Cancel replaced CI runs and drop the checkout token (closes #107)

The canonical `.gitea/workflows/check.yml` lacked two settings `dnswatcher` had added, so a byte-identical re-vendor removed them. A `concurrency` block grouped by workflow and branch, with `cancel-in-progress: true`, makes a new push cancel the older run on the same branch and leaves every other branch's runs alone; on 2026-10-02 45 stale runs had queued on the one shared runner. `persist-credentials: false` on the checkout step keeps the job's token out of `.git/config`; `script/cibuild` needs no token. Each has a one-line comment, and the policy's workflow bullet and both checklists describe the file as it now is. Unverified: the two live checks, which wait on the shared runner. Model: opus-5-5
2026-10-06 05:52:57 +02:00
parent f5c4bb6e2c
commit 6aac45857a
5 changed files with 28 additions and 5 deletions
@@ -21,6 +21,12 @@ fmt-check, and commit.

 # Completed Steps

+- 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
+  block, so a new push cancels the older run on the same branch and no other,
+  and its checkout step sets `persist-credentials: false`, so the job's token is
+  not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists
+  describe the workflow as it now is. Not yet tried on the shared runner, which
+  is out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
  package that also calls `ResponseWriter.Header()`, so the same tree can fail