fix(ci-lease): serialise callers + servicecatalog perm

.github/workflows/scenario-ai-contact-centre.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-ai-contact-centre-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-bops-planning.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-bops-planning-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-council-chatbot.yml

@@ -14,11 +14,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  # One run per branch; cancel a superseded run in flight (the new commit
-  # will get a fresh lease — releasing the old lease happens on the
-  # cancelled run's if: always() release step, or eventually by the janitor).
-  group: scenario-council-chatbot-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-digital-planning-register.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-digital-planning-register-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-fixmystreet.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-fixmystreet-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-foi-redaction.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-foi-redaction-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-localgov-drupal.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-localgov-drupal-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-localgov-ims.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-localgov-ims-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-minute.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-minute-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-paperless-ngx.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-paperless-ngx-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-planning-ai.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-planning-ai-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-planx.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-planx-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-quicksight-dashboard.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-quicksight-dashboard-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-simply-readable.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-simply-readable-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-smart-car-park.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-smart-car-park-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

.github/workflows/scenario-text-to-speech.yml

@@ -11,8 +11,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: scenario-text-to-speech-${{ github.ref }}
-  cancel-in-progress: true
+  # Repo-wide group across ALL scenario callers because ISB caps ci-bot
+  # at 1 active lease at a time (maxLeasesPerUser). Concurrent dispatches
+  # would 409. Serialise here so each scenario gets a turn.
+  group: scenario-ci-pool
+  cancel-in-progress: false
 
 permissions:
   id-token: write

cloudformation/isb-hub-orgmgmt/ci-deploy-role-stackset/template.yaml

@@ -189,6 +189,7 @@ Resources:
                         Action:
                           - 's3:*'
                           - 's3vectors:*'
+                          - 'servicecatalog:*'
                           - 'lambda:*'
                           - 'apigateway:*'
                           - 'dynamodb:*'