From 4555cd93244150a3df2b26f4a6ec1090cdce1424 Mon Sep 17 00:00:00 2001
From: le0m <mainardi.leo@gmail.com>
Date: Fri, 23 Oct 2026 01:47:04 +0200
Subject: [PATCH] chore: add concurrency groups and check head commit's sha
 didn't change before publishing

---
 .github/workflows/build-images.yml   | 4 ++++
 .github/workflows/publish-images.yml | 6 ++++++
 .github/workflows/publish.5.yml      | 2 +-
 .github/workflows/publish.7.yml      | 2 +-
 .github/workflows/publish.8.yml      | 2 +-
 .github/workflows/publish.compat.yml | 8 +++++++-
 .github/workflows/publish.latest.yml | 2 +-
 .github/workflows/test.5.yml         | 1 -
 .github/workflows/test.7.yml         | 1 -
 .github/workflows/test.8.yml         | 1 -
 .github/workflows/test.compat.yml    | 5 ++++-
 .github/workflows/test.latest.yml    | 1 -
 12 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index 379145d..82a269c 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -24,6 +24,10 @@ on:
       pull-password:
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: ${{ matrix.version }}${{ matrix.flavor }} (${{ matrix.arch }})
diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
index 5698c05..f727624 100644
--- a/.github/workflows/publish-images.yml
+++ b/.github/workflows/publish-images.yml
@@ -3,6 +3,8 @@ name: Publish images
 # Publishes the images built and tested by the triggering build-images.yml run: merges each
 # image's per-arch digests into a multi-arch tag on ghcr, then copies it to Docker Hub. Nothing is
 # rebuilt, and nothing is read from Docker Hub, so publishing doesn't count against its pull limits.
+# Callers must skip runs whose commit is no longer the head of main (github.sha), so an older
+# commit whose tests finished late can't overwrite the tags of a newer one.
 
 on:
   workflow_call:
@@ -25,6 +27,10 @@ on:
       push-password:
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   publish:
     name: ${{ matrix.version }}${{ matrix.flavor }}
diff --git a/.github/workflows/publish.5.yml b/.github/workflows/publish.5.yml
index ced35ed..52d554d 100644
--- a/.github/workflows/publish.5.yml
+++ b/.github/workflows/publish.5.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   publish-5:
     name: Publish PHP 5 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.7.yml b/.github/workflows/publish.7.yml
index a79982f..47634dc 100644
--- a/.github/workflows/publish.7.yml
+++ b/.github/workflows/publish.7.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   publish-7:
     name: Publish PHP 7 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.8.yml b/.github/workflows/publish.8.yml
index 4f70265..6ab667e 100644
--- a/.github/workflows/publish.8.yml
+++ b/.github/workflows/publish.8.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   publish-8:
     name: Publish PHP 8 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.compat.yml b/.github/workflows/publish.compat.yml
index 7d90df0..d1b4d68 100644
--- a/.github/workflows/publish.compat.yml
+++ b/.github/workflows/publish.compat.yml
@@ -6,11 +6,17 @@ on:
     branches: [main]
     types: [completed]
 
+# Every completed test run starts this workflow; runs that won't publish get their own group, so
+# they can't cancel a publish in progress.
+concurrency:
+  group: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha && github.workflow || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   publish-compat:
     name: Build and publish compatibility images
     runs-on: ubuntu-22.04
-    if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/publish.latest.yml b/.github/workflows/publish.latest.yml
index 3dae78f..7a2a66a 100644
--- a/.github/workflows/publish.latest.yml
+++ b/.github/workflows/publish.latest.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   publish-latest:
     name: Publish latest PHP images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/test.5.yml b/.github/workflows/test.5.yml
index da0c1ad..f8235cb 100644
--- a/.github/workflows/test.5.yml
+++ b/.github/workflows/test.5.yml
@@ -12,7 +12,6 @@ on:
 jobs:
   test-5:
     name: Build and test PHP 5 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/test.7.yml b/.github/workflows/test.7.yml
index 556e472..5c71041 100644
--- a/.github/workflows/test.7.yml
+++ b/.github/workflows/test.7.yml
@@ -12,7 +12,6 @@ on:
 jobs:
   test-7:
     name: Build and test PHP 7 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/test.8.yml b/.github/workflows/test.8.yml
index 9e32547..70146e0 100644
--- a/.github/workflows/test.8.yml
+++ b/.github/workflows/test.8.yml
@@ -12,7 +12,6 @@ on:
 jobs:
   test-8:
     name: Build and test PHP 8 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/test.compat.yml b/.github/workflows/test.compat.yml
index fc64d44..90cbac2 100644
--- a/.github/workflows/test.compat.yml
+++ b/.github/workflows/test.compat.yml
@@ -9,11 +9,14 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test-compat:
     name: Build and test compatibility images
     runs-on: ubuntu-22.04
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/test.latest.yml b/.github/workflows/test.latest.yml
index 4facb28..2ab5a62 100644
--- a/.github/workflows/test.latest.yml
+++ b/.github/workflows/test.latest.yml
@@ -12,7 +12,6 @@ on:
 jobs:
   test-latest:
     name: Build and test latest PHP images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write