From 9a12d868149ab4b2a3a1d7d34de4d116ab5a0773 Mon Sep 17 00:00:00 2001 From: lidongyang Date: Tue, 25 Aug 2026 16:47:14 +0800 Subject: [PATCH 1/2] [improvement](workflow) Keep only latest code review per PR ### What problem does this PR solve? Issue Number: N/A Related PR: N/A Problem Summary: Cancel an older Code Review Runner job when a newer review is requested for the same PR. Keep concurrency at job scope so unrelated skipped issue comments do not cancel active reviews, and require a fresh review request instead of rerunning an older workflow attempt. ### Release note None ### Check List (For Author) - Test: Manual test - Parsed the workflow with Ruby/Psych - Ran actionlint and confirmed only the four pre-existing shellcheck findings remain - Verified the PR-keyed concurrency and first-attempt policy assertions - Behavior changed: Yes. Only the latest review request for a PR keeps running. - Does this need documentation: No --- .github/workflows/code-review-runner.yml | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/code-review-runner.yml b/.github/workflows/code-review-runner.yml index 6a0ed2e1b9af25..997fe0e5953c61 100644 --- a/.github/workflows/code-review-runner.yml +++ b/.github/workflows/code-review-runner.yml @@ -55,19 +55,27 @@ permissions: jobs: code-review: runs-on: ubuntu-latest + concurrency: + group: code-review-${{ inputs.pr_number || github.event.issue.number || github.run_id }} + cancel-in-progress: true # Pre-finalization steps can use 183 minutes and auth sync can use 8 more, # leaving 12 minutes for runner setup and post-job cleanup. timeout-minutes: 203 + # Retry with a new /review request so an older workflow rerun cannot replace + # the latest review for the same PR. if: >- - inputs.pr_number != '' || + github.run_attempt == 1 && ( - github.event_name == 'issue_comment' && - github.event.issue.pull_request && - startsWith(github.event.comment.body, '/review') && + inputs.pr_number != '' || ( - github.event.comment.author_association == 'MEMBER' || - github.event.comment.author_association == 'OWNER' || - github.event.comment.author_association == 'COLLABORATOR' + github.event_name == 'issue_comment' && + github.event.issue.pull_request && + startsWith(github.event.comment.body, '/review') && + ( + github.event.comment.author_association == 'MEMBER' || + github.event.comment.author_association == 'OWNER' || + github.event.comment.author_association == 'COLLABORATOR' + ) ) ) steps: From 711af669dd063cae540687b73f6edef6e3c4b590 Mon Sep 17 00:00:00 2001 From: lidongyang Date: Tue, 25 Aug 2026 17:45:05 +0800 Subject: [PATCH 2/2] [improvement](workflow) Cancel outdated PR validation jobs ### What problem does this PR solve? Issue Number: N/A Related PR: #67119 Problem Summary: Extend per-PR latest-run concurrency from Code Review Runner to License Check, FE Code Style Checker, Code Formatter, and Gitleaks PR Check. PR jobs share a stable PR-number group, while non-PR License Check runs use a unique run id and remain independent. ### Release note None ### Check List (For Author) - Test: Manual test - Parsed all five workflows with Ruby/Psych - Ran actionlint and confirmed only existing baseline findings remain - Verified all five PR-number concurrency groups and cancel-in-progress policies - Behavior changed: Yes. New PR runs cancel older jobs from these workflows for the same PR. - Does this need documentation: No --- .github/workflows/checkstyle.yaml | 4 +++- .github/workflows/clang-format.yml | 3 +++ .github/workflows/gitleaks-pr-check.yml | 3 +++ .github/workflows/license-eyes.yml | 3 +++ 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/checkstyle.yaml b/.github/workflows/checkstyle.yaml index 74fa4156ca8767..df6c8d504ee63c 100644 --- a/.github/workflows/checkstyle.yaml +++ b/.github/workflows/checkstyle.yaml @@ -26,6 +26,9 @@ jobs: java-checkstyle: name: "CheckStyle" runs-on: ubuntu-latest + concurrency: + group: fe-code-style-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true if: github.event_name == 'pull_request' steps: - name: Checkout @@ -56,4 +59,3 @@ jobs: if: steps.filter.outputs.fe_changes == 'true' run: cd fe && mvn clean checkstyle:check - diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index 7d73013a33772b..5109d88e5a229d 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -31,6 +31,9 @@ jobs: clang-format: name: "Clang Formatter" runs-on: ubuntu-latest + concurrency: + group: code-formatter-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true if: github.event_name == 'pull_request' steps: - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )" diff --git a/.github/workflows/gitleaks-pr-check.yml b/.github/workflows/gitleaks-pr-check.yml index 9ac7991a957525..3882dec27d30fd 100644 --- a/.github/workflows/gitleaks-pr-check.yml +++ b/.github/workflows/gitleaks-pr-check.yml @@ -28,6 +28,9 @@ jobs: gitleaks: name: Check for secrets runs-on: ubuntu-latest + concurrency: + group: gitleaks-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true env: GITLEAKS_VERSION: 8.30.0 GITLEAKS_SHA256: 79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e diff --git a/.github/workflows/license-eyes.yml b/.github/workflows/license-eyes.yml index 1e4cf021657edd..af879bd74fb40f 100644 --- a/.github/workflows/license-eyes.yml +++ b/.github/workflows/license-eyes.yml @@ -32,6 +32,9 @@ jobs: license-check: name: "License Check" runs-on: ubuntu-latest + concurrency: + group: license-check-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true if: | (github.event_name == 'pull_request') || (github.event_name == 'push' && github.ref == 'refs/heads/master')