only_status: waiting cancels only one older waiting run instead of all previous runs

[jay-babu]

Bug Description

We are using styfle/cancel-workflow-action@0.13.1 to cancel older GitHub Actions runs that are waiting for protected environment approval.

Based on the README, the default behavior should cancel previous workflow runs created before the current action run, while all_but_latest: true is only needed when the action should also cancel itself and later-scheduled runs, leaving only the newest run.

In practice, when multiple older runs are in waiting state, the action appears to cancel only one older waiting run, leaving at least one other older waiting run still pending approval.

Workflow snippet

jobs:
  cancel-superseded-approvals:
    name: cancel superseded approvals
    runs-on: ubuntu-latest
    timeout-minutes: 3
    permissions:
      actions: write
      contents: read
    steps:
      - name: Cancel older approval-waiting runs
        uses: styfle/cancel-workflow-action@0.13.1
        with:
          access_token: ${{ github.token }}
          only_status: waiting
          force_cancel: true

We are intentionally not setting:

all_but_latest: true

because our understanding from the docs is that this flag is only needed to cancel the current action run and later-created runs:

By default, this action does not cancel any workflows created after itself. The all_but_latest flags allows the action to cancel itself and all later-scheduled workflows, leaving only the latest.

Steps to Reproduce

1. Create a workflow with a protected environment approval gate so deploy runs can sit in waiting.
2. Add the action above before the environment-gated deploy job.
3. Trigger run A and let it wait for approval.
4. Trigger run B and let it wait for approval.
5. Trigger run C so the cancel action runs again.

Expected Behavior

Run C's cancellation step should cancel all older runs from the same workflow/branch that match:

• status == waiting
• not the current run
• created before the current run
• same workflow/branch/repository context

So both A and B should be cancelled, leaving only C waiting for approval.

Actual Behavior

Only one older waiting run is cancelled. Another older waiting run remains pending approval.

Environment

• Action version: styfle/cancel-workflow-action@0.13.1
• Event: push
• Token: ${{ github.token }} with actions: write
• Inputs used:
  • only_status: waiting
  • force_cancel: true
  • all_but_latest not set
• Protected environment approval is used downstream.
• Deploy concurrency uses cancel-in-progress: false because already-running deployments must not be cancelled.

Question

Is this expected behavior when only_status: waiting and force_cancel: true are combined, or should the action cancel every matching older waiting run returned by listWorkflowRuns?

If all_but_latest: true is required to cancel more than one previous waiting run, the README wording may need clarification, because it currently reads as though default behavior should cancel all runs older than the current action run and all_but_latest only extends cancellation to self/later-scheduled runs.