ci: supersede stale workflow runs with concurrency groups

.github/workflows/auto-label.yml

@@ -9,6 +9,12 @@ on:
 permissions:
   pull-requests: write
   issues: write
+# See the note in ci.yml. Keyed on the PR/issue number rather than
+# `github.ref`, which is the default branch for the `issues` event and would
+# collapse every issue into a single group.
+concurrency:
+  group: auto-label-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
 jobs:
   label:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -13,6 +13,17 @@ permissions:
   contents: read
   actions: read
 
+# Supersede a PR's own older runs. Without this, every push to a branch left
+# its previous CI run queued, and a burst of PR activity saturated the Actions
+# concurrency limit with runs whose results nothing would ever read.
+# `github.ref` is `refs/pull/<n>/merge` on `pull_request`, so PRs never share a
+# group with each other or with main.
+concurrency:
+  group: ci-${{ github.ref }}
+  # PRs only. A push to main is the record of whether main is green; cancelling
+  # it would leave that question unanswered for the commit that landed.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   guards:
     # Fail fast on the class of breakage that shipped to main un-caught:

.github/workflows/codeql-analysis.yml

@@ -14,6 +14,13 @@ permissions:
   security-events: write
   actions: read
 
+# See the note in ci.yml.
+concurrency:
+  group: codeql-${{ github.ref }}
+  # PRs only. A cancelled run on main or on the weekly schedule uploads no
+  # SARIF, which would silently stale the security dashboard rather than fail.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: "Security Scan - ${{ matrix.language }}"

.github/workflows/dependency-review.yml

@@ -9,6 +9,12 @@ permissions:
   contents: read
   pull-requests: write
 
+# See the note in ci.yml. This workflow is `pull_request`-only, so every run
+# is superseded by the next push to the same PR.
+concurrency:
+  group: dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   dependency-review:
     runs-on: ubuntu-latest

.github/workflows/e2e-tests.yml

@@ -12,6 +12,11 @@ permissions:
   issues: write
   deployments: read
 
+# See the note in ci.yml.
+concurrency:
+  group: e2e-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   # By default the E2E suite runs against production. To validate a PR's own
   # Vercel preview instead, two things are needed:

.github/workflows/pr-checks.yml

@@ -6,6 +6,13 @@ on:
 
 permissions: {}
 
+# See the note in ci.yml. Keyed on the PR number, not `github.ref`: on
+# `pull_request_target` the ref is the *base* branch, so every open PR would
+# share one group and cancel the others. Mirrors pr-governance.yml.
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest

.github/workflows/security.yml

@@ -15,6 +15,13 @@ permissions:
   security-events: write
   actions: read
 
+# See the note in ci.yml.
+concurrency:
+  group: security-scan-${{ github.ref }}
+  # PRs only — this workflow also uploads security results on main and on the
+  # weekly schedule.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   npm-audit:
     runs-on: ubuntu-latest