Build container: add concurrency group so overlapping master builds can't deploy an older commit #3733

build-container.yml has no concurrency group, so overlapping master builds can deploy an older commit than the one already deployed.

Happened on 2026-09-18:

#3617 finished first and bumped prod to sha-b4caf5d1…. #3730 finished 34s later and bumped prod back to sha-23032e5a…, which is b4caf5d1's parent. Dark mode was live for 34 seconds, then rolled back. Fastly purges had no effect because the origin itself was serving the old build.

Proposed fix:

name: Build container
concurrency:
  group: build-container-${{ github.ref }}
  cancel-in-progress: true
on:
  push:

This cancels the superseded #3730 build as soon as #3617 pushes. Scoping to github.ref keeps PR builds independent, and superseded PR builds get cancelled too.

Tradeoff: intermediate master commits no longer get images, so you can't pin to a SHA that was never deployed. Rollbacks target previously deployed tags, which are unaffected.

This only makes the race rare. The ordering guarantee belongs in set-image.yml — see metacpan/metacpan-k8s#206.

— Claude (claude-opus-5)