From bce3c57ed9bc295ed311a276f25fffa9faf47adb Mon Sep 17 00:00:00 2001
From: Jean-Paul van Ravensberg <14926452+DevSecNinja@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:06:46 +0200
Subject: [PATCH] ci: make lint PR-only with concurrency

Branch protection makes the merge commit identical to the last PR head,
so re-running lint on push to main is duplicate work. Drop the push:main
trigger and add concurrency cancel-in-progress, matching the convention
in DevSecNinja/.github docs/workflow-trigger-conventions.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c841a61b-f7c4-44bc-bc0a-8428666bcf27
---
 .github/workflows/lint.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6b26d19..25bbcfa 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,11 +1,16 @@
 ---
 name: Lint
 
+# PR-only: branch protection makes the merge commit identical to the
+# last PR head, so re-running on push to main is duplicate work. See
+# DevSecNinja/.github docs/workflow-trigger-conventions.md.
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  workflow_dispatch: # checkov:skip=CKV_GHA_7: Validation workflow only -- no artifacts produced.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read