fix(ci): stop the CodeQL cron cancelling the main merge scan

[waleedlatif1]

Summary

• Scope CodeQL's cancel-in-progress to pull_request instead of every trigger
• push and schedule both resolve to refs/heads/main, so they shared the codeql-refs/heads/main concurrency group — a merge landing in the ~2 minute window before the daily cron got its scan cancelled mid-extraction, and main showed a red status rollup for a commit the cron had in fact scanned clean
• PR superseding is unaffected: each PR is already its own group via refs/pull/N/merge, which is where 49 of the 50 cancellations in the last 300 runs happened
• Non-PR events now queue behind an in-progress run rather than killing it (one pending run is held per group), so the cron waits out a merge scan instead of racing it
• Also fixes the knock-on: a cancelled run records the failure in the overlay-base Actions cache, so the next scan silently drops improved incremental analysis and runs slower

This restores what the workflow originally shipped with; the blanket true came in alongside the weekly-cron change and the collision window widened 7x when the cron went back to daily.

Type of Change

• Bug fix

Testing

actionlint clean and the YAML parses with the expression intact. No generator or audit in check:audits reads .github/workflows/**, and check:cron-parity covers the app crontab (docker/crontab, helm/sim/values.yaml), not Actions schedules.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 17, 2026 6:14pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with pull-request superseding preserved and non-PR cancellation removed as intended.

Summary

This PR narrows CodeQL concurrency cancellation to pull-request runs.

• Superseded scans for the same pull request continue to be cancelled.
• Push, scheduled, and manually dispatched scans no longer cancel an active run sharing their ref.
• Non-PR runs instead use GitHub Actions' single-pending-run concurrency behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[CodeQL workflow triggered] --> B{pull_request event?}
  B -->|Yes| C[Cancel superseded run in PR ref group]
  B -->|No| D[Preserve active run]
  D --> E[Hold latest run pending for shared ref group]

Loading

_{Reviews (1) · Last reviewed commit: "fix(ci): stop the CodeQL cron cancelling..."}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}