Harden ci workflows with concurrency timeouts credential scoping caching and correct triggers #139

	name: Code Quality Checks

	on:
	pull_request:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint-python:
	name: Lint Python
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout Repository
	uses: actions/checkout@v7
	with:
	persist-credentials: false

	- name: Set Up Python Tooling
	uses: ./.github/workflows/setup

	- name: Run Ruff Lint Checks
	run: uv run ruff check --no-fix .

	- name: Run Ruff Format Checks
	run: uv run ruff format --check .

	type-check-python:
	name: Type Check Python
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout Repository
	uses: actions/checkout@v7
	with:
	persist-credentials: false

	- name: Set Up Python Tooling
	uses: ./.github/workflows/setup

	- name: Run ty Type Checks
	run: uv run ty check

	lint-markdown:
	name: Lint Markdown
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout Repository
	uses: actions/checkout@v7
	with:
	persist-credentials: false

	- name: Set Up Node.js
	uses: actions/setup-node@v6
	with:
	node-version: "24"

	- name: Install Markdownlint CLI
	run: npm install --global markdownlint-cli

	- name: Run Markdownlint
	run: markdownlint --config markdownlint.json --ignore-path .markdownlintignore "*/.md"

Navigation Menu