From 9be2108aa791ad268eebe1faa13bd77abff26eb7 Mon Sep 17 00:00:00 2001
From: pavel444-byte <pavel.melnikov.kid.1993@gmail.com>
Date: Sat, 15 Aug 2026 18:07:09 +0500
Subject: [PATCH] Harden CI workflow with permissions, concurrency, and caching

---
 .github/workflows/ci.yml | 42 +++++++++++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6fc79be..2d6d56a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,19 +4,43 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # setup-node asks pnpm for its store path when cache: pnpm is enabled,
+      # so pnpm must already be installed and available on PATH.
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.15.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: 18.20.8
           cache: pnpm
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.15.0
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test
-      - run: pnpm typecheck
-      - run: pnpm build
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Test
+        run: pnpm test
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Build
+        run: pnpm build