From 5f5f38f3f15ff1db1c16982513da849e4ec732fa Mon Sep 17 00:00:00 2001
From: William So <polyipseity@gmail.com>
Date: Wed, 11 Feb 2026 11:15:23 +0800
Subject: [PATCH 1/2] ci: deduplicate workflow runs by PR-first then SHA; add
 concurrency and branch filter for push

---
 .github/workflows/check.yml  | 11 +++++++++++
 .github/workflows/docker.yml | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 9442fc4..022cc95 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -2,9 +2,20 @@ name: Checks
 
 on:
   push:
+    branches:
+      - main
   pull_request:
   workflow_dispatch:
 
+# Use concurrency to deduplicate runs.
+# - For pull requests: group by `pr-<number>` so multiple commits to the same PR
+#   cancel previous runs and only the latest is kept.
+# - For direct pushes: fall back to deduplicating by commit SHA so identical
+#   commits don't trigger multiple concurrent workflows.
+concurrency:
+  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
+  cancel-in-progress: true
+
 # Minimal file-level permissions for checks: read repository contents for linting/tests
 permissions:
   contents: read
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index c0dfbe9..9467df1 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -2,9 +2,20 @@ name: Docker CI
 
 on:
   push:
+    branches:
+      - main
   pull_request:
   workflow_dispatch:
 
+# Use concurrency to deduplicate runs.
+# - For pull requests: group by `pr-<number>` so multiple commits to the same PR
+#   cancel previous runs and only the latest is kept.
+# - For direct pushes: fall back to deduplicating by commit SHA so identical
+#   commits don't trigger multiple concurrent workflows.
+concurrency:
+  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
+  cancel-in-progress: true
+
 # Minimize permissions for Docker CI; only allow read access to repo contents
 # and package write for pushing images to GHCR.
 permissions:

From 952e4537f98bf974886f4188f0774e7fb46a907c Mon Sep 17 00:00:00 2001
From: William So <polyipseity@gmail.com>
Date: Wed, 11 Feb 2026 11:21:28 +0800
Subject: [PATCH 2/2] ci: include workflow name in concurrency group

---
 .github/workflows/check.yml  | 3 ++-
 .github/workflows/docker.yml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 022cc95..99b5bc4 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -12,8 +12,9 @@ on:
 #   cancel previous runs and only the latest is kept.
 # - For direct pushes: fall back to deduplicating by commit SHA so identical
 #   commits don't trigger multiple concurrent workflows.
+# - Include the `github.workflow` name in the group to avoid cross-workflow collisions.
 concurrency:
-  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
   cancel-in-progress: true
 
 # Minimal file-level permissions for checks: read repository contents for linting/tests
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9467df1..4fb8deb 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -12,8 +12,9 @@ on:
 #   cancel previous runs and only the latest is kept.
 # - For direct pushes: fall back to deduplicating by commit SHA so identical
 #   commits don't trigger multiple concurrent workflows.
+# - Include the `github.workflow` name in the group to avoid cross-workflow collisions.
 concurrency:
-  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
   cancel-in-progress: true
 
 # Minimize permissions for Docker CI; only allow read access to repo contents