[matej21]

Every workflow job now has a time limit, and a new CI run on a PR cancels the one it replaces.

Change

• ci.yml and release.yml: timeout-minutes: 10 on each job. Without it, a hung job runs until the 6-hour GitHub default. The last 10 runs took 14–26 s.
• ci.yml: concurrency group ${{ github.workflow }}-${{ github.ref }} with cancel-in-progress on for every ref except main. A push to a PR branch cancels the CI run for the previous commit. On main a running CI run is never cancelled; the next push waits for it. GitHub keeps one pending run per group, so a third push in quick succession still replaces the waiting one.
• push in ci.yml was already limited to main; unchanged.

Not changed

release.yml has no cancelling group. Cancelling it could stop npm publish halfway, and each tag has its own ref, so a group keyed on the ref would never supersede anything.

Checks

• actionlint on both workflows: clean
• CI on this PR runs under the new settings

Status

• Review: round 1 approve on 78c6134; its low finding fixed in c4343d3
• CI: green on c4343d3
• Left before merge: maintainer's merge decision

🤖 Generated with Claude Code

[matej21]

Review round 1: Claude Sonnet (independent general-purpose agent), commit 78c6134. Verdict: approve.

Finding (low): .github/workflows/ci.yml:9-11. Two quick pushes to main share the group CI-refs/heads/main, so the second cancels the first, and the earlier commit is left with a "cancelled" check instead of a pass or fail. Proposed fix: cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}.

Checked and fine:

• timeout-minutes: 10 is on both jobs (check and publish). actionlint is clean. Past runs took 14–26 s.
• Group key: github.workflow keeps CI and Release apart. PR runs use refs/pull/N/merge, so a PR run can't cancel a main run or another PR's run.
• Release: no cancelling group is correct. Each tag is a unique ref, and cancelling npm publish partway would be harmful.
• Triggers: no trigger runs on a push to a branch other than main.
• Description: accurate.

[matej21]

Response to review round 1

• low (main runs cancelled): fixed in c4343d3 with the proposed cancel-in-progress expression. The description states the limit: GitHub keeps one pending run per group, so a third push in quick succession still replaces the waiting run on main. A running main run is never cancelled.

actionlint: clean. The finding was low severity, so there is no round 2.