest commit's scan always completes and +# uploads. (Non-required read-only workflows may still cancel-in-progress.) concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + cancel-in-progress: false permissions: contents: read