CI: cancel superseded actionlint and skill-docs runs #2046

Summary

Two always-on lightweight workflows run on both push and pull_request but do not declare concurrency, so same-repo PR branch updates can leave stale duplicate runs queued/running for the same commit series:

• .github/workflows/actionlint.yml
• .github/workflows/skill-docs.yml

The heavier workflows already use this pattern, for example:

• .github/workflows/evals.yml has concurrency: group: evals-${{ github.head_ref }} + cancel-in-progress: true
• .github/workflows/windows-free-tests.yml has concurrency: group: windows-free-${{ github.head_ref }} + cancel-in-progress: true
• .github/workflows/make-pdf-gate.yml, version-gate.yml, and pr-title-sync.yml also cancel superseded runs

Evidence inspected

Repo-local files inspected:

• README.md
• CONTRIBUTING.md
• .github/workflows/actionlint.yml
• .github/workflows/skill-docs.yml
• .github/workflows/evals.yml
• .github/workflows/make-pdf-gate.yml
• .github/workflows/pr-title-sync.yml
• .github/workflows/version-gate.yml
• .github/workflows/windows-free-tests.yml
• .github/workflows/windows-setup-e2e.yml
• .github/actionlint.yaml
• recent merged PRs including v1.58.1.0 feat: hermetic local E2E + Conductor prose AskUserQuestion #2004, v1.58.0.0 feat: diagram + multi-format document engine (mermaid, excalidraw, single-file HTML, DOCX) #1990, v1.57.10.0 feat: Codex review default-on across review/ship/plan/docs #1966, v1.57.9.0 feat: source-clean gbrain render (dev-setup --out-dir + machine-wide gbrain-refresh) #1951, v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) #1929, v1.57.7.0 feat: GSTACK REVIEW REPORT always declares unresolved decisions #1916, v1.57.4.0 refactor(ethos): rename Boil the Lake principle to Boil the Ocean #1912, v1.57.6.0 fix wave: 8 community bugs (4 security guards failing open) #1911

Commands used for duplicate/evidence checks:

gh issue list -R garrytan/gstack --state open --limit 200 --json number,title,body,url
gh pr list -R garrytan/gstack --state open --limit 200 --json number,title,body,url
gh issue list -R garrytan/gstack --state open --search 'concurrency OR "cancel-in-progress" OR "duplicate workflow" OR "double run"' --limit 50 --json number,title,url
gh pr list -R garrytan/gstack --state open --search 'concurrency OR "cancel-in-progress" OR "duplicate workflow" OR "double run"' --limit 50 --json number,title,url
gh issue list -R garrytan/gstack --state open --search '"push + pull_request" "concurrency" "skill-docs" "actionlint"' --limit 20 --json number,title,url
gh pr list -R garrytan/gstack --state open --search '"push + pull_request" "concurrency" "skill-docs" "actionlint"' --limit 20 --json number,title,url

Duplicate search found no open issue or PR specifically covering missing concurrency on actionlint.yml + skill-docs.yml.

Expected impact

Lower CI noise and queue waste for active branches. Contributors see the newest Workflow Lint / Skill Docs Freshness result instead of waiting on obsolete runs from previous pushes.

This is small, but it matches the repo's existing CI posture: expensive or high-frequency workflows should cancel superseded runs.

Suggested fix

Add concurrency blocks to the two missing workflows:

concurrency:
  group: actionlint-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

concurrency:
  group: skill-docs-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

Also add a static regression test that scans .github/workflows/*.yml and fails when a workflow with both push and pull_request triggers lacks cancel-in-progress: true.

I validated this locally with a small patch:

bun test test/workflow-concurrency.test.ts
go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.11 .github/workflows/actionlint.yml .github/workflows/skill-docs.yml

Both passed.

Why not PR here?

I prepared and locally verified a 3-file patch, but the available GitHub token cannot push workflow changes:

remote rejected: refusing to allow an OAuth App to create or update workflow `.github/workflows/actionlint.yml` without `workflow` scope

So filing the focused issue is the safe handoff path.