Cancel superseded npm/pnpm/Pipenv compatibility PR runs

[Mikola Lysenko (mikolalysenko)]

Problem

npm-compatibility.yml, pnpm-compatibility.yml and pipenv-compatibility.yml are the only PR-triggered compatibility workflows with no concurrency group. ci.yml, bun, vlt, go, composer, gradle, pdm, poetry and bench all have one. So when a PR gets a new push, the old run of these three keeps going: npm has 11 jobs (build + 10 npm legs), pnpm has 26, Pipenv 6+. They all run against a commit that will never merge.

I looked at the last 100 pull_request runs of each workflow (2026-10-05, about 11:30–20:35 UTC), counting runs where a newer run on the same branch started before the old one finished:

workflow	superseded runs	job-min in superseded runs	job-min spent after the newer push
npm hosted/vendored compatibility	16	281	215
pnpm hosted compatibility	14	146	103
Pipenv compatibility	22	286	127
total	52	713	445

That's about 445 wasted job-minutes in ~9 hours, roughly 1,200/day at the current agent-PR push rate. Those runs also hold runners the live runs need. In the same window several npm/pnpm runs show failure but none of their jobs ran a step: they sat queued with no runner and were then cancelled, e.g. 37368805617 (build queued 18 min, zero steps) and 37365426182 (12 install-proof legs queued ~30 min, zero steps). I can't say from the API alone why GitHub cancelled them, but fewer stale jobs in the queue can only help.

Root cause

These three workflows have no concurrency: block. The others got one earlier, and these were missed.

Fix

Add a top-level group to each, the same pattern the others use:

concurrency:
  group: <wf>-compat-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

This differs from the other workflows in one place: non-PR events use github.run_id, not github.ref. Even with cancel-in-progress: false, GitHub keeps only one pending run per group. A third main push arriving while one main run is in progress and one is queued would cancel the queued one. With run_id, every main push and workflow_dispatch runs to completion, exactly as today. Only an older run on the same PR gets cancelled.

Proof

• actionlint 1.7.7 is clean on all three files, before and after. PyYAML parses them.
• No group name collides with an existing one (grep -rn 'group:' .github/workflows).
• None of the three workflows saves a shared cache from a PR run, so cancelling one can't leave a cache half-written.

Also in this PR: e7026a2 cherry-picks #878's fix (it routes the Gradle/JVM digests through utils::digest). On main, production_digests_go_through_the_helpers currently fails, so test/coverage/test-release are red on every PR. The pick becomes a no-op once #878 lands.

Where each test still runs

Nothing is removed. Every leg still runs on every PR head commit, every main push and every dispatch. The only runs dropped are PR runs for a commit that already has a newer push. Required-check names are unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EQTUzCY6pkBLc3BNJhz9Nu

---

Note

Low Risk
Workflow concurrency only drops stale PR matrix jobs; Rust changes are refactors to shared digest helpers with no intended behavior change.

Overview
Adds GitHub Actions concurrency to the npm, pnpm, and Pipenv compatibility workflows so a newer push on the same PR cancels the in-flight run, while main pushes and workflow_dispatch still get their own group via github.run_id (no cross-cancellation with cancel-in-progress: false on non-PR events).

Also centralizes JVM/Gradle SHA-1 and SHA-256 hex in crate::utils::digest (gradle_cache, jvm_jar, Maven sidecars), replacing scattered sha1/sha2 + hex::encode calls—aligned with the production_digests_go_through_the_helpers expectation.

^{Reviewed by Cursor Bugbot for commit e7026a2. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Port: test (windows-latest) failed on 69ab074 because of socket_patch_core::utils::digest::tests::production_digests_go_through_the_helpers. That test is red on main too (CI run 37355008322: coverage, test windows/macos and test-release all fail), and I reproduced it locally on main. It is not caused by this PR. I cherry-picked #878's fix (659ac2c, which routes the Gradle/JVM digests through utils::digest) as e7026a2. The test passes locally with it. It becomes a no-op once #878 lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

e2e (ubuntu-latest, e2e_vendor_gradle_build e2e_vendor_jvm_build, gradle, 6.9.4, 11, …) failed on e7026a2. Its Run e2e tests step was cancelled 3m43s in ("The operation was canceled"). That isn't a test failure or the job timeout (30 min), and no other job in run 37375215306 failed. The same leg passed in 4–6 min on three other PRs in the previous 30 minutes (runs 37371659596, 37371058386, 37368024575), and this PR only changes workflow concurrency and the digest port. Treating it as a lost runner, so I've re-run that one job once. If it fails again, it's real.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e7026a2. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at e7026a2 (e7026a28013f38a77ecdf4511ec407a0451573a3).

• CI: 409/409 checks green on the head commit (6 skipped by matrix rule).
• Bugbot: reviewed e7026a2 (re-requested this run, because the last review covered 69ab074). No new issues, and no review threads are open.
• Mergeable against main, with no conflicts. Approved by Tanmay Singla (@Tanmay182003) on this SHA.
• Reviewer note: e7026a2 is the cherry-picked Route Gradle digests through utils::digest #878 digest fix. Drop it, or let it no-op, if Route Gradle digests through utils::digest #878 lands first.

---

Generated by Claude Code