Improve CI: PR tests only affected features, 60-min timeout, least-privilege token

.github/workflows/test.yaml

@@ -6,60 +6,45 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
+  get-changed-features:
+    runs-on: ubuntu-latest
+    outputs:
+      features: ${{ steps.filter.outputs.features }}
+      has-features: ${{ steps.filter.outputs.has-features }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: "Detect changed features"
+        id: filter
+        run: |
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            git fetch origin ${{ github.base_ref }}
+            FEATURES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD \
+              | grep -E '^(src|test)/' \
+              | sed -E 's#^(src|test)/([^/]+)/.*#\2#' \
+              | sort -u \
+              | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          else
+            FEATURES=$(ls src/ | sort | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          fi
+          echo "features=$FEATURES" >> $GITHUB_OUTPUT
+          echo "has-features=$(echo "$FEATURES" | jq '. | length > 0')" >> $GITHUB_OUTPUT
+
   test-autogenerated:
+    needs: get-changed-features
+    if: needs.get-changed-features.outputs.has-features == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     continue-on-error: true
     strategy:
       matrix:
-        features:
-          - alexpasmantier-television
-          - asdf-vm.com
-          - astral.sh-uv
-          - atuin.sh
-          - aws-cli
-          - bat
-          - biomejs.dev
-          - btop
-          - bun.sh
-          - charmbracelet-gum
-          - chezmoi.io
-          - cloudflare.com-warp-cli
-          - delta
-          - deno.com
-          - dozzle.dev
-          - devenv.sh
-          - fd
-          - feature-installer
-          - fzf
-          - github.com-cli
-          - helix-editor.com
-          - jj-vcs.dev
-          - jnsahaj-lumen
-          - lazygit
-          - jq
-          - k9scli.io
-          - mosh.org
-          - keybase.io
-          - neovim.io
-          - nixos.org
-          - nvidia.com-cuda
-          - opencode.ai
-          - pi.dev
-          - pkgx.sh
-          - pulumi.com
-          - rclone.org
-          - restic.net
-          - ripgrep
-          - smallstep.com
-          - starship.rs
-          - swc.rs
-          - sshd
-          - tailscale.com
-          - webinstall.dev
-          - yq
-          - zellij.dev
-          - zyedidia-eget
+        features: ${{ fromJson(needs.get-changed-features.outputs.features) }}
         baseImage:
           - debian:latest
           - ubuntu:latest
@@ -74,57 +59,14 @@ jobs:
         run: devcontainer features test --skip-scenarios -f ${{ matrix.features }} -i ${{ matrix.baseImage }} .
 
   test-scenarios:
+    needs: get-changed-features
+    if: needs.get-changed-features.outputs.has-features == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     continue-on-error: true
     strategy:
       matrix:
-        features:
-          - alexpasmantier-television
-          - asdf-vm.com
-          - astral.sh-uv
-          - atuin.sh
-          - bat
-          - biomejs.dev
-          - btop
-          - bun.sh
-          - charmbracelet-gum
-          - chezmoi.io
-          - cloudflare.com-warp-cli
-          - delta
-          - deno.com
-          - dozzle.dev
-          - devenv.sh
-          - fd
-          - feature-installer
-          - fzf
-          - github.com-cli
-          - helix-editor.com
-          - jj-vcs.dev
-          - jnsahaj-lumen
-          - lazygit
-          - jq
-          - k9scli.io
-          - mosh.org
-          - keybase.io
-          - neovim.io
-          - nixos.org
-          - nvidia.com-cuda
-          - opencode.ai
-          - pi.dev
-          - pkgx.sh
-          - pulumi.com
-          - rclone.org
-          - restic.net
-          - ripgrep
-          - smallstep.com
-          - starship.rs
-          - swc.rs
-          - sshd
-          - tailscale.com
-          - webinstall.dev
-          - yq
-          - zellij.dev
-          - zyedidia-eget
+        features: ${{ fromJson(needs.get-changed-features.outputs.features) }}
     steps:
       - uses: actions/checkout@v4
 
@@ -136,6 +78,7 @@ jobs:
 
   test-global:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4