From b9e60f696eace4a977b8bcb82f2090e4538728f2 Mon Sep 17 00:00:00 2001
From: Robin Bowes <robin@yo61.com>
Date: Fri, 16 Oct 2026 08:27:58 +0100
Subject: [PATCH] ci: turn on jactionlint's default profile

Fix the 13 findings the default profile reports and set
profile: default.

- missing-timeout (6): 5 minutes for lint, sanity checks, image builds
  and the published-image commitlint job; 8 for commitlint (~100 s);
  6 for publish (63-78 s).
- concurrency-limits (3): ci.yml groups per ref and cancels superseded
  runs except on main; commitlint.yml cancels superseded PR runs only;
  publish-image.yml queues every tag run (cancel-in-progress: false,
  queue: max) so no release is cancelled or skipped.
- duplicate-triggers (1): commitlint.yml runs on pushes to main and on
  pull requests, not on every branch push as well.
- dependabot-cooldown (3): 7-day cooldown on the github-actions, npm
  and docker entries, matching the pre-commit one.

Refs GLB-32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml              |  6 ++++++
 .github/jactionlint.yaml            |  2 +-
 .github/workflows/ci.yml            |  7 +++++++
 .github/workflows/commitlint.yml    | 11 ++++++++++-
 .github/workflows/publish-image.yml |  6 ++++++
 5 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8ebac705..d5f6bb00 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,12 +4,16 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 99
 
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 99
     groups:
       minor-and-patch:
@@ -22,6 +26,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pre-commit
     directory: /
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
index cf9a50ef..a753ec70 100644
--- a/.github/jactionlint.yaml
+++ b/.github/jactionlint.yaml
@@ -1,2 +1,2 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/jdx/jactionlint/main/schema/jactionlint-config.json
-profile: correctness
+profile: default
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 23ae0315..0e3439fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,12 +3,17 @@ on: [push]
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   lint:
     permissions:
       contents: read
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -22,6 +27,7 @@ jobs:
       contents: read
     name: Sanity Checks
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -51,6 +57,7 @@ jobs:
     needs: sanity-checks
     name: Image builds
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 24389879..8223012d 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -1,14 +1,22 @@
 name: Commitlint
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   commitlint:
     permissions:
       contents: read
       pull-requests: read
     runs-on: ubuntu-latest
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -49,6 +57,7 @@ jobs:
       contents: read
       pull-requests: read
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index a23f48fb..8f4214b9 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -11,9 +11,15 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 6
     permissions:
       contents: read
       packages: write