Restore single caller concurrency policy

Return caller guidance and direct workflow tests to the experimentally adopted workflow-level concurrency group and one reusable-workflow calling job. Keep public caller permissions scoped to that job.

Co-authored-by: Copilot <223556698+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/plugin/psmodule/skills/psmodule-v8-upgrade/SKILL.md

@@ -154,28 +154,13 @@ on:
       - labeled
       - unlabeled
 
-jobs:
-  Process-PSModule-Production:
-    if: ${{ github.event_name != 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      queue: max
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  queue: ${{ github.event_name == 'pull_request' && 'single' || 'max' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-  Process-PSModule-PullRequest:
-    if: ${{ github.event_name == 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-      queue: single
-      cancel-in-progress: true
+jobs:
+  Process-PSModule:
     permissions:
       contents: read
       pages: write
@@ -187,10 +172,11 @@ jobs:
       GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
 ```
 
-The only permitted variation is an optional identical `TestData` entry under both caller jobs' `secrets` mappings.
-Do not add `with:` inputs, extra jobs, conditions, schedule changes, `run-name`, permission changes, trigger changes,
-concurrency changes, debug options, or version overrides. Repository-owned automation belongs in separate workflow
-files.
+The only permitted variation is an optional `TestData` entry under
+`jobs.Process-PSModule.secrets`. Do not add `with:` inputs, extra jobs,
+conditions, schedule changes, `run-name`, permission changes, trigger changes,
+concurrency changes, debug options, or version overrides. Repository-owned
+automation belongs in separate workflow files.
 
 ### TestData preservation
 

.github/workflows/Workflow-Test-Default.yml

@@ -30,45 +30,16 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  queue: ${{ github.event_name == 'pull_request' && 'single' || 'max' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions: {}
 
 jobs:
   WorkflowTestDefault:
-    if: ${{ github.event_name != 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      queue: max
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    uses: ./.github/workflows/workflow.yml
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
-      TestData: >-
-        {
-          "secrets": {
-            "PSMODULE_TEST_SINGLELINE_SECRET": "${{ secrets.PSMODULE_TEST_SINGLELINE_SECRET }}"
-          },
-          "variables": {
-            "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }}
-          }
-        }
-    with:
-      WorkingDirectory: tests/srcTestRepo
-      ImportantFilePatterns: |
-        ^tests/srcTestRepo/
-        ^\.github/actions/
-        ^\.github/workflows/(?!Release\.yml$|Linter\.yml$)
-
-  WorkflowTestDefaultPullRequest:
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-      queue: single
-      cancel-in-progress: true
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
       pages: write
@@ -95,15 +66,11 @@ jobs:
         ^\.github/workflows/(?!Release\.yml$|Linter\.yml$)
 
   VerifyRootFunctionsIndexDefault:
-    if: >-
-      ${{ always() && github.event.action != 'closed' &&
-      (needs.WorkflowTestDefault.result == 'success' ||
-      needs.WorkflowTestDefaultPullRequest.result == 'success') }}
+    if: github.event.action != 'closed'
     name: Verify root Functions index [Default]
     runs-on: ubuntu-latest
     needs:
       - WorkflowTestDefault
-      - WorkflowTestDefaultPullRequest
     permissions:
       contents: read
     steps:

.github/workflows/Workflow-Test-WithManifest.yml

@@ -30,45 +30,16 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  queue: ${{ github.event_name == 'pull_request' && 'single' || 'max' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions: {}
 
 jobs:
   WorkflowTestWithManifest:
-    if: ${{ github.event_name != 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      queue: max
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    uses: ./.github/workflows/workflow.yml
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
-      TestData: >-
-        {
-          "secrets": {
-            "PSMODULE_TEST_SINGLELINE_SECRET": "${{ secrets.PSMODULE_TEST_SINGLELINE_SECRET }}"
-          },
-          "variables": {
-            "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }}
-          }
-        }
-    with:
-      WorkingDirectory: tests/srcWithManifestTestRepo
-      ImportantFilePatterns: |
-        ^tests/srcWithManifestTestRepo/
-        ^\.github/actions/
-        ^\.github/workflows/(?!Release\.yml$|Linter\.yml$)
-
-  WorkflowTestWithManifestPullRequest:
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-      queue: single
-      cancel-in-progress: true
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
       pages: write
@@ -95,15 +66,11 @@ jobs:
         ^\.github/workflows/(?!Release\.yml$|Linter\.yml$)
 
   VerifyRootFunctionsIndexWithManifest:
-    if: >-
-      ${{ always() && github.event.action != 'closed' &&
-      (needs.WorkflowTestWithManifest.result == 'success' ||
-      needs.WorkflowTestWithManifestPullRequest.result == 'success') }}
+    if: github.event.action != 'closed'
     name: Verify root Functions index [WithManifest]
     runs-on: ubuntu-latest
     needs:
       - WorkflowTestWithManifest
-      - WorkflowTestWithManifestPullRequest
     permissions:
       contents: read
     steps:

docs/content/get-started/repository-setup.md

@@ -71,28 +71,13 @@ on:
       - labeled
       - unlabeled
 
-jobs:
-  Process-PSModule-Production:
-    if: ${{ github.event_name != 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      queue: max
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  queue: ${{ github.event_name == 'pull_request' && 'single' || 'max' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-  Process-PSModule-PullRequest:
-    if: ${{ github.event_name == 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-      queue: single
-      cancel-in-progress: true
+jobs:
+  Process-PSModule:
     permissions:
       contents: read
       pages: write
@@ -104,16 +89,16 @@ jobs:
       GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
 ```
 
