Merge branch 'main' into refactor/echidna-l3-wave3-sharedbase-l1-guix

Author: hyperpolymath

.github/workflows/agda-meta-checker.yml

@@ -15,6 +15,12 @@ on:
       - 'meta-checker/**'
   workflow_dispatch:
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/boj-build.yml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+# Cause-B mitigation (#77): de-duplicate stacked BoJ build triggers.
+# cancel-in-progress is false so an in-flight dispatch always completes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest

.github/workflows/cargo-audit.yml

@@ -14,30 +14,48 @@ on:
     # Run weekly on Monday at 06:00 UTC to catch new advisories.
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   audit:
     name: Dependency audit
     runs-on: ubuntu-latest
-    if: hashFiles('Cargo.lock') != ''
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
+      - name: Detect Cargo.lock
+        id: detect
+        run: |
+          if [ -f Cargo.lock ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "No Cargo.lock — skipping dependency audit." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Install Rust toolchain
+        if: steps.detect.outputs.present == 'true'
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Install cargo-audit
+        if: steps.detect.outputs.present == 'true'
         run: cargo install cargo-audit --locked
 
       - name: Run cargo audit
+        if: steps.detect.outputs.present == 'true'
         run: cargo audit
 
       - name: Write summary
-        if: always()
+        if: always() && steps.detect.outputs.present == 'true'
         run: |
           echo "## Cargo Audit Results" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/cflite_pr.yml

@@ -4,6 +4,12 @@ on:
   pull_request:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded fuzzing runs so rapid
+# PR pushes don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/chapel-ci.yml

@@ -19,6 +19,12 @@ on:
       - 'Cargo.toml'
       - '.github/workflows/chapel-ci.yml'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/codeql.yml

@@ -9,6 +9,12 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/container-ci.yml

@@ -13,6 +13,10 @@ name: Container Build Verification
 
 on:
   push:
+    # Cause-B mitigation (#77): was any-branch (path-filtered only);
+    # scoped to integration branches so feature-branch pushes that
+    # touch these paths don't also fan out a container build.
+    branches: [main, master]
     paths:
       - 'Containerfile'
       - '.containerization/**'
@@ -34,6 +38,13 @@ on:
     # so the container build does not race the live-prover tests.
     - cron: '0 6 * * 0'
 
+# Cause-B mitigation (#77): de-duplicate superseded builds on the same
+# ref. cancel-in-progress is false so an in-flight image build/publish
+# is never interrupted mid-push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/dogfood-gate.yml

@@ -12,6 +12,12 @@ on:
   push:
     branches: [main, master]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -256,31 +262,37 @@ jobs:
 
           echo "has_manifest=true" >> "$GITHUB_OUTPUT"
 
-          # Validate TOML structure using Python 3.11+ tomllib
-          python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
+          # Validate TOML structure using Python 3.11+ tomllib.
+          # The Python heredoc body sits at the YAML block-scalar base
+          # indentation, so after GitHub strips the block's common indent
+          # the interpreter receives it column-aligned (no sed dedent —
+          # a sed-based dedent breaks because YAML removes the block's
+          # leading indent before the script ever reaches the shell).
+          if ! python3 - <<'PY'
+          import tomllib, sys
+          with open('eclexiaiser.toml', 'rb') as f:
+              data = tomllib.load(f)
+          project = data.get('project', {})
+          if not project.get('name', '').strip():
+              print('ERROR: project.name is required', file=sys.stderr)
+              sys.exit(1)
+          functions = data.get('functions', [])
+          if not functions:
+              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
+              sys.exit(1)
+          for fn in functions:
+              if not fn.get('name', '').strip():
+                  print('ERROR: function name cannot be empty', file=sys.stderr)
+                  sys.exit(1)
+              if not fn.get('source', '').strip():
+                  print(f'ERROR: function {fn["name"]} has no source path', file=sys.stderr)
+                  sys.exit(1)
+          print(f'Valid: {project["name"]} ({len(functions)} function(s))')
+          PY
+          then
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
-          }
+          fi
 
       - name: Write summary
         run: |

.github/workflows/formal-verification.yml

@@ -29,6 +29,12 @@ on:
     paths:
       - 'crates/echidna-core-spark/**'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/ghcr-publish.yml

@@ -9,6 +9,12 @@ on:
     types: [published]
   workflow_dispatch:
 
+# Cause-B mitigation (#77): de-duplicate stacked publish runs.
+# cancel-in-progress is false — never abort an image publish in flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}