From f2ed056bab19afed997214f9e947662ba5e217af Mon Sep 17 00:00:00 2001 From: admin Date: Wed, 12 Aug 2026 09:01:31 -0500 Subject: [PATCH] fix(hybrid-gate): key the concurrency group by SHA on push On a default branch the ref is constant, so a ref-keyed group made every merge cancel the previous commit's gate. Measured in aletheia over one window, two consecutive merges each lost their verdict entirely -- 53ba8110b and 8dd94b02c, where the caller's own jobs went green and every job defined here was cancelled. The split falling exactly on the caller/callee boundary is what identified the cause: aletheia's caller had already SHA-keyed its pushes for precisely this reason, and this group had not, so the fix was half-applied and the half that mattered -- fmt, check, clippy, nextest, the trailer logic, i.e. what the required context actually attests -- kept being cancelled. It is worse than a missing verdict. `Evaluate gate result` fails on a cancelled upstream, so the commit reports RED with nothing wrong, which teaches everyone to discount red on a default branch. aletheia has since made that reporting distinguishable (aletheia#6706), but that only stops the two looking alike; it does not restore the lost verdict. This does. PRs keep ref-keying, so a force-push still supersedes its own in-flight run. Refs: aletheia#6701 --- .github/workflows/hybrid-gate.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hybrid-gate.yml b/.github/workflows/hybrid-gate.yml index 97c10a6..b541b05 100644 --- a/.github/workflows/hybrid-gate.yml +++ b/.github/workflows/hybrid-gate.yml @@ -134,8 +134,20 @@ env: # caller's context in a reusable call) and repo-scoped, so each adopting repo # cancels only its own superseded PR runs. Callers must NOT also set a # concurrency group with this key, or the shared group self-cancels. +# +# WHY the SHA on a push: on a default branch the ref is CONSTANT, so a ref-keyed +# group made every merge cancel the previous commit's gate. Measured in aletheia +# over one window, two consecutive merges each lost their verdict entirely -- +# 53ba8110b and 8dd94b02c, where the caller's own jobs went green and every job +# defined here was cancelled. The split fell exactly on the caller/callee +# boundary, because the caller had already SHA-keyed its pushes for this reason +# and this group had not. Worse than a missing verdict: `Evaluate gate result` +# fails on a cancelled upstream, so the commit reports RED with nothing wrong, +# which teaches people to discount red on a default branch. +# +# PRs keep ref-keying, so a force-push still supersedes its own in-flight run. concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }} cancel-in-progress: true jobs: