From 2ef2768ba6105d125b23a82a4226985f7179e990 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 29 Aug 2026 15:15:17 +0000 Subject: [PATCH 1/2] fix: give every non-PR run its own concurrency group The concurrency block landed in the previous sweep with a comment claiming that a push to main or a v* tag "always runs to completion even if another push lands behind them", on the strength of cancel-in-progress being scoped to pull_request. That is not what GitHub does. GitHub cancels a *pending* run whenever a newer run joins the same group behind an in-progress one, and that rule is independent of cancel-in-progress. With a plain ${{ github.workflow }}-${{ github.ref }} group, a queued release run on main could therefore be dropped silently by a later push to main -- both sit in Publish-refs/heads/main. Appending the unique github.run_id for every non-PR run puts each release run in a group of its own, so it is never queued behind a sibling and can never be cancelled. PR runs keep sharing a group per ref and still supersede each other, which is the whole point of the block. Ported verbatim from java-llama.cpp, where the corrected expression is confirmed empirically: the next push cancelled all 62 jobs of the previous PR run. The comment now also records the one-time overlap to expect on the commit that changes the expression, since GitHub reads concurrency from each run own ref. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH --- .github/workflows/publish.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ee5bf0f..493cc85 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,10 +24,25 @@ on: # # cancel-in-progress is deliberately scoped to pull_request ONLY. A push to main or # to a v* tag is a release path: cancelling one midway could leave a partially -# published set of artifacts, so those always run to completion even if another push -# lands behind them. +# published set of artifacts. +# +# cancel-in-progress: false is NOT sufficient on its own to protect a release run. +# GitHub cancels a *pending* run whenever a newer run joins the same group behind an +# in-progress one -- that rule is independent of cancel-in-progress. So with a plain +# `workflow-ref` group, a queued `publish_to_central` dispatch on main could be +# silently dropped by a later push to main, both sharing `Publish-refs/heads/main`. +# Giving every non-PR run its own group (via the unique run_id) means such a run is +# never queued behind a sibling and therefore can never be cancelled, while PR runs +# still share a group per ref and supersede each other as intended. +# +# One-time effect when this expression changes: GitHub reads `concurrency` from the +# workflow file at each run's own ref, so a run started before the change sits in the +# old group and a run started after it sits in the new one. They are different groups, +# so the new push does NOT supersede the in-flight old run -- exactly once, on the +# commit that lands this. It self-heals from the next push on. Expect the same overlap +# when porting this to a sibling repo; it is not a sign the expression is wrong. concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'pull_request' && 'pr' || github.run_id }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: From 32b6e3ca95ea2343d9f1ca1e3a7d2d5311345e44 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 29 Aug 2026 15:43:30 +0000 Subject: [PATCH 2/2] chore: bump build tooling, unpin CodeQL and gradle actions spotless-maven-plugin 3.10.0 -> 3.10.1, palantir-java-format 2.96.0 -> 2.97.0, pitest-maven 1.25.9 -> 1.30.0. nullaway is untouched -- this repo is already on 0.14.0 via Dependabot PR #149, and that is the version the other three siblings were just aligned to. github/codeql-action was hard-pinned at v4.37.8 in codeql.yml and scorecard.yml (init, analyze and upload-sarif); it now floats on @v4 like the other siblings, so patch releases arrive without a manual bump -- 4.37.9 is already out. gradle/actions/setup-gradle drops its @v6.3.0 pin to @v6 for the same reason. Both pins were accidental, not deliberate. Deliberately NOT taken: jqwik 1.9.3 -> 1.10.1, forbidden by workspace/policies/jqwik-prompt-injection.md; and the maven-compiler/jar/source 4.0.0-beta and surefire 3.6.0-M1 offers, which are pre-releases the versions plugin does not filter by qualifier. Verified with real exit codes: spotless:check and clean compile both pass. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/publish.yml | 2 +- .github/workflows/scorecard.yml | 2 +- pom.xml | 6 +++--- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9d62a0e..59cb58a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,9 +21,9 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-java@v6 with: { java-version: '21', distribution: temurin } - - uses: github/codeql-action/init@v4.37.8 + - uses: github/codeql-action/init@v4 with: { languages: java, queries: +security-and-quality } - name: Build with Maven run: mvn --batch-mode --no-transfer-progress compile - - uses: github/codeql-action/analyze@v4.37.8 + - uses: github/codeql-action/analyze@v4 with: { category: "/language:java" } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 493cc85..7709cb4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -204,7 +204,7 @@ jobs: with: java-version: '21' distribution: temurin - - uses: gradle/actions/setup-gradle@v6.3.0 + - uses: gradle/actions/setup-gradle@v6 with: gradle-version: "9.6.1" - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index dfe8425..4f838ef 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -43,6 +43,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@v4.37.8 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif diff --git a/pom.xml b/pom.xml index 968b04d..174d429 100644 --- a/pom.xml +++ b/pom.xml @@ -34,8 +34,8 @@ SPDX-License-Identifier: Apache-2.0 0.14.0 1.0.1 4.2.2 - 3.10.0 - 2.96.0 + 3.10.1 + 2.97.0 4.10.4.0 7.7.4 1.14.0 @@ -318,7 +318,7 @@ SPDX-License-Identifier: Apache-2.0 org.pitest pitest-maven - 1.25.9 + 1.30.0 org.sonatype.central