ci: cancel superseded runs with native concurrency groups

cancel-redundant-workflows.yml had some overhead as it was spawning an extra
workflow_run job per workflow. With concurrency groups, a new push cancels the
PR's previous run directly.

A cancelled step can leave its docker container running against the shared
sstate.  Label containers with the runner name and remove them in the cleanup
step. Rename docker-prune-images to docker-cleanup accordingly.

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>

.github/actions/docker-build/action.yml

@@ -26,7 +26,7 @@ runs:
       run: |
         # Images older than max_age_days are rebuilt so that base image and
         # package updates are picked up.
-        # Keep docker-prune-images at twice this.
+        # Keep docker-cleanup at twice this.
         max_age_days=7
         tag="$(git rev-parse --short=12 HEAD:.github/workflows/docker-images)"
         image="${{ inputs.docker_image }}:$tag"

.github/actions/docker-cleanup/action.yml

@@ -2,11 +2,20 @@
 #
 # SPDX-License-Identifier: MIT
 
-name: "Prune old CI docker images"
+name: "Cleanup CI docker containers and images"
 
 runs:
   using: "composite"
   steps:
+    - name: Remove CI containers left on this runner
+      shell: bash
+      # A runner executes one job at a time, so any container labelled with
+      # its name is left over from this job (e.g. after a cancellation) or a
+      # previous one.
+      run: |
+        echo "Removing CI containers left by runner $RUNNER_NAME..."
+        docker ps -aq --filter "label=meta-raspberrypi-ci.runner=$RUNNER_NAME" |
+          xargs -r docker rm -f
     - name: Prune old CI docker images
       shell: bash
       # Only images built by docker-build carry the label. Keep this at twice

.github/workflows/cancel-redundant-workflows.yml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: Andrei Gherzan <andrei.gherzan@huawei.com>
-#
-# SPDX-License-Identifier: MIT
-
-name: Cancel redundant workflows
-
-on:
-  workflow_run:
-    workflows:
-      - "Builds"
-      - "Compliance"
-      - "Yocto Compatible"
-    types:
-      - requested
-
-jobs:
-  cancel-redundant-workflows:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: styfle/cancel-workflow-action@0.10.0
-      with:
-        all_but_latest: true
-        workflow_id: ${{ github.event.workflow.id }}

.github/workflows/compliance.yml

@@ -7,6 +7,10 @@ name: Compliance
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   dco:
     name: DCO
@@ -25,12 +29,13 @@ jobs:
       - name: Do DCO check
         run: |
           docker run --rm --security-opt apparmor=unconfined \
+            --label "meta-raspberrypi-ci.runner=$RUNNER_NAME" \
             --security-opt seccomp=unconfined \
             -v "$GITHUB_WORKSPACE:/work:ro" \
             --env "BASE_REF=$GITHUB_BASE_REF" \
             "${{ steps.docker.outputs.image }}"
-      - name: Prune old CI docker images
-        uses: ./.github/actions/docker-prune-images
+      - name: Cleanup CI docker containers and images
+        uses: ./.github/actions/docker-cleanup
         if: always()
       - name: Cleanup dangling docker images
         uses: ./.github/actions/docker-clean-dangling

.github/workflows/yocto-builds.yml

@@ -9,6 +9,10 @@ name: Builds
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     strategy:
@@ -48,6 +52,7 @@ jobs:
       - name: Build the image
         run: |
           docker run --rm --security-opt apparmor=unconfined \
+            --label "meta-raspberrypi-ci.runner=$RUNNER_NAME" \
             --security-opt seccomp=unconfined \
             -v "$GITHUB_WORKSPACE:/work:ro" \
             -v "$DL_DIR:$DL_DIR:rw" \
@@ -62,8 +67,8 @@ jobs:
             "${{ steps.docker.outputs.image }}" \
             /entrypoint-build.sh
         if: steps.changed-files-specific.outputs.any_changed == 'true'
-      - name: Prune old CI docker images
-        uses: ./.github/actions/docker-prune-images
+      - name: Cleanup CI docker containers and images
+        uses: ./.github/actions/docker-cleanup
         if: always()
       - name: Cleanup dangling docker images
         uses: ./.github/actions/docker-clean-dangling

.github/workflows/yocto-layer.yml

@@ -9,6 +9,10 @@ name: Yocto Compatible
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   yocto-check-layer:
     name: Validate with yocto-check-layer
@@ -31,13 +35,14 @@ jobs:
       - name: Run yocto-check-layer
         run: |
           docker run --rm --security-opt apparmor=unconfined \
+            --label "meta-raspberrypi-ci.runner=$RUNNER_NAME" \
             -v "$GITHUB_WORKSPACE:/work:ro" \
             --env "BASE_REF=$GITHUB_BASE_REF" \
             "${{ steps.docker.outputs.image }}" \
             /entrypoint-yocto-check-layer.sh
         if: steps.changed-files-specific.outputs.any_changed == 'true'
-      - name: Prune old CI docker images
-        uses: ./.github/actions/docker-prune-images
+      - name: Cleanup CI docker containers and images
+        uses: ./.github/actions/docker-cleanup
         if: always()
       - name: Cleanup dangling docker images
         uses: ./.github/actions/docker-clean-dangling