From 2a398fb2fdff166a91769fa95e3aa773a007f521 Mon Sep 17 00:00:00 2001
From: James Rich <2199651+jamesarich@users.noreply.github.com>
Date: Fri, 18 Sep 2026 17:34:59 -0700
Subject: [PATCH] Cancel superseded runs of Check PR Labels and Semgrep
 Differential Scan (#11906)

* Cancel superseded runs of Check PR Labels and Semgrep Differential Scan

Both workflows trigger on pull_request without a concurrency group, so
every push, label or edit on a PR queues a fresh run while the earlier
ones keep their place in the org's shared runner queue. Check PR Labels
listens to six event types, so opening, labelling and editing one PR
queued three identical runs within a minute today.

Give each the same head_ref-keyed group with cancel-in-progress that
CI, Tests and the trunk check already use. Develop pushes are
unaffected: they fall through to run_id, as before.

* Key the new concurrency groups by PR number, not head_ref

Fork PRs often come from a branch named develop, so two of them share
github.head_ref and one would cancel the other's run. The PR number is
unique per PR.
---
 .github/workflows/pr_enforce_labels.yml     | 4 ++++
 .github/workflows/sec_sast_semgrep_pull.yml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/pr_enforce_labels.yml b/.github/workflows/pr_enforce_labels.yml
index bf2239f63..3b98dafcd 100644
--- a/.github/workflows/pr_enforce_labels.yml
+++ b/.github/workflows/pr_enforce_labels.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [opened, edited, labeled, unlabeled, synchronize, reopened]
 
+concurrency:
+  group: pr-labels-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   pull-requests: read
   contents: read
diff --git a/.github/workflows/sec_sast_semgrep_pull.yml b/.github/workflows/sec_sast_semgrep_pull.yml
index 1508e0822..3783fae41 100644
--- a/.github/workflows/sec_sast_semgrep_pull.yml
+++ b/.github/workflows/sec_sast_semgrep_pull.yml
@@ -2,6 +2,10 @@
 name: Semgrep Differential Scan
 on: pull_request
 
+concurrency:
+  group: semgrep-diff-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs: