[PetrefiedThunder]

What this changes

In ci.yml, license-check.yml and secrets.yml, the top-level concurrency group is now the standard one:

group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

cancel-in-progress was already exactly this, so push, merge-queue, schedule and manual runs are still never cancelled. Only the group key changes (the old ci-, license- and secrets- prefixes are dropped).

Path filtering: already in place, no change

Branch protection on main requires CI result, License result and gitleaks, so on.pull_request.paths cannot be used: a filtered-out workflow would never report a required check. Both gated workflows already filter inside the workflow, with gated jobs and an always() result job:

• CI: the detect job's filter step (pull_request only) skips every heavy job on docs-only PRs and narrows the matrix to changed projects and their dependents. Code, tests, dependency files and workflow changes run. CI result always reports.
• License check: the detect job's deps step (pull_request only) runs the scans only when a dependency manifest, a lockfile, a governing license file or the gate's own config changed. License result always reports.
• Secrets scan: no path filter (unchanged).

Adding dorny/paths-filter would duplicate this logic, so I left it out. License files stay in the License check trigger because they decide the outcome of the license gate.

Verify

• actionlint passes on all three files.
• Required check names are unchanged: CI result, License result, gitleaks.
• None of these files are touched by open PRs fix(security): fixed public MCP JSON-RPC errors + server-side logging with request id (code-scanning #2-#9) #242, fix(mcp): stop leaking exception text from /mcp/tools/{id}/invoke #244 or chore: move remaining api.thisisatest.tech references to api.agentmiddleware.dev #222.

---

Note

Low Risk
Workflow-only concurrency grouping changes with no application code or check-name impact.

Overview
Standardizes GitHub Actions concurrency keys on the CI and License check workflows (and the secrets scan workflow per this PR) so they all use the same pattern: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}.

CI drops the extra ci- prefix that was prepended before ${{ github.workflow }} (which was redundant with the workflow name). License check replaces the custom license-… group with the workflow-based key. cancel-in-progress is unchanged—still only true for pull_request, so push/merge-queue/schedule/manual runs are not cancelled.

Required check names and in-workflow path filtering behavior are untouched; only how concurrent runs of the same workflow are grouped and superseded on PRs changes.

^{Reviewed by Cursor Bugbot for commit 159ed0f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-middleware-web	Ready	Preview	Oct 26, 2026 12:28pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T12:06:55.548619Z	159ed0f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: agentmiddleware/agent-middleware
• Branch: gemini/ci-concurrency-paths
• File: .coderabbit.yaml
• Commit: 3cb0283
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b867e5e1-5aae-4ccc-b592-0bee57d30daa

Commits

Reviewing files that changed from the base of the PR and between 159ed0f and 3cb0283.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: agentmiddleware/agent-middleware
• Branch: gemini/ci-concurrency-paths
• File: .coderabbit.yaml
• Commit: 159ed0f
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e5d138f5-3610-49df-90af-dc84bec38fc6

Commits

Reviewing files that changed from the base of the PR and between 95b2d42 and 159ed0f.

Files selected for processing: 3

• .github/workflows/ci.yml
• .github/workflows/license-check.yml
• .github/workflows/secrets.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Walkthrough

The CI, license-check, and secrets workflows now use the workflow name as the concurrency group prefix. Each workflow retains its pull request number or Git ref as the suffix.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Low · up to 159ed

Mergeable with awareness that in-flight runs during rollout may continue instead of being cancelled by newer runs.

Architecture risk: Low · up to 159ed

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/ci.yml: The concurrency group now uses the workflow name instead of the fixed ci prefix; the pull-request number or Git ref suffix is unchanged.
• observed — Modified behavior in .github/workflows/license-check.yml: The concurrency group prefix changes from the fixed license string to the workflow name; the pull request number or Git ref suffix remains unchanged.
• observed — Modified behavior in .github/workflows/secrets.yml: The concurrency group prefix changes from the fixed secrets string to the workflow name; the pull request number or Git ref remains the suffix.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the standardized concurrency group changes and confirms the unchanged cancellation, filtering, required checks, and validation details.
Title check		The title clearly and concisely identifies the standard concurrency group change across CI, License check, and Secrets scan workflows.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[PetrefiedThunder]

REVIEW: PASS muse 159ed0f

• Scope: 3 one-line concurrency.group changes (ci.yml, license-check.yml, secrets.yml) to ${{ github.workflow }}-${{ PR number || ref }}. cancel-in-progress unchanged (pull_request only), so push/merge-queue/schedule/dispatch runs are never cancelled.
• Correctness: workflow names (CI, CodeQL, License check, Lint, Release Python SDK, Secrets scan) are all unique, so dropping the ci-/license-/secrets- prefixes causes no cross-workflow group collision. No triggers, job names or required check names (CI result, License result, gitleaks) change.
• Security: no permissions/secrets/action changes. No made-up data; no code or tests touched.
• Local: all 3 files parse as YAML; ruff check gateway clean (amw-45-rr venv). No Python tests apply.
• CI: all checks green incl. CodeQL, Bugbot, CodeRabbit. 0 unresolved threads. Commit signed off.

[PetrefiedThunder]

REVIEW: PASS muse 3cb0283

Delta from my PASS at 159ed0f:

• Merge commit 3cb0283 (by Pi) brings in main's e5cbe70 (#247, site-only). git show --remerge-diff is empty, so no conflict resolutions.
• range-diff: 159ed0f is unchanged (1 = 1).
• No .github changes came in from main. The PR's diff against main is still exactly the three one-line concurrency-group changes in ci.yml, license-check.yml and secrets.yml.
• No duplicate workflow name: values, so the ${{ github.workflow }} groups stay distinct. No other concurrency blocks changed, and no job or required-check names changed.
• All workflow YAML parses.
• CI when I posted: lint, gitleaks, licenses, SDK/integration matrices, Vercel and CodeRabbit pass. Gateway 3.11–3.14, Postgres proofs/concurrency, image smoke and CodeQL js/python are still pending. Merge only once those are green.