ci: stop cancelling in-progress runs on main (3 commits shipped unverified)

[Shaan-alpha]

Came out of auditing why CI "keeps failing". It mostly wasn't — but this is the one real gap the audit found.

The gap

concurrency.group is keyed on github.ref, which is refs/heads/main for every push to main. With cancel-in-progress: true, each merge cancels the previous merge's still-running check.

On 2026-07-31 six PRs merged inside ~30 seconds, and three merge commits ended up on main — and in production — with cancelled as their only CI verdict:

commit	PR	verdict
c08afed	#59	cancelled
b694214	#61	cancelled
5cd73eb	#62	cancelled

The cumulative state was green immediately afterwards (ee885a8 success), so nothing shipped broken — I verified the merged tree locally and in production. But those three commits are individually unverified. A later bisect or revert would land on a commit CI never actually passed, and the run history says "cancelled" where it should say pass or fail.

Fix

cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

Superseding is correct for a PR — only the tip commit matters — and wrong for main, where every merge commit is a deployable artifact.

Gating on the ref rather than dropping the concurrency block entirely, because the block also serves its original purpose: on: [pull_request, push] both fire for a PR branch, and the group stops that double-run. That guard is still wanted.

Honest note on cause

I caused the pile-up by merging six PRs back to back. The config permitted it silently, which is the part worth fixing — the next batch merge would do the same thing.

What the rest of the CI audit found (no change needed)

• Every CI failure on 2026-07-31 predates #60 (merged 03:37Z; latest failure 03:33Z). All of them were the same inherited repo_quality fixture time bomb that #60 fixed. Since then, main is green.
• The only older failure is 2026-07-28 on dependabot/npm_and_yarn/frontend/typescript-7.0.2 — #20, blocked upstream.
• #20 / #21 still fail for the reasons already recorded in PROGRESS_LOG, re-confirmed from the job logs today: typescript-eslint does not support TS 7.0. and Error while loading rule 'react/display-name': contextOrFilename.getFilename is not a function. Both come from tooling bundled inside eslint-config-next, whose latest stable is still 16.2.12 — the version already installed. Not fixable here; merging either would turn main red.

Verification

Workflow YAML parses; concurrency.cancel-in-progress resolves to the expression string and all four jobs (backend, frontend, config, dependency-review) are intact.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.