From ec15c1429d4956b413bca83d7e7677e9b5a8312d Mon Sep 17 00:00:00 2001
From: Anton Volkov <antonwolfy@gmail.com>
Date: Tue, 3 Nov 2026 20:12:49 +0100
Subject: [PATCH 1/3] Replace cancel-workflow-action with native concurrency

Use a top-level concurrency group in conda-package.yml, check-onemath.yaml, generate_coverage.yaml and cron-run-tests.yaml instead of styfle/cancel-workflow-action, and drop the actions: write permission it needed. Superseded PR runs are cancelled, master runs are not.
---
 .github/workflows/check-onemath.yaml     | 14 +++++---------
 .github/workflows/conda-package.yml      | 14 +++++---------
 .github/workflows/cron-run-tests.yaml    | 13 ++++---------
 .github/workflows/generate_coverage.yaml | 14 +++++---------
 4 files changed, 19 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/check-onemath.yaml b/.github/workflows/check-onemath.yaml
index 87be2a4574e..11b99ca15a1 100644
--- a/.github/workflows/check-onemath.yaml
+++ b/.github/workflows/check-onemath.yaml
@@ -9,6 +9,11 @@ on:
 permissions:
   contents: read
 
+# Cancel superseded PR runs only; master runs always complete
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   # Pinned: Miniforge3 26.9.4-0 fails 'conda init' on Windows runners
   miniforge-version: '26.7.2-1'
@@ -31,10 +36,6 @@ jobs:
   build_env_file:
     name: Build conda env file
 
-    permissions:
-      # Needed to cancel any previous runs that are not completed for a given workflow
-      actions: write
-
     strategy:
       fail-fast: false
       matrix:
@@ -49,11 +50,6 @@ jobs:
       python-install-spec: "python ${{ matrix.python_spec || format('{0}.*', matrix.python) }}"
 
     steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
-        with:
-          access_token: ${{ github.token }}
-
       - name: Checkout DPNP repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml
index 9a0ca2c91eb..694db29141f 100644
--- a/.github/workflows/conda-package.yml
+++ b/.github/workflows/conda-package.yml
@@ -9,6 +9,11 @@ on:
 permissions:
   contents: read
 
+# Cancel superseded PR runs only; master runs always complete
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   # Pinned: Miniforge3 26.9.4-0 fails 'conda init' on Windows runners
   miniforge-version: '26.7.2-1'
@@ -60,10 +65,6 @@ jobs:
           # TODO: add free-threaded builds ('3.15.* *_cp315t') once NumPy and
           # dpctl cp315t builds are available
 
-    permissions:
-      # Needed to cancel any previous runs that are not completed for a given workflow
-      actions: write
-
     runs-on: ${{ matrix.os }}
     timeout-minutes: 90
 
@@ -76,11 +77,6 @@ jobs:
       python-conda-spec: ${{ matrix.python_spec || matrix.python }}
 
     steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
-        with:
-          access_token: ${{ github.token }}
-
       - name: Checkout DPNP repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/cron-run-tests.yaml b/.github/workflows/cron-run-tests.yaml
index d1635b553a3..9c9ddf7b1b1 100644
--- a/.github/workflows/cron-run-tests.yaml
+++ b/.github/workflows/cron-run-tests.yaml
@@ -9,6 +9,10 @@ on:
 
 permissions: read-all
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # Pinned: Miniforge3 26.9.4-0 fails 'conda init' on Windows runners
   miniforge-version: '26.7.2-1'
@@ -33,10 +37,6 @@ jobs:
       run:
         shell: ${{ matrix.runner == 'windows-2022' && 'cmd /C CALL {0}' || 'bash -el {0}' }}
 
-    permissions:
-      # Needed to cancel any previous runs that are not completed for a given workflow
-      actions: write
-
     strategy:
       fail-fast: false
       matrix:
@@ -68,11 +68,6 @@ jobs:
       python-install-spec: "python ${{ matrix.python_spec || format('{0}.*', matrix.python) }}"
 
     steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
-        with:
-          access_token: ${{ github.token }}
-
       - name: Find the latest tag
         id: find_latest_tag
         uses: oprypin/find-latest-tag@6957ac556fa6d349727ecabfcaaf9f8e5ee37124 # v1.1.3
diff --git a/.github/workflows/generate_coverage.yaml b/.github/workflows/generate_coverage.yaml
index 7e7c7c546ad..e2788330c1a 100644
--- a/.github/workflows/generate_coverage.yaml
+++ b/.github/workflows/generate_coverage.yaml
@@ -6,6 +6,11 @@ on:
 
 permissions: read-all
 
+# Cancel superseded PR runs only; master runs always complete
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   generate-coverage:
     name: Generate coverage and push to Coveralls.io
@@ -13,10 +18,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 180
 
-    permissions:
-      # Needed to cancel any previous runs that are not completed for a given workflow
-      actions: write
-
     defaults:
       run:
         shell: bash -el {0}
@@ -34,11 +35,6 @@ jobs:
       dpctl-pkg-txt: 'environments/dpctl_pkg.txt'
 
     steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
-        with:
-          access_token: ${{ github.token }}
-
       - name: Add Intel repository
         if: env.oneapi-pkgs-env == ''
         run: |

From 0a6d7ac62bf7497a1db305245fd2107ea4958544 Mon Sep 17 00:00:00 2001
From: Anton Volkov <antonwolfy@gmail.com>
Date: Wed, 4 Nov 2026 11:46:06 +0100
Subject: [PATCH 2/3] Give non-PR runs a unique concurrency group

---
 .github/workflows/check-onemath.yaml     | 4 ++--
 .github/workflows/conda-package.yml      | 4 ++--
 .github/workflows/generate_coverage.yaml | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check-onemath.yaml b/.github/workflows/check-onemath.yaml
index 11b99ca15a1..544367ae819 100644
--- a/.github/workflows/check-onemath.yaml
+++ b/.github/workflows/check-onemath.yaml
@@ -9,9 +9,9 @@ on:
 permissions:
   contents: read
 
-# Cancel superseded PR runs only; master runs always complete
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml
index 694db29141f..b44301e9c0e 100644
--- a/.github/workflows/conda-package.yml
+++ b/.github/workflows/conda-package.yml
@@ -9,9 +9,9 @@ on:
 permissions:
   contents: read
 
-# Cancel superseded PR runs only; master runs always complete
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
diff --git a/.github/workflows/generate_coverage.yaml b/.github/workflows/generate_coverage.yaml
index e2788330c1a..3978b68cb03 100644
--- a/.github/workflows/generate_coverage.yaml
+++ b/.github/workflows/generate_coverage.yaml
@@ -6,9 +6,9 @@ on:
 
 permissions: read-all
 
-# Cancel superseded PR runs only; master runs always complete
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:

From 7b5b2f9a7f1183c4871d1455a4da7c36d3f225d4 Mon Sep 17 00:00:00 2001
From: Anton Volkov <antonwolfy@gmail.com>
Date: Thu, 5 Nov 2026 14:17:55 +0100
Subject: [PATCH 3/3] Align concurrency across the remaining workflows

PR-triggered workflows cancel only superseded PR runs and give other runs a unique group; schedule/dispatch-only workflows drop the group so every run completes.
---
 .github/workflows/conda-package-cf.yml   | 5 +++--
 .github/workflows/coverity.yml           | 4 ----
 .github/workflows/cron-run-tests.yaml    | 4 ----
 .github/workflows/os-llvm-sycl-build.yml | 6 +++---
 .github/workflows/pre-commit.yml         | 5 +++++
 .github/workflows/zizmor.yml             | 5 +++--
 6 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml
index 0fd80cb4375..9356b40da0d 100644
--- a/.github/workflows/conda-package-cf.yml
+++ b/.github/workflows/conda-package-cf.yml
@@ -9,9 +9,10 @@ on:
 permissions:
   contents: read
 
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   linux:
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index dff33007a81..75b7cd36f32 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -8,10 +8,6 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: coverity-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
   COVERITY_PROJECT: IntelPython/dpnp
   ONEAPI_ROOT: /opt/intel/oneapi
diff --git a/.github/workflows/cron-run-tests.yaml b/.github/workflows/cron-run-tests.yaml
index 9c9ddf7b1b1..b832ebbec61 100644
--- a/.github/workflows/cron-run-tests.yaml
+++ b/.github/workflows/cron-run-tests.yaml
@@ -9,10 +9,6 @@ on:
 
 permissions: read-all
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
   # Pinned: Miniforge3 26.9.4-0 fails 'conda init' on Windows runners
   miniforge-version: '26.7.2-1'
diff --git a/.github/workflows/os-llvm-sycl-build.yml b/.github/workflows/os-llvm-sycl-build.yml
index fc2a5fc6fa8..68d79d5abea 100644
--- a/.github/workflows/os-llvm-sycl-build.yml
+++ b/.github/workflows/os-llvm-sycl-build.yml
@@ -10,10 +10,10 @@ on:
 
 permissions: read-all
 
-# Only one build at a time per ref; a newer run supersedes an in-progress one.
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   install-compiler:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 66d77ef2eb0..510fae0fcdc 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -7,6 +7,11 @@ on:
 
 permissions: read-all
 
+# Cancel superseded PR runs only; other runs get a unique group and always complete
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pre-commit:
     name: Check
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 7c4c1a527b3..c3258ad2f74 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -8,9 +8,10 @@ on:
 
 permissions: {}
 
+# Cancel superseded PR runs only; other runs get a unique group and always complete
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   zizmor: