GitHub queues runs blocked by the concurrency group in order rather than
cancelling the older one, so every cron restart added a link that waited
its turn behind the chain and the queue grew by about five a day. A link
that starts and finds another already waiting now steps aside.
GitHub's cron scheduler creates this repository's scheduled runs four to
five hours late and drops the slots in between, so the hourly Hot CVEs
refresh cannot come from a cron. A workflow_dispatch call creates a run
within seconds, so a pacemaker workflow now sleeps until the next :05,
fires the refresh and its own successor, and keeps time by itself. Its
cron only restarts the chain if a link fails.
Hot CVEs loses its cron and the gate that was there to coexist with an
external trigger; nothing outside GitHub is involved any more.
0xMarcio