ci: set timeouts, harden permissions, cancel builds

Signed-off-by: rare-magma <[email protected]>
rare-magma · Aug 3, 2024 · 5f960cc · 5f960cc
1 parent 008d5da
commit 5f960cc
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -1,10 +1,16 @@
 name: PR
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
 on:
   pull_request:
     types: [opened, reopened]
 jobs:
   test:
     name: test
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -34,7 +40,7 @@ jobs:
 
   e2e:
     name: e2e
-    timeout-minutes: 10
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     container:
       image: mcr.microsoft.com/playwright:v1.45.3-jammy

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,11 +1,17 @@
 name: Release
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
 on:
   push:
     branches:
       - main
 jobs:
   test:
     name: test
+    timeout-minutes: 5
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -35,7 +41,9 @@ jobs:
 
   e2e:
     name: e2e
-    timeout-minutes: 10
+    timeout-minutes: 5
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     container:
       image: mcr.microsoft.com/playwright:v1.45.3-jammy
@@ -75,6 +83,9 @@ jobs:
 
   release:
     name: release
+    timeout-minutes: 5
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs:
       - test
@@ -124,6 +135,8 @@ jobs:
 
       - name: Build
         if: steps.semrel.outputs.version != ''
+        env:
+          NODE_ENV: "production"
         run: pnpm build
 
       - name: Deploy to Cloudflare Pages