From f86a008602e49e17291e33ee5ee99bc99007cf4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Fri, 21 Aug 2026 09:59:11 +0200
Subject: [PATCH] ci: scope the build concurrency group per ref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow-level `concurrency: {group: pages, cancel-in-progress: false}`
was shared by every ref. GitHub cancels a *pending* run in a concurrency
group as soon as a newer run queues, so whenever runs overlapped an
unrelated PR's build was cancelled -- 2 of the last 30 runs, including a
Dependabot PR.

`build` is about to become a required status check (owncloud/admin), and a
cancelled check-run is not a success, so the shared group would block merges
until a manual re-run.

Move concurrency down to the jobs:

  - build:  group `build-${{ github.ref }}`, cancel-in-progress: true -- a PR
            build is now only superseded by a newer push to that same PR,
            i.e. only for a head SHA that no merge is gated on.
  - deploy: keeps the constant `pages` group with cancel-in-progress: false,
            preserving the one-at-a-time Pages publish. That job only runs on
            main, so it no longer contends with PR builds.

Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2889e02..6293d79 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,14 +11,17 @@ permissions:
   pages: write
   id-token: write
 
-# One concurrent deploy; cancel superseded runs on master.
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
 jobs:
   build:
     runs-on: ubuntu-latest
+    # Scoped per ref, so a PR build only ever supersedes an older build of the
+    # SAME pull request (github.ref is refs/pull/<n>/merge). A single constant
+    # group here would make every queued run cancel the previously pending one
+    # across unrelated PRs, and `build` is a required status check — a cancelled
+    # run is not a success, so that would block merges until a manual re-run.
+    concurrency:
+      group: build-${{ github.ref }}
+      cancel-in-progress: true
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -52,6 +55,12 @@ jobs:
     if: github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest
+    # One concurrent Pages deploy, never cancelled mid-publish. This job only
+    # runs on main, so the constant group serialises deploys without touching
+    # PR builds.
+    concurrency:
+      group: pages
+      cancel-in-progress: false
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}