fix(ci): cancel stale merge queue runs for the same PR (#4013)

* fix(ci): cancel stale merge queue runs for the same PR

Add a cancel-stale-merge-queue job that runs only for merge_group events.
It strips the SHA suffix from the merge queue ref to find a stable per-PR
prefix, then cancels any older in-progress or queued workflow runs that
share the same prefix.

This fixes the issue where re-entering the merge queue or a push to main
left stale CI runs running because the workflow-level concurrency group
included the unique SHA from the merge queue ref.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): address review feedback on merge queue cancellation

- Paginate listWorkflowRuns with per_page: 100 to avoid missing stale
  runs when there are many in-progress/queued runs
- Add event: 'merge_group' filter to scope listings to merge queue runs
- Wrap cancelWorkflowRun in try/catch to handle race conditions where a
  run completes between listing and cancelling (409/422)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: devantler

.github/workflows/ci.yaml

@@ -31,6 +31,77 @@ concurrency:
 permissions: {}
 
 jobs:
+  # Cancel stale merge queue runs for the same PR.
+  # Merge queue refs include a unique SHA suffix (gh-readonly-queue/<base>/pr-<id>-<sha>),
+  # so the workflow-level concurrency group can't deduplicate them. This job strips the
+  # SHA to find older runs for the same queue entry and cancels them.
+  cancel-stale-merge-queue:
+    name: 🧹 Cancel Stale Merge Queue Runs
+    if: github.event_name == 'merge_group'
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      actions: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
+        with:
+          egress-policy: audit
+
+      - name: Cancel previous runs for same merge queue entry
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const ref = context.ref;
+            const match = ref.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
+            if (!match) {
+              console.log('Not a merge queue ref, skipping');
+              return;
+            }
+            const stablePrefix = match[1];
+
+            for (const status of ['in_progress', 'queued']) {
+              let page = 1;
+              while (true) {
+                const { data: { workflow_runs: runs } } = await github.rest.actions.listWorkflowRuns({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id: 'ci.yaml',
+                  event: 'merge_group',
+                  status,
+                  per_page: 100,
+                  page,
+                });
+
+                if (runs.length === 0) break;
+
+                for (const run of runs) {
+                  if (run.run_number >= context.runNumber) continue;
+                  const runRef = `refs/heads/${run.head_branch}`;
+                  const runMatch = runRef.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
+                  if (runMatch && runMatch[1] === stablePrefix) {
+                    console.log(`Cancelling stale run ${run.id} (${runRef})`);
+                    try {
+                      await github.rest.actions.cancelWorkflowRun({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        run_id: run.id,
+                      });
+                    } catch (error) {
+                      if (error && (error.status === 409 || error.status === 422)) {
+                        console.log(`Skipping run ${run.id}; it is no longer cancellable (${error.status})`);
+                        continue;
+                      }
+                      throw error;
+                    }
+                  }
+                }
+
+                if (runs.length < 100) break;
+                page += 1;
+              }
+            }
+
   # Wait for sufficient GitHub API rate limit before proceeding
   rate-limit-gate:
     name: ⏳ Rate Limit Gate