[altaywtf]

Every main push now finishes its CI run, so the secret and workflow scan covers each pushed range, and verification checks out one commit instead of full history.

	Before	After
Push and dispatch runs	one CI-refs/heads/main group; a third push cancels the pending second run, whose range is never scanned	one group per run; every pushed range is scanned
Pull request runs	superseded runs cancelled	unchanged
verify and verify-consumer-surface checkouts	full history	default depth

• Releases stay serialized by the shared release workflow's own release-<repo>-main group, which keeps full history for semantic-release. That group holds one pending release, so if three pushes land within one release and the older verify finishes last, semantic-release skips the stale commit and the newer commits publish on the next push.
• The scan deepens its own clone to the pushed range, or to full history on dispatch.
• The scan passes through on pull requests; actionlint 1.7.12 and zizmor 1.29.0 report nothing on this branch locally, and the first main run after merge audits the change.
• Merging runs verify and the release job on main; a ci: commit publishes nothing.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes release-triggering CI concurrency and checkout depth, which are operationally sensitive and warrant a final human review despite the logic verifying as correct.

Review effort: Balanced
Findings: None

What changed in this PR

This PR adjusts the CI workflow so that every push to main runs to completion (ensuring the push-time secret/workflow scan covers each pushed commit range) and makes the verify jobs check out a shallow (default-depth) clone instead of full history. Previously all main pushes shared one concurrency group (CI-refs/heads/main), so with cancel-in-progress: false a third queued push could cancel the pending second run and leave its range unscanned. The change gives each non-PR run a unique concurrency group keyed on github.run_id, while pull-request runs keep ref-based grouping and remain cancellable. It is a CI-only change and publishes nothing on merge (ci: type).

Changes:

• Concurrency group now uses github.ref for pull_request events and the unique github.run_id for push/workflow_dispatch, so main pushes no longer cancel one another.
• Removed fetch-depth: 0 from the verify and verify-consumer-surface checkouts; the push-time scan action deepens its own shallow clone as needed, and the release reusable workflow still checks out full history for semantic-release.

File	Description
.github/​workflows/​ci.yml	Keys the concurrency group on run_id for non-PR events so every main push is scanned, and drops fetch-depth: 0 from both verify checkouts to use shallow clones.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[putio-ci]

🎉 This PR is included in version 3.0.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