From 01416af3ab8b5920072e5e3eacb17f2b80da7c84 Mon Sep 17 00:00:00 2001
From: FilipBl4gojevic <84703395+FilipBl4gojevic@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:35:01 +0200
Subject: [PATCH] ci: harden workflow permissions, add timeout and concurrency
 gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- permissions: contents: read — this workflow only builds and tests,
  it never writes to the repo; matches the convention deploy.yml
  already sets.
- timeout-minutes: 15 on the job so a hung step doesn't burn runner
  time indefinitely.
- concurrency group keyed on the ref so a new push cancels the
  in-flight run for the same branch/PR instead of queuing behind it.

Action versions are left unpinned (still @v4) — SHA-pinning only this
workflow while deploy.yml stays on @v4 would be an inconsistency to
clean up in its own pass, not here.
---
 .github/workflows/ci.yml | 8 ++++++++
 .gitignore               | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce7fcd0..8d97306 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,9 +6,17 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitignore b/.gitignore
index c49dda9..8b089dc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,4 +40,4 @@ mnemonic.txt
 vector-audit-log.json
 
 # Incremental typecheck cache (npm run typecheck uses --incremental)
-*.tsbuildinfo
\ No newline at end of file
+*.tsbuildinfo