ci: supersede in-flight PR runs on a new push

NativePipeline already had concurrency + cancel-in-progress, but Build,
UnitTests, Release and ShaCheck had none — so every push to a PR left the
previous run of each still going. On GitHub Free all of them share one
20-concurrent-job cap with NativePipeline's ~10 test shards, so stale runs
were not just noise: they delayed the run for the commit under review.

cancel-in-progress is gated on pull_request. A push run on main / mx-* is the
recorded CI result for that commit (and Release.yml's push path publishes),
so those are allowed to finish; only superseded PR runs get cancelled.

Not added to MarketplaceRelease.yml (tag-triggered publish — never cancel),
NightlyDispatcher.yml (scheduled), the workflow_dispatch-only workflows, or
PullRequestLabeler.yml (seconds long).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: YogendraShelke

.github/workflows/Build.yml

@@ -9,6 +9,15 @@ on:
     branches:
       - main
       - 'mx/**'
+
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Build (${{ matrix.os }})"

.github/workflows/Release.yml

@@ -6,6 +6,14 @@ on:
   pull_request:
     branches: [main, 'mx/11.12.x']
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Release (${{ matrix.os }})"

.github/workflows/ShaCheck.yml

@@ -10,6 +10,14 @@ on:
     paths:
       - ".github/workflows/*.yml"
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   harden_security:
     name: Check SHA in GH Actions

.github/workflows/UnitTests.yml

@@ -6,6 +6,14 @@ on:
   pull_request:
     branches: [main, 'mx/11.12.x']
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Unit tests"