Harden ci workflows with concurrency timeouts credential scoping caching and correct triggers

.github/workflows/benchmark.yml

@@ -7,15 +7,21 @@ permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   run-benchmark:
     name: Run Performance Benchmark
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup

.github/workflows/code_quality_checks.yml

@@ -2,20 +2,24 @@ name: Code Quality Checks
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-python:
     name: Lint Python
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup
@@ -29,9 +33,12 @@ jobs:
   type-check-python:
     name: Type Check Python
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Python Tooling
         uses: ./.github/workflows/setup
@@ -42,9 +49,12 @@ jobs:
   lint-markdown:
     name: Lint Markdown
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set Up Node.js
         uses: actions/setup-node@v6

.github/workflows/pr_quality_checks.yml

@@ -2,22 +2,25 @@ name: PR Quality Checks
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-pr:
     name: Lint PR Commits
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set Up Node.js
         uses: actions/setup-node@v6
@@ -34,10 +37,5 @@ jobs:
           npm --version
           npx commitlint --version
 
-      - name: Validate Current Commit (Last Commit)
-        if: github.event_name == 'push'
-        run: npx commitlint --config commitlint.config.js --last --verbose
-
       - name: Validate PR Commits
-        if: github.event_name == 'pull_request'
         run: npx commitlint --config commitlint.config.js --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

.github/workflows/setup/action.yml

@@ -5,6 +5,8 @@ runs:
   steps:
     - name: Set Up UV
       uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
 
     - name: Set Up Python
       uses: actions/setup-python@v6