Harden ci workflows with concurrency timeouts credential scoping caching and correct triggers

[mowi12]

Summary

Hardens CI with concurrency, timeouts, token scoping, caching, trigger cleanup; no release/wiki changes.

Related Issue

Closes #73

Changes

See issue description.

How to Test

open PR → only the 3 PR workflows fire; push a 2nd commit → in-flight runs cancel; after merge → no re-run on main; check setup step logs for cache hit.

Checklist

Either tick the items or cross out those that do not apply (using example text) and provide a brief explanation why they do not apply.

Author

• I linked the issue that this PR closes.
• I tested the changes locally.
• I updated the documentation (if needed).
• I added/updated tests (if needed).

[github-actions]

🚀 Performance Benchmark Results

mr-manager startup benchmark summary
created_at: 2026-07-15T08:48:29.835816+00:00
scan_root: /home/runner/work/_temp/benchmark-fixtures
configured_runs_per_start_type: 10

Version references:
- v0.0.1: v0.0.1
- v0.0.2: v0.0.2
- v0.0.3: v0.0.3
- v1.0.0: v1.0.0
- v1.0.1: v1.0.1
- feat/73-refactor-harden-ci-workflows-with-concurrency-timeouts-credential-scoping-caching-and-correct-triggers (current): e140fd33052b

Per-version timings:
version                                        start  runs  mean_ms  median_ms  p95_ms  avg_repos
-------------------------------------------------------------------------------------------------
v0.0.1                                         cold     10     3.13       3.13    3.21       50.0
v0.0.2                                         cold     10     3.55       3.54    3.65       50.0
v0.0.2                                         warm     10     0.38       0.37    0.41       50.0
v0.0.3                                         cold     10     3.60       3.57    3.76       50.0
v0.0.3                                         warm     10     0.40       0.39    0.49       50.0
v1.0.0                                         cold     10     3.39       3.39    3.48       50.0
v1.0.0                                         warm     10     0.19       0.19    0.21       50.0
v1.0.1                                         cold     10     3.39       3.39    3.46       50.0
v1.0.1                                         warm     10     0.18       0.18    0.21       50.0
feat/73-refactor-harden-ci-workflows-with-con  cold     10     3.38       3.37    3.45       50.0
feat/73-refactor-harden-ci-workflows-with-con  warm     10     0.17       0.17    0.19       50.0

Warm-vs-cold speedup:
- v0.0.2: 9.35x faster warm start (89.3% less startup time)
- v0.0.3: 8.89x faster warm start (88.8% less startup time)
- v1.0.0: 17.84x faster warm start (94.4% less startup time)
- v1.0.1: 18.76x faster warm start (94.7% less startup time)
- feat/73-refactor-harden-ci-workflows-with-concurrency-timeouts-credential-scoping-caching-and-correct-triggers (current): 19.42x faster warm start (94.9% less startup time)```
<!-- thollander/actions-comment-pull-request "benchmark_results" -->

[Copilot]

Pull request overview

Hardens the repository’s GitHub Actions CI workflows to reduce wasted runs and limit token exposure, while speeding up Python environment setup via caching. This aligns with Issue #73’s goal of adding concurrency cancellation, timeouts, credential scoping, caching, and correcting triggers so merges to main don’t re-run PR checks.

Changes:

• Add workflow/job-level concurrency + timeout-minutes to avoid long/hung and superseded runs.
• Scope PR/code-quality checks to pull_request only and disable persisted checkout credentials (persist-credentials: false).
• Enable setup-uv caching in the shared composite setup action.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/setup/action.yml	Enables setup-uv caching to avoid rebuilding dependencies each run.
.github/workflows/pr_quality_checks.yml	Removes push: main, adds concurrency cancellation, timeout, and disables persisted credentials.
.github/workflows/code_quality_checks.yml	Removes push: main, adds concurrency cancellation, per-job timeouts, and disables persisted credentials.
.github/workflows/benchmark.yml	Adds concurrency cancellation, timeout, and disables persisted credentials for the benchmark workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.