fix(workflows): apply workflow review guidelines across all workflows (#19)

- [x] Review all 5 workflow files against GitHub workflow review
instructions
- [x] Fix must-fix issues (security & reliability)
- [x] Add missing timeout-minutes to all jobs (5 minutes for all jobs
per repository requirements)
- [x] Fix runner version pinning (ubuntu-latest → ubuntu-24.04 in
codeql.yml)
- [x] Fix concurrency settings (cancel-in-progress uses != 'push' for
better coverage)
- [x] Add missing shell safety (set -euo pipefail) to all multi-line
scripts
- [x] Address improvement issues (maintainability)
  - [x] Fix step naming to use proper title case
  - [x] Fix shell flags (euoC → euo in copilot-setup-steps.yml)
- [x] Validate all changes
  - [x] All tests pass (38/38 tests passing)
  - [x] All workflows syntax validated
- [x] Update workflow review instructions for consistency
- [x] Resolve merge conflicts with main branch

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

---------

Signed-off-by: Jonathan Garbee <jonathan@garbee.me>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Garbee <868301+Garbee@users.noreply.github.com>
Co-authored-by: Jonathan Garbee <jonathan@garbee.me>

Author: Copilot

.github/instructions/github-workflow-review.instructions.md

@@ -60,7 +60,7 @@ You are an expert GitHub Actions engineer and security reviewer. Your goal is to
   - `github.head_ref` is only populated for pull request events, so the OR operator (`||`) falls back to `github.ref_name` for push events.
   - `github.ref_name` provides a succinct name (e.g., `main`) instead of the full ref path (e.g., `refs/heads/main`).
   - This ensures PR runs are grouped separately from target branch runs (e.g., `Workflow-feature-branch` vs `Workflow-main`).
-- **Cancel in Progress:** Use `cancel-in-progress: ${{ github.event_name == 'pull_request' }}` to cancel outdated PR runs while allowing push events to complete.
+- **Cancel in Progress:** Use `cancel-in-progress: ${{ github.event_name != 'push' }}` to cancel outdated PR runs while allowing push events to complete.
   - PR runs benefit from cancellation when new commits are pushed.
   - Push events to protected branches should complete to ensure deployment pipelines finish.
 
@@ -230,7 +230,7 @@ permissions:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 jobs:
   test:

.github/workflows/actionlint.yml

@@ -18,22 +18,28 @@ jobs:
   actionlint:
     name: Actionlint
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     permissions:
       contents: read # Only needed for private repos. Needed to clone the repo.
       actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
       security-events: write # Required for upload-sarif to upload SARIF files.
     steps:
-      - name: Checkout repository
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Start Workflow Telemetry
         uses: ./
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check workflow files
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
+      - name: Add GOPATH to PATH
+        run: echo "$HOME/go/bin" >> "$GITHUB_PATH"
+      - name: Check Workflow Files
         run: actionlint -format "$(cat .github/formatters/actionlint-sarif.gotmpl)" .github/workflows/*.yml > actionlint.sarif
-      - name: Upload SARIF file
+      - name: Upload SARIF File
+        if: ${{ always() }} # Ensure this runs even if the actionlint step fails, so we get results in the Security tab.
         uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           sarif_file: actionlint.sarif

.github/workflows/codeql.yml

@@ -10,12 +10,13 @@ on:
     - cron: "33 11 * * 3"
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 permissions: {}
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     permissions:
       security-events: write # To upload the results of the analysis
       packages: read # To fetch CodeQL packs from GitHub Packages, if you are using any.
@@ -28,7 +29,7 @@ jobs:
           - language: actions
           - language: javascript-typescript
     steps:
-      - name: Checkout repository
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false

.github/workflows/copilot-setup-steps.yml

@@ -16,7 +16,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 permissions: {}
 
@@ -26,6 +26,7 @@ jobs:
     name: Copilot Setup
 
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     # Note: Do not try to run inside of a container yet. That causes all the setup scripts
     # by Copilot to fail since that triggers `sh` instead of `bash` for runs. Setting
@@ -43,21 +44,23 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Setup NodeJS
+      - name: Setup Node.js
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version-file: .node-version
           cache: npm
       - name: Install Dependencies
         run: npm ci
-      - name: Install actionlint
+      - name: Install Actionlint
         run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
+      - name: Add GOPATH to PATH
+        run: echo "$HOME/go/bin" >> "$GITHUB_PATH"
       - name: Install Zizmor
         env:
           TMP_DIR: ${{ runner.temp }}
           GH_TOKEN: ${{ github.token }}
         run: |
-          set -euoC pipefail
+          set -euo pipefail
           tarball="$TMP_DIR/zizmor.tar.gz"
           gh release download --repo zizmorcore/zizmor --pattern "zizmor-x86_64-unknown-linux-gnu.tar.gz" --output "$tarball"
           tar -xzf "$tarball" -C "$TMP_DIR"

.github/workflows/test-action.yml

@@ -10,8 +10,8 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 permissions:
   contents: read # To clone the repository
@@ -21,8 +21,9 @@ jobs:
   test-basic:
     name: Test Basic Usage
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - name: Checkout Code
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -46,8 +47,9 @@ jobs:
   test-custom-interval:
     name: Test Custom Interval
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - name: Checkout Code
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -60,15 +62,17 @@ jobs:
 
       - name: Simulate Workload
         run: |
+          set -euo pipefail
           echo "Simulating CPU and memory intensive workload"
           sleep 10
           echo "Workload simulation complete"
 
   test-resource-visualization:
     name: Test Resource Visualization
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - name: Checkout Code
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -84,6 +88,7 @@ jobs:
 
       - name: CPU and Storage Intensive Activity
         run: |
+          set -euo pipefail
           echo "Starting CPU-intensive activity for 15 seconds..."
           echo "Creating 5GB test file to demonstrate disk usage..."
           dd if=/dev/zero of=/tmp/test-5gb-file.bin bs=1M count=5120 status=progress
@@ -109,6 +114,7 @@ jobs:
 
       - name: Memory Intensive Activity
         run: |
+          set -euo pipefail
           echo "Starting memory-intensive activity for 15 seconds..."
           node -e "
           const arrays = [];
@@ -138,6 +144,7 @@ jobs:
 
       - name: Idle Activity
         run: |
+          set -euo pipefail
           echo "Starting idle period for 5 seconds..."
           sleep 5
           echo "Idle period completed."

.github/workflows/zizmor.yml

@@ -10,7 +10,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 permissions:
   contents: read # To clone the repository
@@ -19,20 +19,21 @@ jobs:
   zizmor:
     name: Zizmor
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     permissions:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
       contents: read # Only needed for private repos. Needed to clone the repo.
       actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
     steps:
-      - name: Checkout Code
+      - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Start Workflow Telemetry
         uses: ./
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Run zizmor
+      - name: Run Zizmor
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
         with:
           persona: auditor