ci(actions): bound superseded PR runs

.github/workflows/prepare-pypi-release.yml

@@ -215,7 +215,7 @@ jobs:
 
       - name: Clean local release artifacts
         run: |
-          rm -rf build dist *.egg-info release-sbom.cdx.json release-provenance.json
+          rm -rf -- build dist ./*.egg-info release-sbom.cdx.json release-provenance.json
 
       - name: Commit and push release branch
         run: |

.github/workflows/security-process.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [develop, main, master]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [develop, main, master]
   schedule:
     - cron: "31 4 * * 1"
@@ -13,8 +14,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   appguardrail-scan:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -53,6 +59,7 @@ jobs:
           retention-days: 7
 
   trivy-fs:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     permissions:
       contents: read