-Every permission on the calling jobs is required. GitHub App installation tokens perform repository writes. A push to
+Every permission on the calling job is required. GitHub App installation tokens perform repository writes. A push to
 `main` publishes a stable release after the full pipeline passes; the pull-request trigger handles CI, prereleases,
 and prerelease cleanup. See
 [Workflow inputs](../reference/workflow-inputs.md) for what each permission is used for, and
 [Calling the workflow](../guides/calling-the-workflow.md) for passing test secrets and variables.
 
-The production job retains pushes, dispatches, and scheduled work in the maximum native queue. The pull-request job
-cancels obsolete activity and uses the pull-request number for every action, including `closed`. GitHub requires a
-literal queue value and does not permit cancellation with `queue: max`, so the two jobs use separate compatible
-policies. Keep both groups distinct from the reusable workflow's prefixed group.
+The caller-level concurrency block retains production, dispatch, and scheduled work in the maximum native queue while
+replacing obsolete activity for the same pull request. Its fallback expression uses the pull-request number for every
+pull-request action, including `closed`; other events use their Git ref. Keep its group distinct from the reusable
+workflow's prefixed group.
 
 ## 5. Configure the settings file
 

docs/content/guides/calling-the-workflow.md

@@ -36,28 +36,13 @@ on:
       - labeled
       - unlabeled
 
-jobs:
-  Process-PSModule-Production:
-    if: ${{ github.event_name != 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      queue: max
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  queue: ${{ github.event_name == 'pull_request' && 'single' || 'max' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-  Process-PSModule-PullRequest:
-    if: ${{ github.event_name == 'pull_request' }}
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-      queue: single
-      cancel-in-progress: true
+jobs:
+  Process-PSModule:
     permissions:
       contents: read
       pages: write
@@ -75,11 +60,10 @@ Stable releases are evaluated from a push to the default branch. A merged pull r
 release notes; a direct default-branch push or a manual dispatch uses the default `Patch` bump and commit-based notes.
 Keep the `pull_request` trigger for CI, prereleases, and prerelease cleanup.
 
-The production job serializes default-branch pushes, manual releases, and scheduled work in the maximum native queue.
-The pull-request job uses a separate group for each pull request, so a close event interrupts only its own activity and
-does not block the resulting stable release. Its `single` queue and cancellation replace obsolete activity. GitHub
-requires a literal queue value and rejects cancellation with `queue: max`, so these policies must remain separate.
-The reusable workflow uses a distinct prefixed concurrency group. Do not give either caller job that group name.
+The concurrency group uses the pull-request number when available and the Git ref otherwise, so a close event
+interrupts only its own pull-request activity and does not block the resulting stable release. Pull-request events use
+the `single` queue and cancel obsolete activity; other events use the maximum native queue without cancellation. The
+reusable workflow uses a distinct prefixed concurrency group. Do not give the caller that group name.
 
 ## Passing test data
 
@@ -101,9 +85,9 @@ The reusable workflow accepts test data through `TestData` and no longer declare
 - `TEST_USER_USER_FG_PAT`
 - `TEST_USER_PAT`
 
-If a caller passed any of these secrets directly, place them in the `secrets` map inside `TestData`. Add the same
-`TestData` mapping to the `secrets` block of both caller jobs. The environment variable names used by the tests can
-stay the same; only the workflow-call interface changes:
+If a caller passed any of these secrets directly, place them in the `secrets` map inside `TestData`. Add the
+`TestData` mapping to the calling job's `secrets` block. The environment variable names used by the tests can stay the
+same; only the workflow-call interface changes:
 
 ```yaml
 TestData: >-
@@ -122,8 +106,8 @@ workflow. It is one JSON object with two maps, so everything the tests need is v
 ```
 
 Values under `secrets` are masked in the logs; values under `variables` are not. Build it in the calling workflow and
-pass it through the `secrets:` blocks of both caller jobs so the whole blob is masked. Reference each secret directly
-as `"${{ secrets.<name> }}"` and each variable as `${{ toJSON(vars.<name>) }}`. A folded `>-` scalar keeps the source
+pass it through the calling job's `secrets:` block so the whole blob is masked. Reference each secret directly as
+`"${{ secrets.<name> }}"` and each variable as `${{ toJSON(vars.<name>) }}`. A folded `>-` scalar keeps the source
 readable while producing a single-line value, as long as the JSON content lines stay at the same indentation level:
 
 ```yaml

docs/content/guides/github-app-authentication.md

@@ -19,18 +19,11 @@ The reusable workflow declares three required secrets at its `workflow_call` bou
 | `GitHubAppPrivateKey` | The GitHub App private key passed to the token action. |
 
 The names are the reusable workflow contract, not a requirement for the caller's repository or organization secret
-names. Map the caller's secrets explicitly in both caller jobs:
+names. Map the caller's secrets explicitly in the calling job:
 
 ```yaml
 jobs:
-  Process-PSModule-Production:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
-    secrets:
-      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
-      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
-      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}
-
-  Process-PSModule-PullRequest:
+  Process-PSModule:
     uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
     secrets:
       PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}

docs/content/reference/repository-standard.md

@@ -124,18 +124,15 @@ repository. Name it `Process-PSModule.yml`, matching
 `workflow.yml` is the reusable workflow's own filename inside `PSModule/Process-PSModule` and belongs only in the
 `uses:` reference.
 
-The caller uses these mutually exclusive jobs:
+The caller uses one `Process-PSModule` job. Its workflow-level concurrency group uses the pull-request number when
+available and the Git ref otherwise. Pull-request events use `queue: single` and cancel obsolete activity; other
+events use `queue: max` without cancellation.
 
-| Job | Events | Concurrency policy |
-| --- | --- | --- |
-| `Process-PSModule-Production` | Non-pull-request events | Group by Git ref with `queue: max`; do not cancel runs. |
-| `Process-PSModule-PullRequest` | Pull-request events | Group by pull-request number with `queue: single`; cancel obsolete runs. |
-
-Both jobs use the same reusable-workflow reference, required job-level permissions, and explicit `PSGALLERY_API_KEY`,
+The job uses the reusable-workflow reference, required job-level permissions, and explicit `PSGALLERY_API_KEY`,
 `GitHubAppClientId`, and `GitHubAppPrivateKey` mapping. The exact
 [caller template](../guides/calling-the-workflow.md) is part of this standard. Use the controlled
 `PSModule/Process-PSModule` `@v8` major reference; pin external Actions dependencies to a commit SHA with the version
-tag in a trailing comment so Dependabot can update them. Permissions are declared only on the caller jobs, not at the
+tag in a trailing comment so Dependabot can update them. Permissions are declared only on the calling job, not at the
 workflow root.
 
 ## Required common files

docs/content/specification/design.md

@@ -20,8 +20,9 @@ documented in [Workflow inputs](../reference/workflow-inputs.md).
 ### Trigger admission
 
 The [workflow trigger design](workflow-triggers/design.md) owns caller admission before processing: a retained
-production queue and replaceable pull-request activity. The caller jobs cover each complete reusable-workflow call
-through its final enabled stage; the reusable workflow identifies closure and performs optional prerelease cleanup.
+production queue and replaceable pull-request activity. The caller-level concurrency group covers each complete
+reusable-workflow call through its final enabled stage; the reusable workflow identifies closure and performs optional
+prerelease cleanup.
 
 ### Composed reusable workflows