chore(ci): add concurrency, timeouts, narrow fetch-depth, extend path filters

- Concurrency: PR runs cancel on new pushes (cheap signal refresh);
  main and release runs never cancel (preserve history, avoid partial
  releases).
- Timeouts: every job has timeout-minutes so a stuck runner can't burn
  the 6h default (15m for prep/lint/check/tag, 20m for SDK jobs, 30m
  for the full goreleaser run).
- fetch-depth: release_provider keeps :0 for goreleaser's changelog;
  release_python_sdk and tag_go_sdk drop it — neither reads history.
- Path filters: include .github/workflows/pulumi-*.yml and .golangci.yml
  so workflow / lint config changes trigger CI.

Author: SoulKyu

.github/workflows/pulumi-ci.yml

@@ -10,6 +10,8 @@ on:
       - "internal/**"
       - "go.mod"
       - "go.sum"
+      - ".github/workflows/pulumi-*.yml"
+      - ".golangci.yml"
   pull_request:
     branches:
       - main
@@ -18,6 +20,14 @@ on:
       - "internal/**"
       - "go.mod"
       - "go.sum"
+      - ".github/workflows/pulumi-*.yml"
+      - ".golangci.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Cancel in-progress PR runs on new pushes; let main runs finish to
+  # preserve post-merge signal history.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   prerequisites:
@@ -29,6 +39,7 @@ jobs:
     # Depend on prerequisites so lint auto-skips on schema drift failures.
     needs: prerequisites
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -51,6 +62,7 @@ jobs:
     name: GoReleaser Config Check
     needs: prerequisites
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -66,6 +78,7 @@ jobs:
     name: Generate Python SDK
     needs: prerequisites
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -104,6 +117,7 @@ jobs:
     name: Generate Go SDK
     needs: prerequisites
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/pulumi-release.yml

@@ -19,6 +19,13 @@ permissions:
   id-token: write
   attestations: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Never cancel a release mid-flight — a partial release leaves the GitHub
+  # Release in an inconsistent state (binaries without signatures, tags
+  # without wheels, etc.).
+  cancel-in-progress: false
+
 jobs:
   prerequisites:
     name: Prerequisites
@@ -28,10 +35,13 @@ jobs:
     name: Release Provider
     needs: prerequisites
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          # Full history required so goreleaser's github-native changelog
+          # can walk commits since the previous tag.
           fetch-depth: 0
 
       - name: Setup Go
@@ -92,11 +102,10 @@ jobs:
     # Depend on release_provider so the GitHub release exists before we upload the wheel.
     needs: release_provider
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - name: Setup Go
         uses: actions/setup-go@v5
@@ -144,6 +153,7 @@ jobs:
     name: Tag Go SDK
     needs: release_provider
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4