What part of the code is affected?
.github/workflows/: code_quality_checks.yml, pr_quality_checks.yml, benchmark.yml, and the composite .github/workflows/setup/action.yml.
Why is it problematic?
- No concurrency → superseded PR runs finish anyway, wasting minutes.
- No timeout-minutes → a hung step runs up to the 6-hour default.
- checkout persists
GITHUB_TOKEN into .git/config in read-only jobs that run third-party tooling.
code_quality/pr_quality run on pull_request and push: main, so every merge re-runs checks that already passed; commitlint's --last path overlaps the semantic-PR app.- No dependency cache → uv sync rebuilds from scratch each run.
Proposed improvement
Add concurrency (cancel-in-progress) + timeout-minutes + persist-credentials: false to the read-only workflows; scope code_quality/pr_quality to pull_request only; enable enable-cache: true on setup-uv. Leave wiki (push:main) and release (tag) as-is.
Caveat: dropping push: main is safe only if branch protection's "Require branches to be up to date before merging" is enabled.
What part of the code is affected?
.github/workflows/:code_quality_checks.yml,pr_quality_checks.yml,benchmark.yml, and the composite.github/workflows/setup/action.yml.Why is it problematic?
GITHUB_TOKENinto.git/configin read-only jobs that run third-party tooling.code_quality/pr_qualityrun on pull_request and push: main, so every merge re-runs checks that already passed; commitlint's --last path overlaps the semantic-PR app.Proposed improvement
Add concurrency (cancel-in-progress) + timeout-minutes + persist-credentials: false to the read-only workflows; scope
code_quality/pr_qualitytopull_requestonly; enable enable-cache: true on setup-uv. Leave wiki (push:main) and release (tag) as-is.Caveat: dropping push: main is safe only if branch protection's "Require branches to be up to date before merging" is enabled.