Cancel replaced CI runs and drop the checkout token (closes #107)

The canonical `.gitea/workflows/check.yml` lacked two settings `dnswatcher` had added, so a byte-identical re-vendor removed them. A `concurrency` block grouped by workflow and branch, with `cancel-in-progress: true`, makes a new push cancel the older run on the same branch and leaves every other branch's runs alone; on 2026-10-02 45 stale runs had queued on the one shared runner. `persist-credentials: false` on the checkout step keeps the job's token out of `.git/config`; `script/cibuild` needs no token. Each has a one-line comment, and the policy's workflow bullet and both checklists describe the file as it now is. Unverified: the two live checks, which wait on the shared runner. Model: opus-5-5
2026-10-06 05:52:57 +02:00
parent f5c4bb6e2c
commit 6aac45857a
5 changed files with 28 additions and 5 deletions
@@ -96,7 +96,9 @@ with your task.
      `fetch-depth: 0` on the CI checkout step, which clones shallow and fetches
      no tags by default.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push — reference
+      push, checks out with `persist-credentials: false`, and carries the
+      `concurrency` block that lets a new push cancel only the same branch's
+      older run — reference
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
    - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from