ci(actions): bound superseded PR runs

.github/workflows/commercial-readiness-agent-coverage.yml

@@ -20,6 +20,7 @@ on:
       - ".github/workflows/commercial-readiness-loop.yml"
       - ".github/workflows/commercial-readiness-agent-coverage.yml"
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
     paths:
       - "scripts/ci/commercial_readiness_loop.py"
@@ -42,11 +43,12 @@ permissions:
   contents: read
 
 concurrency:
-  group: commercial-readiness-agent-coverage-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   exact-commercial-agent-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/controlplane-schema-coverage.yml

@@ -11,6 +11,7 @@ on:
       - "CHANGELOG.d/871-retention-schema-migration.md"
       - ".github/workflows/controlplane-schema-coverage.yml"
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
     paths:
       - "appguardrail_core/controlplane_schema.py"
@@ -24,11 +25,12 @@ permissions:
   contents: read
 
 concurrency:
-  group: controlplane-schema-coverage-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   exact-controlplane-schema-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

.github/workflows/openssf-evidence-coverage.yml

@@ -2,15 +2,21 @@ name: OpenSSF Evidence Coverage
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
   push:
     branches: [develop, main]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   exact-openssf-evidence-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:

.github/workflows/pinned-https-coverage.yml

@@ -2,15 +2,21 @@ name: Pinned HTTPS Coverage
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
   push:
     branches: [develop, main]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   exact-pinned-https-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:

.github/workflows/prepare-pypi-release.yml

@@ -22,6 +22,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: false
+
 jobs:
   prepare-release:
     runs-on: ubuntu-latest
@@ -215,7 +219,7 @@ jobs:
 
       - name: Clean local release artifacts
         run: |
-          rm -rf build dist *.egg-info release-sbom.cdx.json release-provenance.json
+          rm -rf -- build dist ./*.egg-info release-sbom.cdx.json release-provenance.json
 
       - name: Commit and push release branch
         run: |

.github/workflows/publish-pypi.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/retention-audit-coverage.yml

@@ -2,6 +2,7 @@ name: Retention Audit Coverage
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
   push:
     branches: [develop, main]
@@ -10,11 +11,12 @@ permissions:
   contents: read
 
 concurrency:
-  group: retention-audit-coverage-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   exact-retention-audit-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:

.github/workflows/scan-path-context-coverage.yml

@@ -4,13 +4,19 @@ on:
   push:
     branches: [develop, main]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   exact-coverage:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/security-process.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [develop, main, master]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main, master]
   schedule:
     - cron: "31 4 * * 1"
@@ -13,8 +14,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   appguardrail-scan:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -51,46 +57,3 @@ jobs:
           path: appguardrail-scan.txt
           if-no-files-found: error
           retention-days: 7
-
-  trivy-fs:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run Trivy FS scan
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scan-ref: .
-          scanners: vuln,secret,misconfig
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: "1"
-
-      - name: Upload Trivy SARIF to code scanning
-        if: >-
-          always()
-          && hashFiles('trivy-results.sarif') != ''
-          && (github.event_name != 'pull_request'
-              || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
-        with:
-          sarif_file: trivy-results.sarif
-
-      - name: Upload Trivy SARIF artifact
-        if: always() && hashFiles('trivy-results.sarif') != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: trivy-results
-          path: trivy-results.sarif
-          if-no-files-found: error
-          retention-days: 7

.github/workflows/tests.yml

@@ -4,13 +4,19 @@ on:
   push:
     branches: [develop, main]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     branches: [develop, main]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pytest:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     name: Unit tests (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:

tests/test_retention_audit_release_contract.py

@@ -89,7 +89,7 @@ def test_exact_coverage_workflow_tracks_every_core_surface() -> None:
     ).read_text(encoding="utf-8")
 
     assert "permissions:\n  contents: read" in workflow
-    assert "cancel-in-progress: true" in workflow
+    assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in workflow
     assert "appguardrail_core/audit_events.py" in workflow
     assert "appguardrail_core/retention_policy.py" in workflow
     assert "tests/test_audit_events.py" in workflow

tests/test_workflow_concurrency_contract.py

@@ -0,0 +1,40 @@
+"""GitHub Actions concurrency contracts."""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOWS = ROOT / ".github" / "workflows"
+PR_WORKFLOWS = (
+    "commercial-readiness-agent-coverage.yml",
+    "controlplane-schema-coverage.yml",
+    "openssf-evidence-coverage.yml",
+    "pinned-https-coverage.yml",
+    "retention-audit-coverage.yml",
+    "scan-path-context-coverage.yml",
+    "security-process.yml",
+    "tests.yml",
+)
+RELEASE_WORKFLOWS = ("prepare-pypi-release.yml", "publish-pypi.yml")
+
+
+def test_pr_workflows_cancel_only_superseded_heads() -> None:
+    for name in PR_WORKFLOWS:
+        workflow = (WORKFLOWS / name).read_text(encoding="utf-8")
+        assert "${{ github.workflow }}-${{ github.repository }}-" in workflow
+        assert "github.event.pull_request.number || github.run_id" in workflow
+        assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in workflow
+        assert (
+            "types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]"
+            in workflow
+        )
+        assert "github.event.pull_request.draft == false" in workflow
+
+
+def test_release_workflows_serialize_without_dropping_delivery() -> None:
+    for name in RELEASE_WORKFLOWS:
+        workflow = (WORKFLOWS / name).read_text(encoding="utf-8")
+        assert "group: ${{ github.workflow }}-${{ github.repository }}" in workflow
+        assert "github.run_id" not in workflow.split("jobs:", 1)[0]
+        assert "queue:" not in workflow.split("jobs:", 1)[0]
+        assert "cancel-in-progress: false" in workflow