fleet: the busbar-release plugin template (CI, deps policy, settings)

.github/workflows/ci.yml

@@ -6,14 +6,24 @@
 name: ci
 
 on:
+  # A tree is tested once: on its pull request into dev and on the push that lands it on dev. qa and
+  # main take dev's commits by pull request whose head is that tested commit: the checks it carries
+  # from dev's run satisfy the ruleset, and nothing re-tests it. Any other head: run this by hand
+  # (workflow_dispatch) on its branch.
   push:
-    branches: [dev, qa, main]
+    branches: [dev]
   pull_request:
-    branches: [dev, qa, main]
+    branches: [dev]
   workflow_dispatch: {}
   # release.yml runs this file on the tagged commit before it publishes.
   workflow_call: {}
 
+# A newer push to a pull request cancels its older run (only the newest commit can merge); a push to
+# dev, a dispatch and release.yml's call run to the end.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/consumer-verify.yml

@@ -1,12 +1,12 @@
 # RENDERED by `busbar-release plugin heal busbar-store-postgres` from GetBusbar/busbar-release template/; a hand
-# edit is overwritten by the next sync. Daily: does the newest
+# edit is overwritten by the next sync. Weekly: does the newest
 # PUBLISHED release still work for a user (busbar's plugin-consumer-verify.yml)? A publish-time check
 # cannot see an artifact that rots afterwards; release.yml verifies each release as it publishes.
 name: consumer-verify
 
 on:
   schedule:
-    - cron: "10 9 * * *"
+    - cron: "10 9 * * 1"
   workflow_dispatch:
     inputs:
       version:

.github/workflows/dependabot-bundle.yml

@@ -13,7 +13,7 @@ on:
     types: [opened, synchronize]
     branches: [dev]
   schedule:
-    - cron: "23 5 * * *"
+    - cron: "23 5 * * 1"
   workflow_dispatch:
 permissions:
   contents: write