9 files changed, 61 insertions, 13 deletions
diff --git a/.github/workflows/analyze.yml b/.github/workflows/analyze.yml
index 4e7a819533..195bfde9cf 100644
--- a/.github/workflows/analyze.yml
+++ b/.github/workflows/analyze.yml
@@ -1,5 +1,5 @@
 name: Static Analysis
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   static-analysis:
     name: GCC-14
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b54af665d4..25fcc6a7b0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,12 +1,10 @@
-name: "CodeQL"
+name: CodeQL
 on:
-  push:
-    branches: [ "develop" ]
-  pull_request:
-    branches: [ "develop" ]
+  workflow_call:
   workflow_dispatch:
   schedule:
     - cron: "27 17 * * 0"
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/configure.yml b/.github/workflows/configure.yml
index 440cbbb3a9..952ab847ab 100644
--- a/.github/workflows/configure.yml
+++ b/.github/workflows/configure.yml
@@ -1,5 +1,5 @@
 name: Configure
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   configure:
     name: ${{ matrix.name }}
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 218299e015..9954926722 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -10,6 +10,12 @@ on:
       - '2.*'
     tags:
       - '*'
+concurrency:
+  # Group by workflow name and branch/PR to only cancel runs on the same branch
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Only cancels in-progress runs if the branch is not 'stable' or 'develop'
+  cancel-in-progress: ${{ !contains(fromJSON('["refs/heads/stable", "refs/heads/develop"]'), github.ref) }}
+
 jobs:
   fuzzing:
     name: Fuzzing
diff --git a/.github/workflows/libpng.yml b/.github/workflows/libpng.yml
index bbba799beb..99e690bf76 100644
--- a/.github/workflows/libpng.yml
+++ b/.github/workflows/libpng.yml
@@ -1,5 +1,5 @@
 name: Libpng
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   libpng:
     name: Ubuntu Clang
diff --git a/.github/workflows/link.yml b/.github/workflows/link.yml
index 369ae85ba5..d90571cb97 100644
--- a/.github/workflows/link.yml
+++ b/.github/workflows/link.yml
@@ -1,5 +1,5 @@
 name: Link
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   zlib:
     name: Link zlib
diff --git a/.github/workflows/orchestrator.yml b/.github/workflows/orchestrator.yml
index 44bea2a1e5..348e1a22e3 100644
--- a/.github/workflows/orchestrator.yml
+++ b/.github/workflows/orchestrator.yml
@@ -1,16 +1,60 @@
 name: Orchestrator
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
+concurrency:
+  # Group by workflow name and branch/PR to only cancel runs on the same branch
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Only cancels in-progress runs if the branch is not 'stable' or 'develop'
+  cancel-in-progress: ${{ !contains(fromJSON('["refs/heads/stable", "refs/heads/develop"]'), github.ref) }}
 
 jobs:
+  # Workflows not handled here: fuzz, lint, release
+
+  analyze:
+    name: Static Analysis
+    uses: ./.github/workflows/analyze.yml
+    secrets: inherit
+
   cmake:
+    name: CMake
     uses: ./.github/workflows/cmake.yml
     secrets: inherit
 
+  codeql:
+    name: CodeQL
+    uses: ./.github/workflows/codeql.yml
+    secrets: inherit
+
+  configure:
+    name: Configure
+    uses: ./.github/workflows/configure.yml
+    secrets: inherit
+
+  libpng:
+    name: Libpng
+    uses: ./.github/workflows/libpng.yml
+    secrets: inherit
+
+  link:
+    name: Link
+    uses: ./.github/workflows/link.yml
+    secrets: inherit
+
+  osb:
+    name: OSB
+    uses: ./.github/workflows/osb.yml
+    secrets: inherit
+
   pigz:
+    name: Pigz
     uses: ./.github/workflows/pigz.yml
     secrets: inherit
 
-  # This job only starts if ALL reusable workflows above succeed
+  pkgcheck:
+    name: Package Check
+    uses: ./.github/workflows/pkgcheck.yml
+    secrets: inherit
+
+  # This job only starts if both cmake and pigz workflows above succeed
   final-upload:
     needs: [cmake, pigz]
     runs-on: ubuntu-slim
diff --git a/.github/workflows/osb.yml b/.github/workflows/osb.yml
index c3a6a05a69..8330211cce 100644
--- a/.github/workflows/osb.yml
+++ b/.github/workflows/osb.yml
@@ -1,5 +1,5 @@
 name: OSB
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   cmake:
     name: ${{ matrix.name }}
diff --git a/.github/workflows/pkgcheck.yml b/.github/workflows/pkgcheck.yml
index fccb5d98b2..8c8d17ea3c 100644
--- a/.github/workflows/pkgcheck.yml
+++ b/.github/workflows/pkgcheck.yml
@@ -1,5 +1,5 @@
 name: Package Check
-on: [push, pull_request, workflow_dispatch]
+on: [workflow_call, workflow_dispatch]
 jobs:
   pkgcheck:
     name: ${{ matrix.name }}