ci: cancel a pull request's superseded runs

.github/workflows/audit.yml

@@ -21,6 +21,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Audits the ref that triggered the event (dependency changes on push / PR).
   audit:

.github/workflows/ci.yml

@@ -20,6 +20,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   fmt:
     name: rustfmt – check

.github/workflows/codeql.yml

@@ -55,6 +55,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/dse-check.yml

@@ -35,6 +35,13 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   dse-check:
     name: DSE - volatile zero-store survival (${{ matrix.os }}, ${{ matrix.toolchain }})

.github/workflows/fuzz-quick.yml

@@ -23,6 +23,13 @@ on:
       - ".github/workflows/fuzz-quick.yml"
   workflow_dispatch: # manual trigger when you need a long run
 
+# A newer push to the same pull request cancels the run it supersedes. Every other run
+# (pushes to `main`, the schedule, manual dispatch) gets a group of its own and is never
+# cancelled, so each `main` commit keeps a complete result to check a release tag against.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   fuzz:
     runs-on: ubuntu-latest