Unify CI concurrency group across trigger events

[mariusvniekerk]

Summary

• workflow_dispatch runs were grouped by github.ref (refs/heads/<branch>) while pull_request runs were grouped by head_ref (bare branch name), so a dispatched CI run on a branch was never cancelled when a push to the same branch superseded it, and vice versa
• Use github.ref_name so all trigger events on the same branch share one concurrency group; PR runs and main push runs remain separate groups

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (77467b8)

CI concurrency grouping has a Medium severity fork-PR denial-of-service risk.

Medium

• .github/workflows/ci.yml:16: The concurrency group uses ${{ github.head_ref || github.ref_name }}, which can collide across repositories when refs share the same short branch name. For pull_request events, github.head_ref is controlled by the PR author, including fork authors. A fork PR from a branch named main would use CI-main, colliding with trusted push or workflow_dispatch runs on this repo’s main; with cancel-in-progress: true, that PR can cancel trusted CI runs.

  Fix: Namespace PR concurrency groups so fork PRs cannot collide with trusted branch runs. For example, include the head repository identity, use the PR number, or only separate PRs when github.event.pull_request.head.repo.full_name != github.repository.

---

Panel: ci_default_security | Synthesis: codex, 27s | Members: codex_default (codex/default, done, 48s), codex_security (codex/security, done, 38s) | Total: 1m53s

[roborev-ci]

roborev: Combined Review (4e8dc9e)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 35s), codex_security (codex/security, done, 14s) | Total: 49s