Add jactionlint to template, fix Github workflow lint issues

template/.pre-commit-config.yaml.jinja

@@ -28,6 +28,13 @@ repos:
         entry: betterleaks git . --pre-commit --staged --redact
         language: system
         pass_filenames: false
+      - id: jactionlint
+        name: jactionlint
+        entry: jactionlint --fix
+        language: system
+        types:
+          - yaml
+        files: ^\.github/workflows/
       - id: ruff
         name: ruff
         entry: uv run ruff check --fix

template/mise.toml.jinja

@@ -9,6 +9,7 @@ postinstall = [
 
 [tools]
 betterleaks = "latest"
+jactionlint = "latest"
 "pipx:copier" = "latest"
 prek = "latest"
 taplo = "latest"

template/{% if project_visibility == 'public' %}.github{% endif %}/jactionlint.yaml

@@ -0,0 +1,3 @@
+profile: default
+rules:
+  unpinned-uses: off

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/audit.yaml.jinja

@@ -11,15 +11,25 @@ on:
     paths:
       - uv.lock
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.head_ref || github.ref }}{% endraw %}
+  cancel-in-progress: {% raw %}${{ github.event_name == 'pull_request' }}{% endraw %}
+
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '{{ py.latest() }}'
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/ci.yaml.jinja

@@ -7,6 +7,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: {% raw %}${{ github.workflow }}-${{ github.head_ref || github.ref }}{% endraw %}
   cancel-in-progress: {% raw %}${{ github.event_name == 'pull_request' }}{% endraw %}
@@ -15,6 +18,7 @@ jobs:
   ci:
     name: {% raw %}Test (Python ${{ matrix.python-version }}){% endraw %}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: {% raw %}${{ matrix.python-version }}{% endraw %}
     strategy:
@@ -27,6 +31,8 @@ jobs:
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -65,13 +71,15 @@ jobs:
   docs:
     name: Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '{{ py.latest() }}'
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -94,13 +102,13 @@ jobs:
   betterleaks:
     name: Secret scan
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    timeout-minutes: 15
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -124,13 +132,13 @@ jobs:
     name: Commit messages
     if: {% raw %}${{ github.event_name == 'pull_request' }}{% endraw %}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    timeout-minutes: 15
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: ✉️ Check commit messages
         uses: commit-check/commit-check-action@v2

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/{% if enable_container %}container.yaml{% endif %}.jinja

@@ -8,10 +8,18 @@ on:
     tags:
       - v[0-9]*.[0-9]*
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.head_ref || github.ref }}{% endraw %}
+  cancel-in-progress: {% raw %}${{ github.event_name == 'pull_request' }}{% endraw %}
+
+permissions:
+  contents: read
+
 jobs:
   build-push:
     name: Build and push image
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       packages: write
       contents: read
@@ -20,9 +28,13 @@ jobs:
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 🛠️ Set up buildx
         uses: docker/setup-buildx-action@v4
+        with:
+          cache-binary: {% raw %}${{ !startsWith(github.ref, 'refs/tags/') }}{% endraw %}
 
       - name: 🔑 Log in to the container registry
         uses: docker/login-action@v4
@@ -53,7 +65,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: {% raw %}${{ steps.meta.outputs.tags }}{% endraw %}
           labels: {% raw %}${{ steps.meta.outputs.labels }}{% endraw %}
-          cache-from: type=gha
+          cache-from: {% raw %}${{ !startsWith(github.ref, 'refs/tags/') && 'type=gha' || '' }}{% endraw %}
           cache-to: type=gha,mode=max
 
       - name: 🔒 Attest build provenance

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/{% if enable_container %}ghcr.yaml{% endif %}.jinja

@@ -8,10 +8,18 @@ on:
     - cron: 0 3 * * 0
   workflow_dispatch:
 
+concurrency:
+  group: ghcr-cleanup
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     name: Clean up images
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       packages: write
 

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/{% if enable_docs %}docs.yaml{% endif %}.jinja

@@ -9,24 +9,24 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: pages
+  group: {% raw %}${{ github.workflow }}-${{ github.head_ref || github.ref }}{% endraw %}
   cancel-in-progress: false
 
 jobs:
   build:
     name: Build Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '{{ py.latest() }}'
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -54,9 +54,16 @@ jobs:
     name: Deploy Documentation
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment:
       name: github-pages
       url: {% raw %}${{ steps.deployment.outputs.page_url }}{% endraw %}
+    permissions:
+      pages: write
+      id-token: write
+    concurrency:
+      group: pages
+      cancel-in-progress: false
     steps:
       - name: 🚀 Deploy site
         uses: actions/deploy-pages@v5

template/{% if project_visibility == 'public' %}.github{% endif %}/workflows/{% if enable_pypi %}release.yaml{% endif %}.jinja

@@ -6,30 +6,31 @@ on:
     tags:
       - v[0-9]*.[0-9]*
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.head_ref || github.ref }}{% endraw %}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distribution
     runs-on: ubuntu-latest
+    cache-mode: none
+    timeout-minutes: 15
     env:
       UV_PYTHON: '{{ py.latest() }}'
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-
-      - name: 📦 Cache uv managed packages
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/uv
-          key: {% raw %}uv-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}{% endraw %}
-          restore-keys: |
-            {% raw %}uv-${{ runner.os }}-{% endraw %}
+          persist-credentials: false
 
       - name: 🍳 Set up mise
         uses: jdx/mise-action@v5
         with:
-          cache: true
           install: true
 
       - name: 📦 Build package
@@ -38,13 +39,15 @@ jobs:
       - name: 🔼 Upload artifact
         uses: actions/upload-artifact@v7
         with:
+          if-no-files-found: error
           name: dist
           path: dist/
 
   release:
     name: Create GitHub release
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -55,16 +58,18 @@ jobs:
           path: dist/
 
       - name: 🏷️ Create GitHub release
-        run: gh release create {% raw %}${{ github.ref_name }}{% endraw %} dist/* --generate-notes
+        run: gh release create "${REF_NAME}" dist/* --generate-notes
         env:
           GH_REPO: {% raw %}${{ github.repository }}{% endraw %}
           GH_TOKEN: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
+          REF_NAME: {% raw %}${{ github.ref_name }}{% endraw %}
 {%- if enable_pypi %}
 
   publish:
     name: Publish to PyPI
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment:
       name: pypi
       url: https://pypi.org/project/{{ project_name }}/