chore(ci): harden workflows

Author: izzzzzi

.github/workflows/ci.yml

@@ -5,48 +5,67 @@ on:
     branches: [main]
   workflow_call:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   lint-python:
     name: Ruff (Python)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/ruff-action@v3
 
   test-python:
     name: Unit Tests (Python)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - shell: bash
+          cache: "pip"
+      - name: Install Python dependencies
         run: python -m pip install -r requirements.txt
-      - shell: bash
+      - name: Run Python unit tests
         run: python -m unittest discover -s tests -p 'test_*.py'
 
   typecheck-ts:
     name: TypeScript (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
+    defaults:
+      run:
+        working-directory: ui
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
-      - shell: bash
-        run: cd ui && bun install --frozen-lockfile 2>/dev/null || bun install
-      - shell: bash
-        run: cd ui && bun run typecheck
+      - name: Install UI dependencies
+        run: bun install --frozen-lockfile
+      - name: Run TypeScript typecheck
+        run: bun run typecheck
 
   test-ts:
     name: Unit Tests (TypeScript)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: ui
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
-      - shell: bash
-        run: cd ui && bun install --frozen-lockfile 2>/dev/null || bun install
-      - shell: bash
-        run: cd ui && bun run test
+      - name: Install UI dependencies
+        run: bun install --frozen-lockfile
+      - name: Run TypeScript unit tests
+        run: bun run test

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: write
   issues: write
@@ -18,6 +22,7 @@ jobs:
     name: Package Check
     needs: ci
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -30,6 +35,7 @@ jobs:
     name: Semantic Release
     needs: [ci, package]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: github.repository == 'izzzzzi/izTeamSlots'
 
     steps: