From c890dc59e9546ab536417826f64b12636f5c2974 Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Thu, 17 Sep 2026 11:12:35 -0700 Subject: [PATCH] fix(ci): stop the CodeQL cron cancelling the main merge scan The workflow-level `cancel-in-progress: true` applied to every trigger, but push and schedule both resolve to `refs/heads/main` and therefore share the `codeql-refs/heads/main` concurrency group. A merge landing shortly before the daily cron had its scan cancelled mid-extraction, leaving main with a red status rollup for a commit the cron then scanned clean. Scoping the cancel to `pull_request` keeps the superseding behavior where it belongs -- each PR is its own group via `refs/pull/N/merge` -- and lets non-PR events queue behind an in-progress run instead of killing it. --- .github/workflows/codeql.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d6e5122f2c4..a57f223abb2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -62,7 +62,15 @@ on: concurrency: group: codeql-${{ github.ref }} - cancel-in-progress: true + # PR runs only. Superseding is what this is for: a PR push makes the previous + # scan of that PR irrelevant, and `refs/pull/N/merge` keeps each PR in its own + # group. The push and schedule triggers both resolve to `refs/heads/main`, so a + # blanket `true` let the daily cron cancel the merge scan of the same commit -- + # a 2-minute window that finally landed on 3c8a4c4 (push 08:32:58 killed by the + # 08:34:47 cron), leaving main with a red rollup for a commit that the cron had + # in fact scanned clean. Non-PR events now queue instead: one pending run is + # held per group, so the cron simply waits out the merge scan. + cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: contents: read