Remove concurrency settings from workflow

[kernelsam]

Removed concurrency settings from the Dependabot workflow.

Pull request questions

Which issue does this address

Issue number: #nnn

Why was change needed

???

What does change improve

???

[github-actions]

🤖 Claude Code Review

PR Code Review

Analyzing the diff for the removal of concurrency settings from .github/workflows/dependabot-approve-and-merge.yaml.

---

Code Quality

✅ Style guide - Minimal YAML change, no style issues.

✅ No commented-out code - Clean removal.

✅ Meaningful variable names - N/A.

✅ DRY principle - N/A.

✅ Defects/Logic errors - The change removes the concurrency group that would cancel in-progress runs when a new run starts. This is intentional for Dependabot workflows: without concurrency controls, multiple Dependabot PRs can be approved/merged in parallel without canceling each other. This is the correct behavior for dependency automation workflows. No defects identified.

✅ CLAUDE.md - No concerns.

---

Testing

✅ Unit/Integration tests - Not applicable for workflow configuration changes.

✅ Test coverage - N/A.

---

Documentation

✅ README - No update needed.

✅ API docs - N/A.

✅ Inline comments - N/A for this change.

✅ CHANGELOG.md - Not updated, but this is a minor workflow infrastructure change; acceptable depending on project conventions.

✅ Markdown formatting - N/A (YAML file).

---

Security

✅ No hardcoded credentials - None present.

✅ Input validation - N/A.

✅ Error handling - N/A.

✅ No sensitive data - None present.

✅ License files - None present.

---

Summary

This is a straightforward, low-risk change. Removing concurrency from the Dependabot approve-and-merge workflow is reasonable — the previous setting would cancel in-progress merge attempts when a new Dependabot PR arrived, which could cause incomplete merges. Without it, each Dependabot PR runs its own independent workflow. The change aligns with the recent commit history (b591095) which has the same stated intent.

Verdict: Approve. No issues found.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

🤖 Claude Code Review

I'll review this PR diff now.

PR Code Review

This PR makes two changes to GitHub Actions workflows:

1. Removes concurrency settings from dependabot-approve-and-merge.yaml
2. Deletes verify-dockerfile-refreshed-at-updated.yaml

---

Code Quality

✅ No commented-out code — Only YAML configuration changes, no commented-out code present.

✅ Meaningful variable names — N/A for workflow configuration files.

✅ DRY principle — N/A for this change.

✅ No defects identified — Both changes are straightforward removals with no logic errors.

Concurrency removal analysis: The concurrency block in dependabot-approve-and-merge.yaml was canceling in-progress runs when a new one started for the same workflow/branch. Removing it means multiple runs can now execute simultaneously. For a dependabot approve-and-merge workflow, this is acceptable — concurrent runs are unlikely to conflict and could even be desirable when multiple dependabot PRs are open at once.

---

Testing

✅ No unit/integration tests required — These are CI workflow configuration changes only.

---

Documentation

✅ README — No update needed for workflow-only changes.

✅ CHANGELOG.md — Not present in the diff. If this repo maintains a changelog, these workflow changes may warrant an entry under a "CI" or "Chore" section, but it is not strictly required for internal workflow changes.

---

Security

✅ No hardcoded credentials — None present.

✅ Permissions — Both workflows use permissions: {} (deny-all at top level) with only scoped permissions where needed. The deleted workflow used contents: read and pull-requests: read, which was appropriately minimal.

✅ No sensitive data — Not applicable.

✅ No license files — No .lic files or AQAAAD-prefixed content present.

---

Summary

Area	Status
Code Quality	✅
Testing	✅
Documentation	✅
Security	✅

Overall: Approved. The changes are clean and low-risk. Removing the concurrency group from the dependabot workflow is reasonable, and deleting the Dockerfile REFRESHED_AT verification workflow suggests that check has been retired or moved elsewhere. No concerns.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[github-actions]

🤖 Claude Code Review

PR Code Review

---

Code Quality

✅ No commented-out code — Clean diff, no dead code.

✅ Meaningful variable names — Standard GitHub Actions context variables used appropriately.

✅ DRY principle — Deleting .github/workflows/verify-dockerfile-refreshed-at-updated.yaml and consolidating into the existing docker-verify-refreshed-at-updated.yaml is the correct move. Previously two separate files called the same reusable workflow.

⚠️ Potential behavioral change — trigger scope narrowing

The deleted verify-dockerfile-refreshed-at-updated.yaml had:

on:
  pull_request:

This triggered on PRs against any branch. The surviving docker-verify-refreshed-at-updated.yaml has:

on:
  pull_request:
    branches: [main]

PRs targeting non-main branches will no longer have Dockerfile REFRESHED_AT verified. This is likely intentional but should be confirmed.

✅ No defects — Removing concurrency from dependabot-approve-and-merge.yaml is safe. The original concurrency group used github.head_ref, which is per-branch anyway — different dependabot PRs would have different refs and wouldn't cancel each other. The removal has no meaningful impact.

✅ CLAUDE.md — Project memory file is appropriately general for any developer environment.

⚠️ Style guide — Unable to fetch https://raw.githubusercontent.com/senzing-garage/knowledge-base/refs/heads/main/WHATIS/code-style.md due to permission restrictions. Manual verification against the style guide is recommended.

---

Testing

✅ N/A — These are CI/CD workflow changes only. No application logic is modified.

---

Documentation

⚠️ CHANGELOG.md not updated — The file exists with an [Unreleased] section. Workflow changes are typically worth noting for maintainability. Low severity given the template placeholder state of the changelog, but the pattern should be set here.

✅ README — No README update needed for internal workflow changes.

✅ Inline comments — Workflows are self-documenting at this complexity level.

---

Security

✅ No hardcoded credentials — Secret references use secrets.SENZING_GITHUB_CODEOWNER_PR_RW_TOKEN correctly.

✅ Principle of least privilege maintained — Adding pull-requests: read to docker-verify-refreshed-at-updated.yaml is correct; the reusable upstream workflow requires it and the scope is minimal (read-only).

✅ No license files (.lic) or AQAAAD strings — None present.

✅ No sensitive data in logs — N/A for workflow permission changes.

---

Summary

Severity	Issue
Low	Confirm intentional scope narrowing: REFRESHED_AT check no longer runs on PRs to non-main branches
Low	CHANGELOG.md not updated
Info	Style guide could not be auto-verified — manual check recommended

The changes are clean and well-scoped. The main item to confirm is whether the reduced trigger scope for the Dockerfile verification is intentional.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter