[Minor] ci: dedupe concurrent push + pull_request runs

A commit on a branch with an open PR triggers two full ci runs at once:
one for the push event (ref refs/heads/<branch>) and one for the
pull_request event (ref refs/pull/<n>/merge). Besides wasting runner
time they share GitHub's hosted runners and double the CPU load, which
is enough to push the heavy 001_merged rspamd's controller startup past
the functional suites' fixed readiness timeouts -- the residual
440_ssl_server flake reproduced only on whichever of the two same-SHA
runs lost the CPU race (the other passed).

Add a top-level concurrency group keyed on the head commit SHA with
cancel-in-progress. push and pull_request expose the head differently
(github.sha vs github.event.pull_request.head.sha -- the latter is the
real head on PR events, where github.sha is the merge commit), so the
group key uses pull_request.head.sha when present and falls back to
github.sha, collapsing both events for one commit into a single run.

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c29bdc43b8fe0ca08236af32c0ea6ac565666059..8d8ae15b5464771dc27be35a13629ad2b48e60a5 100644 (file)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,19 @@ on:
     branches:
       - '**'
 
+# A commit pushed to a branch that also has an open PR fires two runs at
+# once: one for `push` (ref refs/heads/<branch>) and one for `pull_request`
+# (ref refs/pull/<n>/merge). They duplicate each other's work and, sharing
+# the hosted runners, double CPU load -- which is enough to push the heavy
+# 001_merged rspamd's controller startup past the functional suites' fixed
+# readiness timeouts and flake (e.g. 440_ssl_server). The only identifier
+# the two events share is the head commit SHA (their refs differ), so key
+# the concurrency group on it: both events for one commit collapse to a
+# single run, and cancel-in-progress reaps the loser instead of racing it.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   linters:
     uses: ./.github/workflows/ci_linters.yml