[lvrach]

What changed

• Every actions/checkout sets persist-credentials: false (10 steps).
• Every job that runs steps sets timeout-minutes. The 7 jobs that had none get 5 to 30 minutes. On main the longest of them, the image build, takes 4 minutes.
• PR runs group on the PR number instead of head_ref.
• builds.yml: push and release runs group on event and ref. They do not cancel a running build.
• dependency-scan.yml: the group key includes the event.

Why

zizmor . reported 10 medium artipacked findings. A job with no timeout runs for up to six hours. The builds.yml group keyed on the sha, so a release on main's HEAD shared a group with the push build, and one cancelled the other. The main tag could then stay stale. A weekly dependency-scan run and a push at the same sha had the same collision.

How to verify

• zizmor . shows 0 medium findings (10 before). Two low self-repository hints remain.
• actionlint .github/workflows/*.yml shows only the two shellcheck notes that main already has.
• CI on this PR passes. The kind e2e job passes GITHUB_TOKEN through env, so it does not need the checkout credentials.

Not covered

• Dependabot PRs still skip the image build and the Trivy scan (docker-build-dockerhub.yml:52).
• Same-repo PR builds still receive the Docker Hub secrets without a protected environment.
• No .pinact.yaml. The self-repository hints stay.

Linear: MAR-3258

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the workflow-hardening changes.

No open issues 🎉

What changed in this PR

This PR hardens GitHub Actions workflows across the codebase by limiting checkout credential persistence, bounding job runtimes, and preventing unrelated runs from cancelling each other.

Changes:

• Disable credential persistence in all 10 checkout steps.
• Add explicit timeouts to seven jobs that previously had none.
• Use PR numbers for concurrency grouping and separate publishing and dependency-scan runs by event, preserving running push and release builds.

File	Description
.github/​workflows/​kubernetes.yml	Disable checkout credential persistence and group PR runs by number.
.github/​workflows/​harness.yml	Add lint and test timeouts and disable checkout credential persistence.
.github/​workflows/​docker-build-dockerhub.yml	Add metadata, build, and manifest timeouts; disable checkout credential persistence.
.github/​workflows/​dependency-scan.yml	Separate concurrency groups by event and disable checkout credential persistence.
.github/​workflows/​control-plane.yml	Add a lint timeout, harden checkouts, and group PR runs by number.
.github/​workflows/​cli.yml	Disable checkout credential persistence and group PR runs by number.
.github/​workflows/​chart.yml	Disable checkout credential persistence and group PR runs by number.
.github/​workflows/​builds.yml	Separate publishing concurrency groups, preserve running builds, and harden version-check execution.

_{Review effort: Balanced}