From 9439774780b6c8b8d741e193e5116b5d81353bbf Mon Sep 17 00:00:00 2001
From: Ibukun Dairo <ibukun.o.dairo@gmail.com>
Date: Sat, 3 Oct 2026 15:51:07 +0100
Subject: [PATCH] ci: workflows follow the Cuesoft standard

---
 .github/workflows/ci.yml            |  6 ++++++
 .github/workflows/compat.yml        | 14 +++++++++++---
 .github/workflows/release-guard.yml |  5 +++++
 .github/workflows/release.yml       |  5 +++++
 4 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d84de2b..381c119 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,9 +8,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   skill:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
@@ -23,6 +28,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: shellcheck
diff --git a/.github/workflows/compat.yml b/.github/workflows/compat.yml
index 7fd9ecc..5a511d4 100644
--- a/.github/workflows/compat.yml
+++ b/.github/workflows/compat.yml
@@ -18,9 +18,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   grammar:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
@@ -77,19 +82,22 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: install ${{ matrix.tool }}
+        env:
+          TOOL: ${{ matrix.tool }}
+          PACKAGE: ${{ matrix.package }}
         run: |
           # Retry for transient registry failures. Exhausting the retries
           # means the package is gone or renamed, which is a real finding.
           for attempt in 1 2 3; do
-            if npm install -g ${{ matrix.package }}; then
+            if npm install -g "$PACKAGE"; then
               exit 0
             fi
             echo "install attempt $attempt failed; retrying"
             sleep $((attempt * 10))
           done
-          echo "::error::${{ matrix.package }} could not be installed after" \
+          echo "::error::$PACKAGE could not be installed after" \
             "3 attempts. If it was renamed or withdrawn, agent-sync's" \
-            "support for ${{ matrix.tool }} needs updating." >&2
+            "support for $TOOL needs updating." >&2
           exit 1
       # Matching lives in a script so it can be unit tested; see
       # tests/compat_test.sh, which pins the substring false positives.
diff --git a/.github/workflows/release-guard.yml b/.github/workflows/release-guard.yml
index 6f4bc4b..95400c7 100644
--- a/.github/workflows/release-guard.yml
+++ b/.github/workflows/release-guard.yml
@@ -13,9 +13,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   complete:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1a96ba..58c554f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,7 @@ concurrency:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       release: ${{ steps.decide.outputs.release }}
       tag: ${{ steps.decide.outputs.tag }}
@@ -78,6 +79,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: shellcheck
@@ -93,6 +95,7 @@ jobs:
       id-token: write
       attestations: write
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ needs.check.outputs.tag }}
@@ -159,6 +162,7 @@ jobs:
   tap:
     needs: [check, publish]
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       TAG: ${{ needs.check.outputs.tag }}
     steps:
@@ -192,6 +196,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ needs.check.outputs.tag }}