release: promote develop → main (v0.4.0 — auth + client provisioning, cluster doctor) (#106)

.github/workflows/build.yml

@@ -14,8 +14,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   schema-drift:
+    timeout-minutes: 10
     name: Schema drift check
     # Verifies the embedded internal/schema/ingest.v1.json matches
     # tracebloc/data-ingestors' master. A green PR that silently
@@ -30,6 +35,7 @@ jobs:
         run: ./scripts/sync-schema.sh --check
 
   test:
+    timeout-minutes: 15
     name: Test
     runs-on: ubuntu-latest
     steps:
@@ -52,6 +58,7 @@ jobs:
         run: go test -race -cover ./...
 
   lint:
+    timeout-minutes: 10
     name: Lint
     runs-on: ubuntu-latest
     steps:
@@ -103,6 +110,7 @@ jobs:
           misspell -error .
 
   build:
+    timeout-minutes: 20
     name: Build (${{ matrix.os }}/${{ matrix.arch }})
     runs-on: ubuntu-latest
     strategy:

.github/workflows/e2e.yml

@@ -21,8 +21,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: e2e-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   integration:
+    timeout-minutes: 30
     name: Integration (kind)
     runs-on: ubuntu-latest
     # Skip on PRs that aren't explicitly opted in via the `e2e` label;

.github/workflows/public-pii-gate-caller.yml

@@ -0,0 +1,14 @@
+name: Public PII gate
+
+# Per-repo caller for the public-repo PII gate. Blocks PRs whose title/body/
+# commits contain a denylisted customer/partner name or known secret.
+# Logic lives in tracebloc/.github/.github/workflows/public-pii-gate.yml.
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize, labeled, unlabeled]
+
+jobs:
+  pii-gate:
+    uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main
+    secrets: inherit

.github/workflows/release.yml

@@ -44,8 +44,13 @@ permissions:
   contents: write  # create / update the GitHub Release
   id-token: write  # cosign keyless OIDC
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   release:
+    timeout-minutes: 20
     name: Build + sign + publish
     runs-on: ubuntu-latest
     strategy:
@@ -158,6 +163,7 @@ jobs:
           if-no-files-found: error
 
   publish:
+    timeout-minutes: 20
     name: Aggregate + create GitHub Release
     runs-on: ubuntu-latest
     needs: release
@@ -220,6 +226,7 @@ jobs:
   # add a HOMEBREW_TAP_TOKEN repo secret with write access to
   # tracebloc/homebrew-tap) when that repo exists.
   bump-homebrew-tap:
+    timeout-minutes: 20
     name: Bump Homebrew tap formula
     runs-on: ubuntu-latest
     needs: publish