[techmore]

Summary

sep-source.yml is the only one of the three workflows on integration/aurora without a concurrency group or a permissions block. This adds both, copied from dt-checks.yml and host-tests.yml:

• concurrency: sep-source-<PR number or ref>, cancel-in-progress: true
• permissions: contents: read

Why

When this PR was opened (2026-11-10 UTC), ten heads in the last 100 SEP source checks runs had been checked twice at the same SHA. Examples: fix/t8140-slpddr-coproc-crash at b1c202a5, 77014185 and 1814809b, and j713/radio-s2r-perst at 170c1617. A push to a PR also leaves the earlier kunit job running. Each of those jobs builds an arm64 kernel and boots it in QEMU, with a timeout of up to 60 minutes.

No job writes anything back. They only check out the tree, so contents: read is enough.

Scope

• One file, +7 lines, no job or step changes.
• soc: apple: sep: preserve unreadable and partial identity state #962, soc: apple: sep: preserve J613 26.6.2 existing-state policy and expose selected policy #975 and soc: apple: sep: open the boot policy window for Touch ID's designate #1340 also edited this file, inside the source job steps. All three are merged, and this PR is based on them.

Testing

• The YAML parses, and the top-level keys are on, permissions, concurrency and jobs.
• Because this PR touches .github/workflows/sep-source.yml, its own path filter runs the workflow on this PR.

Update

Rebased onto integration/aurora at 125e6966. The diff is unchanged (patch-id 97b7bee3). The commit's author name now matches its sign-off, and its AI trailer is Assisted-by: LLM, the form in Documentation/process/coding-assistants.rst.

[RyanTheTide]

The change is correct. permissions: contents: read covers every job: source, rust-build and kunit only check out and build, and none of them uses GITHUB_TOKEN or a secret. The concurrency group matches the dt-checks.yml and host-tests.yml pattern with its own sep-source- prefix.

The only remaining item: commit d81152f needs the submitter's Signed-off-by: (git commit --amend -s, push). Then mark the PR ready for review.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T11:32:42.460416Z	18561d5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[techmore]

Ryan, the Signed-off-by: was already there: 44daef4, which replaced d81152f, carries my sign-off, and so does the rebased head efeedfe below. I should have said so when I pushed 44daef4.

CI on 44daef4 fails because the PR is based on an old integration/aurora. The change itself only touches .github/workflows/sep-source.yml:

• source: test_log_ratelimit flags dev_info! at sbio.rs:2671 and sbio.rs:3048. soc: apple: sep: rate-limit the two verify messages from the fresh bring-up #1590 fixed this upstream.
• kunit: pmp-report.c:1704 calls get_cpu_idle_time() in a build without CPU_FREQ. pmdomain: apple: build floor sampling without CPU_FREQ #1594 fixed this upstream.

I rebased the commit onto integration/aurora 8333109, which includes both fixes. The patch, commit message and sign-off are unchanged (git range-diff 44daef4c^..44daef4c efeedfec^..efeedfec gives =). The new head is efeedfe.

CI on the new head: pending.