From 3684d1e455ed49e4190a048017d320bb5e73c465 Mon Sep 17 00:00:00 2001
From: Seto Elkahfi <1797197+setoelkahfi@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:21:58 +0200
Subject: [PATCH] ci: add concurrency groups to CI and the release workflows

CI cancels the run in flight when a newer push lands on the same ref.
release-github and release-mcp-registry queue per tag and never cancel,
so a second dispatch for the same tag waits instead of racing the first.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                   | 6 ++++++
 .github/workflows/release-github.yml       | 6 ++++++
 .github/workflows/release-mcp-registry.yml | 6 ++++++
 3 files changed, 18 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7cb1fa..e85a516 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,12 @@ name: Tests
 # many).
 on: push
 
+# A newer push to the same ref supersedes the run in flight, so a burst of
+# pushes to a branch doesn't queue a full ubuntu + macOS matrix for each one.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml
index ff1face..64b3e9c 100644
--- a/.github/workflows/release-github.yml
+++ b/.github/workflows/release-github.yml
@@ -7,6 +7,12 @@ on:
         description: "Release tag (e.g. v0.2.0)"
         required: true
 
+# One release per tag at a time, and never cancelled: a half-built release
+# has to finish or fail on its own. A second dispatch for the same tag waits.
+concurrency:
+  group: release-github-${{ github.event.inputs.tag || github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
diff --git a/.github/workflows/release-mcp-registry.yml b/.github/workflows/release-mcp-registry.yml
index 860656c..a01d48d 100644
--- a/.github/workflows/release-mcp-registry.yml
+++ b/.github/workflows/release-mcp-registry.yml
@@ -7,6 +7,12 @@ on:
         description: "Release tag (e.g. v0.1.0)"
         required: true
 
+# One registry publish per tag at a time, and never cancelled: cancelling
+# `mcp-publisher` mid-publish could leave the listing half-updated.
+concurrency:
+  group: release-mcp-registry-${{ github.event.inputs.tag || github.ref }}
+  cancel-in-progress: false
+
 # OIDC is how we authenticate to the MCP Registry: the registry trusts a GitHub
 # Actions token issued for this repository, so no long-lived secret is needed.
 permissions: