From 1a01a8c7d50461938a01d254306101f6c582a0da Mon Sep 17 00:00:00 2001
From: Moritz Wieland <moritz.wieland@googlemail.com>
Date: Wed, 15 Jul 2026 10:44:48 +0200
Subject: [PATCH 1/4] ci: enable uv dependency caching

---
 .github/workflows/setup/action.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/setup/action.yml b/.github/workflows/setup/action.yml
index 0cbbf2b..0655f42 100644
--- a/.github/workflows/setup/action.yml
+++ b/.github/workflows/setup/action.yml
@@ -5,6 +5,8 @@ runs:
   steps:
     - name: Set Up UV
       uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
 
     - name: Set Up Python
       uses: actions/setup-python@v6

From e9f38623fdad2ab3b4c3303bca22b7933e413fdf Mon Sep 17 00:00:00 2001
From: Moritz Wieland <moritz.wieland@googlemail.com>
Date: Wed, 15 Jul 2026 10:44:48 +0200
Subject: [PATCH 2/4] ci: scope code quality checks to PRs and add guardrails

---
 .github/workflows/code_quality_checks.yml | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/code_quality_checks.yml b/.github/workflows/code_quality_checks.yml
index 7906a57..ca109c8 100644
--- a/.github/workflows/code_quality_checks.yml
+++ b/.github/workflows/code_quality_checks.yml
@@ -2,20 +2,24 @@ name: Code Quality Checks
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-python:
     name: Lint Python
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup
@@ -29,9 +33,12 @@ jobs:
   type-check-python:
     name: Type Check Python
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup
@@ -42,9 +49,12 @@ jobs:
   lint-markdown:
     name: Lint Markdown
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Node.js
         uses: actions/setup-node@v6

From e0b3a6567089fd8e40fbd2c4a89a9bb959405c3a Mon Sep 17 00:00:00 2001
From: Moritz Wieland <moritz.wieland@googlemail.com>
Date: Wed, 15 Jul 2026 10:44:48 +0200
Subject: [PATCH 3/4] ci: scope pr commit lint to PRs and add guardrails

---
 .github/workflows/pr_quality_checks.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/pr_quality_checks.yml b/.github/workflows/pr_quality_checks.yml
index d70155a..2f49862 100644
--- a/.github/workflows/pr_quality_checks.yml
+++ b/.github/workflows/pr_quality_checks.yml
@@ -2,22 +2,25 @@ name: PR Quality Checks
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-pr:
     name: Lint PR Commits
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set Up Node.js
         uses: actions/setup-node@v6
@@ -34,10 +37,5 @@ jobs:
           npm --version
           npx commitlint --version
 
-      - name: Validate Current Commit (Last Commit)
-        if: github.event_name == 'push'
-        run: npx commitlint --config commitlint.config.js --last --verbose
-
       - name: Validate PR Commits
-        if: github.event_name == 'pull_request'
         run: npx commitlint --config commitlint.config.js --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

From 2c5e33858394b7b05bfa47312c1cb8632e513362 Mon Sep 17 00:00:00 2001
From: Moritz Wieland <moritz.wieland@googlemail.com>
Date: Wed, 15 Jul 2026 10:44:49 +0200
Subject: [PATCH 4/4] ci: add concurrency, timeout and credential scoping to
 benchmark

---
 .github/workflows/benchmark.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 9be5cd5..6a9eb1e 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -7,15 +7,21 @@ permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   run-benchmark:
     name: Run Performance Benchmark
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup