ci: supersede in-flight PR runs on a new push

NativePipeline already had concurrency + cancel-in-progress, but Build,
UnitTests, Release and ShaCheck had none — so every push to a PR left the
previous run of each still going. On GitHub Free all of them share one
20-concurrent-job cap with NativePipeline's ~10 test shards, so stale runs
were not just noise: they delayed the run for the commit under review.

cancel-in-progress is gated on pull_request. A push run on main / mx-* is the
recorded CI result for that commit (and Release.yml's push path publishes),
so those are allowed to finish; only superseded PR runs get cancelled.

Not added to MarketplaceRelease.yml (tag-triggered publish — never cancel),
NightlyDispatcher.yml (scheduled), the workflow_dispatch-only workflows, or
PullRequestLabeler.yml (seconds long).

fix: make native tests cancellable

ci: make cancelling the native pipeline actually stop it

Clicking "Cancel workflow" appeared to do nothing for minutes. The reason is
that `if: always()` is exempt from cancellation by design: a step or job with
always() keeps running (and a job with it can even start) after the run is
cancelled. The pipeline used always() in eleven places, including every upload
inside archive-test-results — so on cancel each of the ~10 in-flight shards
first uploaded five artifact sets nobody was waiting for.

Replaced all of them with `!cancelled()`, which is equivalent for the cases we
care about — it is true on success AND on failure, so failing shards still
archive their screenshots/logs/videos/diffs, and jobs with skipped
dependencies still run — but is false on cancellation. A shard that trips
timeout-minutes is not "cancelled" in this sense, so timeout artifacts survive.

Not fixed here: the maestro bash harness does not trap SIGINT/SIGTERM, so a
shard mid-flow still runs to the runner's force-kill. Cancellation is much
faster, not instant.

Author: YogendraShelke

.github/actions/archive-test-results/action.yaml

@@ -12,20 +12,24 @@ inputs:
     required: false
     default: ${{ github.workspace }}
 
+# Every step below is `if: ${{ !cancelled() }}` rather than `if: always()`. Both still run
+# when the test step failed — which is the case we need these artifacts for — but always()
+# is exempt from cancellation, so cancelling a run left each shard uploading five artifact
+# sets before it could die, which is why "Cancel workflow" appeared to do nothing.
 runs:
   using: composite
   steps:
     - name: Archive runtime logs
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-runtime-logs-${{ inputs.test-type }}
         path: log/*.log
         if-no-files-found: ignore
 
     - name: Archive test screenshots
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-screenshots-${{ inputs.test-type }}
         path: ${{ inputs.workspace-path }}/maestro/images/actual/${{ inputs.platform }}/**/*.png
@@ -38,7 +42,7 @@ runs:
       # resolves the diff name against the baseline's own relative path. That nested location
       # was never matched by the screenshots glob above, so diffs were silently lost. Gather
       # any *_diff.png from wherever it landed into one flat dir for upload.
-      if: always()
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
         dest="${{ inputs.workspace-path }}/maestro/images/diff/${{ inputs.platform }}"
@@ -49,15 +53,15 @@ runs:
 
     - name: Archive screenshot diffs
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-diffs-${{ inputs.test-type }}
         path: ${{ inputs.workspace-path }}/maestro/images/diff/${{ inputs.platform }}/*.png
         if-no-files-found: ignore
 
     - name: Archive artifacts
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-artifacts-${{ inputs.test-type }}
         path: packages/pluggableWidgets/**/artifacts/
@@ -68,7 +72,7 @@ runs:
     # empty and the upload is a no-op (if-no-files-found: ignore).
     - name: Archive failure videos
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-videos-${{ inputs.test-type }}
         path: maestro/videos/*.mp4

.github/workflows/Build.yml

@@ -9,6 +9,15 @@ on:
     branches:
       - main
       - 'mx/**'
+
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Build (${{ matrix.os }})"

.github/workflows/NativePipeline.yml

@@ -418,7 +418,7 @@ jobs:
     runs-on: ubuntu-26.04
     # Skip this job if we're using artifacts from a specific run; the native bundles now come
     # from the project job (deploy + native-packager), so gate on project success.
-    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && always() && (needs.project.result == 'success') }}
+    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && !cancelled() && (needs.project.result == 'success') }}
     steps:
       - name: Debug branch value
         run: echo "Using branch ${{ needs.determine-nt-version.outputs.nt_branch }}"
@@ -535,7 +535,7 @@ jobs:
     runs-on: macos-26
     # Skip this job if we're using artifacts from a specific run; the native bundles now come
     # from the project job (deploy + native-packager), so gate on project success.
-    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && always() && (needs.project.result == 'success') }}
+    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && !cancelled() && (needs.project.result == 'success') }}
     steps:
       - name: "Check out Native Template for Native Components Test Project"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -647,7 +647,7 @@ jobs:
   android-widget-tests:
     needs: [scope, mendix-version, project, android-app, android-avd-cache]
     # Run if widgets need testing (widgets_to_test is not empty) and project succeeds
-    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && always() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && !cancelled() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
     runs-on: ubuntu-26.04
     # 30 min hard cap per widget shard. A healthy widget's flows run in ~30s each; the cap is a
     # backstop for genuinely wedged shards. Bumped 20→30 after a run where shards were cancelled
@@ -731,10 +731,12 @@ jobs:
             bash maestro/run_maestro_widget_tests.sh android "${{ matrix.widget }}" || [ "$UPDATE_BASELINES" = "true" ]
       
       - name: Archive test results
-        # always(): the test step exits non-zero on a failing shard, which would otherwise
+        # !cancelled(): the test step exits non-zero on a failing shard, which would otherwise
         # SKIP this step — i.e. we'd capture screenshots/logs/videos for green shards but NOT
-        # for the failing ones we actually need to debug. Run regardless of test outcome.
-        if: ${{ always() }}
+        # for the failing ones we actually need to debug. This covers pass AND fail, but
+        # unlike always() it is NOT exempt from cancellation, so a cancelled run stops here
+        # instead of first uploading five artifact sets per shard.
+        if: ${{ !cancelled() }}
         uses: ./.github/actions/archive-test-results
         with:
           platform: android
@@ -743,7 +745,7 @@ jobs:
   ios-widget-tests:
     needs: [scope, mendix-version, project, ios-app]
     # Run if widgets need testing (widgets_to_test is not empty) and project succeeds
-    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && always() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && !cancelled() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
     runs-on: macos-26
     # 30 min per widget shard, matching android-widget-tests. iOS needs the budget more than
     # Android: sim cold-boot + Maestro driver startup + runtime-ready wait eat several minutes
@@ -803,8 +805,10 @@ jobs:
           bash maestro/run_maestro_widget_tests.sh ios "${{ matrix.widget }}" || [ "$UPDATE_BASELINES" = "true" ]
       
       - name: Archive test results
-        # always(): capture failure artifacts (the failing shard's test step exits non-zero).
-        if: ${{ always() }}
+        # !cancelled(): capture failure artifacts (the failing shard's test step exits
+        # non-zero), but do NOT hold a cancelled run open uploading artifacts nobody wants
+        # -- always() is exempt from cancellation, !cancelled() is not.
+        if: ${{ !cancelled() }}
         uses: ./.github/actions/archive-test-results
         with:
           platform: ios
@@ -813,7 +817,7 @@ jobs:
   android-js-tests:
     needs: [scope, mendix-version, project, android-app, android-avd-cache]
     # Run if JS actions changed and project succeeds and either android-app succeeds OR we're using custom artifacts (android-app was skipped)
-    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && always() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && !cancelled() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
     runs-on: ubuntu-26.04
     timeout-minutes: 90
     steps:
@@ -883,8 +887,10 @@ jobs:
             bash maestro/run_maestro_jsactions_tests.sh android || [ "$UPDATE_BASELINES" = "true" ]
       
       - name: Archive test results
-        # always(): capture failure artifacts (the failing shard's test step exits non-zero).
-        if: ${{ always() }}
+        # !cancelled(): capture failure artifacts (the failing shard's test step exits
+        # non-zero), but do NOT hold a cancelled run open uploading artifacts nobody wants
+        # -- always() is exempt from cancellation, !cancelled() is not.
+        if: ${{ !cancelled() }}
         uses: ./.github/actions/archive-test-results
         with:
           platform: android
@@ -893,7 +899,7 @@ jobs:
   ios-js-tests:
     needs: [scope, mendix-version, project, ios-app]
     # Run if JS actions changed and project succeeds and either ios-app succeeds OR we're using custom artifacts (ios-app was skipped)
-    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && always() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && !cancelled() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
     runs-on: macos-26
     timeout-minutes: 90
     steps:
@@ -941,8 +947,10 @@ jobs:
           bash maestro/run_maestro_jsactions_tests.sh ios || [ "$UPDATE_BASELINES" = "true" ]
       
       - name: Archive test results
-        # always(): capture failure artifacts (the failing shard's test step exits non-zero).
-        if: ${{ always() }}
+        # !cancelled(): capture failure artifacts (the failing shard's test step exits
+        # non-zero), but do NOT hold a cancelled run open uploading artifacts nobody wants
+        # -- always() is exempt from cancellation, !cancelled() is not.
+        if: ${{ !cancelled() }}
         uses: ./.github/actions/archive-test-results
         with:
           platform: ios
@@ -954,9 +962,11 @@ jobs:
   # sources after a successful merge, leaving just the combined artifacts.
   aggregate-test-results:
     needs: [android-widget-tests, ios-widget-tests, android-js-tests, ios-js-tests]
-    # Run even when shards fail/cancel — the failing shards are exactly the ones whose
-    # screenshots/logs we want to inspect.
-    if: ${{ always() }}
+    # Run even when shards fail or time out — those are exactly the ones whose
+    # screenshots/logs we want to inspect. !cancelled() rather than always() so an
+    # explicitly cancelled run isn't held open merging artifacts nobody asked for
+    # (a shard that hits timeout-minutes does not make cancelled() true).
+    if: ${{ !cancelled() }}
     runs-on: ubuntu-26.04
     # The workflow-level block grants only packages:write, so every other scope defaults to
     # none. This job needs contents:read (to check out the triage script) and actions:read

.github/workflows/Release.yml

@@ -6,6 +6,14 @@ on:
   pull_request:
     branches: [main, 'mx/11.12.x']
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Release (${{ matrix.os }})"

.github/workflows/ShaCheck.yml

@@ -10,6 +10,14 @@ on:
     paths:
       - ".github/workflows/*.yml"
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   harden_security:
     name: Check SHA in GH Actions

.github/workflows/UnitTests.yml

@@ -6,6 +6,14 @@ on:
   pull_request:
     branches: [main, 'mx/11.12.x']
 
+# Supersede in-flight runs: a new push to the same PR/branch cancels the previous run
+# instead of queueing beside it (this repo shares GitHub Free's 20-concurrent-job cap with
+# NativePipeline, so stale runs directly delay the ones that matter). Only PR runs are
+# cancelled — a push run on main/mx-* is the recorded result for that commit, so let it finish.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: "Unit tests"