What cancelled the build?

[rlove]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Misc

Discussion Details

When a Workflow Execution is cancelled there a way to audit who/what cancelled it?

[nileshdhakad18]

If someone cancels a run manually, you’ll see it right on the run page, e.g.:
Workflow run cancelled by rlove
If you’ve set up concurrency with cancel-in-progress: true, then a new run will auto-cancel the old one — in that case no username shows, it’s just the newer run replacing the old.

And if this is in an org, the audit log (workflow.run.cancel) will give you the exact user/app that did the cancel.

[rlove]

This is a repo that is part of an org, but the audit log does not show that data in all cases of cancelled runs.
The reason I am looking as we can't figure out what is causing the cancels on those that don't show up in Audit Log

[nileshdhakad18]

Check your workflow’s concurrency setting, the run timeline (“Superseded by run #XYZ”), and audit filters for workflow.run.cancel.
Currently, GitHub only logs user/app-triggered cancels — not system ones

[Ansh-699]

Who can cancel workflows

Workflow executions can be canceled manually by a user with write access to the repository or automatically (e.g., by a newer workflow run if concurrency is set with cancel-in-progress: true).

Audit visibility

GitHub doesn’t show the canceller directly in the Actions UI. You will see the run marked as Cancelled, but it doesn’t display the username by default.

How to track who canceled
There are a few approaches:

A. GitHub Audit Log (for orgs)

If the repository is in an organization, the Audit Log records workflow cancellations and who triggered them.

Steps:

Go to Organization → Settings → Audit Log

Filter by workflow_run or workflow_job events

Look for workflow_run.cancelled events — the log will include the actor (user) who canceled it.

B. GitHub API

Using the REST API, you can check workflow runs:

[rlove]

This is a repo that is part of an org, but the audit log does not show that data in all cases of cancelled runs. The reason I am looking as we can't figure out what is causing the cancels on those that don't show up in Audit Log