Skip to content

ci(codeql): don't cancel superseded runs of a required scan #484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Jul 11, 2026
Merged

ci(codeql): don't cancel superseded runs of a required scan #484

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
03e55a8
ci(codeql): don't cancel superseded runs of a required scan
hyperpolymath Jul 11, 2026
218597a
Merge branch 'main' into ci/codeql-no-cancel-required-scan
hyperpolymath Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,19 @@ on:
# cut only changes the scheduled-baseline cadence.
- cron: '0 6 1 * *'

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
# Estate guardrail: serialise superseded runs so re-pushes / rebased PR
# updates do not pile up against the shared account-wide Actions pool.
#
# cancel-in-progress is DELIBERATELY false: CodeQL is a REQUIRED
# code-scanning tool in the estate branch rulesets (a result must upload
# for the head commit before a PR can merge). A cancelled run uploads
# nothing, leaving branch protection stuck "expecting 1 result from CodeQL
# for <sha>" indefinitely — the ghost check that blocks PRs for hours/days.
# Queue rather than cancel so the latest commit's scan always completes and
# uploads. (Non-required read-only workflows may still cancel-in-progress.)
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
cancel-in-progress: false

permissions:
contents: read
Expand Down
Loading