From 3e25f1939447f8c116a1a2d6cc6efe2483f7b801 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 2 May 2026 09:18:59 +0200 Subject: [PATCH 1/4] chore(ci): add concurrency control to all workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per the org-wide CI Concurrency Hardening brief. Adds top-level `concurrency:` blocks to cancel superseded PR runs while preserving main-branch / scheduled / release runs. Classification per file: - ci.yml → default variant Cancels superseded runs on PRs only; main-branch runs (which this workflow doesn't currently have, but the conditional `cancel-in-progress` is a future-proofing default) are never cancelled. - deploy.yml → release variant Never cancels a deploy. The deploy script does `find . -delete && tar -xzf` on Netcup; cancelling mid-flight could leave the site in a half-deleted state. Group by ref so parallel pushes serialize without race-deleting each other. - blog-autopublish.yml → ALREADY HAS the correct concurrency block (group: blog-autopublish, cancel-in-progress: false). This is a fixed-group pattern that serializes ALL autopublish runs (cron + workflow_dispatch). For this workflow that's correct, NOT the brief's "scheduled variant" with ${{ github.run_id }}: this workflow mutates repo state (creates branches and PRs), so concurrent runs would race. Per idempotency rule, leaving unchanged. No job-level concurrency. No `runs-on:` changes. No matrix restructuring. Scope is strictly `.github/workflows/`. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 4 ++++ .github/workflows/deploy.yml | 12 ++++++++++++ 2 files changed, 16 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cd104f9..796daa8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,9 @@ name: CI +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + on: pull_request: branches: [main] diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index f644b5a..5c61d93 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,5 +1,17 @@ name: Deploy +# Release variant — never cancel a deploy mid-flight. A cancelled deploy +# can leave the Netcup site in a half-deleted state (the script does +# `find . -delete && tar -xzf`). Group by ref so two parallel pushes to +# the same branch serialize cleanly without race-deleting each other. +# +# Security note: this concurrency block uses only server-controlled +# context vars (github.ref, github.workflow) — no PR-author-controlled +# input flows into the group key. +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false + on: push: branches: [main] From e10d517bcffbef39618fd7bab237787b82fc9333 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sun, 3 May 2026 09:00:34 +0200 Subject: [PATCH 2/4] fix: light-mode mermaid color override via SVG style-tag patching MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous attempt (CSS attribute selectors on inline `style="..."`) never worked — mermaid v11 doesn't emit inline styles. Each post's `classDef` lines compile to CSS rules INSIDE the rendered SVG's ` +{% endblock %} diff --git a/templates/base.html b/templates/base.html index d4ffaf1..05d3ccb 100644 --- a/templates/base.html +++ b/templates/base.html @@ -93,6 +93,7 @@