[kavmur]

What was the problem/requirement? (What/Why)

PR-triggered CI workflows had no concurrency block, so superseded runs on a branch kept running and new pushes queued extra jobs on the shared enterprise ubuntu-latest pool. With agent-driven development pushing frequently per PR, this wastes runner capacity on a pool that degrades silently under load.

What was the solution? (How)

Applied the org admins' recommended GitHub Actions hygiene practices to the PR CI workflows (code_quality.yml, codeql.yml, security_scan.yml), purely additive:

• Concurrency cancellation with a conditional group key: pull_request events share a per-ref group so a new push supersedes the in-progress run; all other events (push/release/workflow_call) get a unique github.run_id suffix so they never cancel each other's pending runs.
• Draft-skip on the heavy matrix build so draft PRs don't consume the pool (via ready_for_review trigger + if: github.event.pull_request.draft != true). Not applied to codeql/security_scan so those keep reporting.
• Explicit fail-fast on the code_quality matrix.

What is the impact of this change?

Lower consumption of the shared Actions runner pool, especially on draft PRs and rapid push bursts. No change to what the jobs do. Verified: not a required status check — mainline only requires Semantic PR and DCO, so skipping these jobs on drafts cannot stall the merge queue.

How was this change tested?

Statically validated — every edited workflow parses cleanly with yaml.safe_load and the concurrency/if guards were confirmed structurally. Runtime behavior (cancel-on-push, draft-skip) manifests only on GitHub's runners; recommend opening as a draft first to confirm the heavy jobs skip, then marking ready.

Integ test result

N/A — CI configuration only; no src/ changes.

Installer test result

N/A — no installer/ or src/ changes.

Did you run the "Job Bundle Output Tests"? If not, why not? If so, paste the test results here.

N/A — change is limited to .github/workflows/; no submitter or adaptor code touched.

Was this change documented?

No doc changes needed — workflow-config only.

Did you modify schema files?

• Yes
• No

Is this a breaking change?

No. Draft-skip (Yes — code_quality.yml's matrix build skips draft PRs and sets explicit fail-fast.) Additive workflow metadata only; no public contract or adaptor interface changed.

[github-actions]

Claude review · advisory

Reviewed 9e54e04 (full review): 0 findings.

Open: 0 blocking · 0 should-fix · 0 nit. ✅ Nothing blocking.

_{Fix or reply to each thread; the next revision's review re-checks open threads and resolves those it agrees are handled. Resolving a thread yourself also closes it. Later revisions review only what changed.}