[777genius]

New commits to a skills-resolution PR could leave its older Go/Docker checks running because this workflow had no concurrency policy.

Replace superseded runs of the same PR. Keep main runs independent: the Skills catalog operations contract requires this workflow's exact reviewed commit, binary digest and dedicated container probe before activation. Any future manual event also gets an independent run identity.

Only five workflow lines change. Triggers, permissions, pinned tools, runner, timeout, test/build steps and the owned cleanup trap remain unchanged.

Validation: actionlint, strict TypeScript and 14 cases using the official GitHub expressions evaluator pass. Full payload AST and shell trap match the baseline. No extra local Go/native run or new dependencies were introduced for this YAML-only change; normal exact-head CI remains required before merge.

Refs #534.

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Adds a workflow-level `concurrency` block to the skills-resolution GitHub Actions workflow: superseded runs for the same pull request are cancelled, while main-branch (push) runs each keep their own distinct identity so the exact-commit activation evidence is preserved.

Review summary

The diff adds a GitHub Actions concurrency policy (5 lines) to the skills-resolution workflow so superseded pull-request runs are cancelled while main-branch runs stay independent. I traced the group expression and cancellation rule: PR groups key on github.event.pull_request.number (falling back to refs/pull/N/merge), never on attacker-influenced github.head_ref, and push runs key on github.run_id with cancel-in-progress evaluating false — so a fork author cannot alias, and thereby cancel, another PR's run, a main push activation-evidence run, or another workflow's run (no other workflow shares the skills-resolve- group namespace). The workflow's triggers, contents: read permissions, pinned actions, and test/build/docker-probe steps are unchanged, so no security control is weakened. No security issues found in the changed code.

_{Review 1 on this PR · 3b2c695 · requested Oct 28 15:39 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4ea2b9f5-620a-43e4-be33-dcf63ff8d0c7

Commits

Reviewing files that changed from the base of the PR and between 272e7ba and 3b2c695.

Files selected for processing: 1

• .github/workflows/skills-resolve.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.05%. Comparing base (272e7ba) to head (3b2c695).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #553   +/-   ##
=======================================
  Coverage   61.05%   61.05%           
=======================================
  Files        1791     1791           
  Lines      105965   105965           
=======================================
+ Hits        64692    64694    +2     
+ Misses      32005    32003    -2     
  Partials     9268     9268           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.