feat(github-workflows): improve specs with concurrency, permissions, and timeouts

Author: shakaran

.github/workflows/coding-standards.yml

@@ -23,6 +23,14 @@ on:
       - src/**
       - tests/**
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   coding-standards:
     name: "Coding Standards"

.github/workflows/composer-lint.yml

@@ -13,6 +13,14 @@ on:
     paths:
       - .github/workflows/composer-lint.yml
       - "composer.json"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 jobs:
   composer-lint:

.github/workflows/continuous-integration.yml

@@ -25,10 +25,20 @@ on:
       - templates/**
       - tests/**
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
 jobs:
   phpunit:
     name: "PHPUnit"
     runs-on: "ubuntu-latest"
+    timeout-minutes: 10
     env:
       SYMFONY_REQUIRE: ${{matrix.symfony-require}}
       SYMFONY_DEPRECATIONS_HELPER: weak
@@ -131,6 +141,7 @@ jobs:
   upload_coverage:
     name: "Upload coverage to Codecov"
     runs-on: "ubuntu-latest"
+    timeout-minutes: 5
     # Only run on PRs from forks or PRs from branches that do not match `*.x`
     if: "github.event.pull_request.head.repo.full_name != github.repository || !contains(github.event.pull_request.head.ref, '.x')"
     needs:
@@ -151,5 +162,6 @@ jobs:
         uses: "codecov/codecov-action@v5"
         with:
           directory: reports
+          fail_ci_if_error: false
         env:
           CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"

.github/workflows/documentation.yml

@@ -14,6 +14,13 @@ on:
       - ".github/workflows/documentation.yml"
       - "docs/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   documentation:
     name: "Documentation"

.github/workflows/release-on-milestone-closed.yml

@@ -4,6 +4,12 @@ on:
   milestone:
     types:
       - "closed"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 
 jobs:
   release:

.github/workflows/static-analysis.yml

@@ -23,6 +23,14 @@ on:
       - src/**
       - tests/**
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+
 jobs:
   static-analysis:
     name: "Static Analysis"

.github/workflows/test-dev-stability.yml

@@ -5,10 +5,18 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   phpunit:
     name: "PHPUnit"
     runs-on: "ubuntu-latest"
+    timeout-minutes: 10
     env:
       SYMFONY_REQUIRE: ${{matrix.symfony-require}}
 

.github/workflows/website-schema.yml

@@ -15,6 +15,13 @@ on:
       - ".doctrine-project.json"
       - ".github/workflows/website-schema.yml"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   json-validate:
     name: "Validate JSON schema"