From ecb12181f634c15ff2c6fd2f4fa99e1533e11cda Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:50:33 +0900
Subject: [PATCH] ci(actions): scope Product cancellation to PR heads

Signed-off-by: Seongho Bae <me@seonghobae.me>
---
 .github/workflows/product.yml | 4 ++--
 scripts/check_ci_contract.py  | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/product.yml b/.github/workflows/product.yml
index b14f5465..8863e1ee 100644
--- a/.github/workflows/product.yml
+++ b/.github/workflows/product.yml
@@ -6,8 +6,8 @@ on:
     branches: [main]
 
 concurrency:
-  group: conceptweave-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
diff --git a/scripts/check_ci_contract.py b/scripts/check_ci_contract.py
index e0e7130e..1342082b 100644
--- a/scripts/check_ci_contract.py
+++ b/scripts/check_ci_contract.py
@@ -14,7 +14,8 @@ def main() -> int:
 
     required_fragments = (
         "runs-on: ubuntu-24.04",
-        "cancel-in-progress: true",
+        "group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}",
+        "cancel-in-progress: ${{ github.event_name == 'pull_request' }}",
         "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
         "COVERAGE_TOOLCHAIN: nightly-2026-08-20",
         'rustup toolchain install "$COVERAGE_TOOLCHAIN" --profile minimal --component llvm-tools-preview',
@@ -31,6 +32,9 @@ def main() -> int:
             "evidence demonstrates selective floating-image starvation"
         )
 
+    if "github.event.pull_request.number || github.ref" in workflow:
+        raise SystemExit("Product CI must isolate non-PR runs by run_id")
+
     return 0