From 39d2f214b9e2464df233ea4a56679e977c0f523c Mon Sep 17 00:00:00 2001 From: yessjun Date: Mon, 10 Aug 2026 00:24:42 +0900 Subject: [PATCH] ci: bound the workflow and move the actions forward A branch that gets three pushes in a minute ran three full jobs, and the two that no longer described anything kept runners busy. The job also took whatever token permissions the repository grants by default, while writing nothing. The actions were behind their current releases; the versions were read from each action's release information rather than assumed. --- .github/workflows/verify.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 65aaea6e..5745d20f 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -5,13 +5,24 @@ on: push: branches: [main] +# A branch that gets three pushes in a minute ran three full jobs, and the two +# that no longer describe anything were still occupying runners. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +# Without this the job's token carries whatever the repository default grants. +# Nothing here writes anything. +permissions: + contents: read + jobs: verify: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-java@v5 with: distribution: temurin java-version: '25'