Concurrency limits

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: cicd-github-concurrency-limits

Provider: GitHub

Platform: CICD

Severity: Low

Category: Best Practices

Learn More

Description

Workflows and jobs without concurrency controls can pile up redundant, overlapping runs that waste CI/CD compute, lengthen queue times, and delay feedback when commits or pull request updates land in quick succession. Set the concurrency property to an object with a group and an explicit cancel-in-progress value, so the behavior for overlapping runs is a deliberate choice rather than an implicit default.

Use cancel-in-progress: true where only the latest commit matters, such as pull request builds, tests, and linting. GitHub then cancels the in-progress run for the same concurrency group instead of running duplicates. Use cancel-in-progress: false for workflows that must not be interrupted mid-flight, such as deployments and release publishing, where new runs should queue behind the current one. This rule accepts either value.

The rule flags workflows or jobs that omit concurrency entirely, set it to a bare string, or provide a group with no cancel-in-progress key at all. Reusable-only workflows, meaning those triggered solely by workflow_call, are exempt because their callers should define concurrency to avoid deadlocks and premature cancellations.

Secure configuration example:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Compliant Code Examples

# Workflow with proper concurrency control
name: Workflow with Concurrency Control
on: pull_request

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test
---
# Reusable workflow (should be skipped)
name: Reusable Workflow
on: workflow_call

concurrency:
  group: reusable-${{ github.ref }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm build
---
# Job-level concurrency with cancel-in-progress
name: Job Level Concurrency
on: push

jobs:
  test:
    runs-on: ubuntu-latest
    concurrency:
      group: test-${{ github.ref }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@v4
      - run: npm test
---
# Reusable workflow call (should be skipped)
name: Workflow Calling Reusable
on: push

concurrency:
  group: caller-${{ github.ref }}
  cancel-in-progress: true

jobs:
  call-reusable:
    uses: ./.github/workflows/reusable.yml
---
# Deploy workflow explicitly opting out of cancellation
name: Deploy Application
on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-deploy-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
---
# Job-level concurrency explicitly opting out of cancellation
name: Job Level Deploy
on: push

jobs:
  deploy:
    runs-on: ubuntu-latest
    concurrency:
      group: deploy-${{ github.ref }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh

Non-Compliant Code Examples

name: Workflow without Cancel in Progress
on: pull_request

# Workflow-level concurrency without cancel-in-progress
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test
---
# Job-level concurrency without cancel-in-progress
name: Job Level Concurrency
on: push

jobs:
  test:
    runs-on: ubuntu-latest
    concurrency:
      group: test-${{ github.ref }}
    steps:
      - uses: actions/checkout@v4
      - run: npm test
---
# Missing concurrency at both levels
name: No Concurrency
on: pull_request

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm run deploy

# String-based concurrency (bare string, no cancel-in-progress)
name: String Concurrency
on: push

concurrency: ci-${{ github.ref }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm build