feat: group Dependabot security updates and cancel superseded PR runs in the templates

.github/dependabot.yml

@@ -7,5 +7,8 @@ updates:
     groups:
       actions:
         patterns: ["*"]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
     cooldown:
       default-days: 7

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- `templates/dependabot.yml`: security updates come as one grouped PR per ecosystem (`applies-to: security-updates`) instead of one PR per package. The version-update groups never applied to them.
+- Caller templates: a new push to a pull request cancels that pull request's previous Status checks run (workflow-level `concurrency`). Push, schedule and merge-queue runs are never cancelled.
 - Templates: no `codeql` job. Public repositories in the organization get CodeQL through default setup, which rejects results from `codeql.yml`.
 
 ## v1.1.3

templates/dependabot.yml

@@ -1,14 +1,16 @@
 # Copy to .github/dependabot.yml in every repository and delete the
-# ecosystems you don't use. Updates are grouped (one PR per ecosystem) and
-# wait 7 days after a release (cooldown) so compromised releases are usually
-# yanked before they reach us. Security updates are not delayed.
+# ecosystems you don't use. Updates are grouped (one PR per ecosystem, plus
+# one for its security updates) and wait 7 days after a release (cooldown)
+# so compromised releases are usually yanked before they reach us. Security
+# updates are not delayed.
 version: 2
 updates:
   - package-ecosystem: github-actions # also bumps the shared workflows
     directory: /
     schedule: { interval: weekly, day: monday }
     groups:
       actions: { patterns: ["*"] }
+      actions-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: docker # bumps tag AND @sha256 digest of FROM lines
@@ -23,6 +25,7 @@ updates:
     schedule: { interval: weekly, day: monday }
     groups:
       go: { patterns: ["*"], update-types: [minor, patch] }
+      go-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: npm
@@ -31,6 +34,7 @@ updates:
     groups:
       npm-production: { dependency-type: production, update-types: [minor, patch] }
       npm-development: { dependency-type: development, update-types: [minor, patch] }
+      npm-security: { applies-to: security-updates, patterns: ["*"] }
     cooldown: { default-days: 7 }
 
   - package-ecosystem: terraform

templates/workflows/status-checks-go.yml

@@ -12,6 +12,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   go:
     uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@v1

templates/workflows/status-checks-node.yml

@@ -12,6 +12,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   node:
     uses: privacybydesign/github-workflows/.github/workflows/node-checks.yml@v1

templates/workflows/terraform.yml

@@ -13,6 +13,12 @@ on:
 
 permissions: {}
 
+# A new push to a PR cancels the PR's previous run. Other events get a
+# group of their own (run_id), so they never wait for or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   terraform:
     strategy: