Refactor github actions workflows

Author: koki-develop

.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
-name: setup
-description: ""
+name: Setup
+description: "Setup the environment"
 
 runs:
   using: composite

.github/workflows/ci.yml

@@ -1,36 +1,67 @@
-name: ci
+name: CI
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
 
 on:
+  pull_request:
   push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
+    timeout-minutes: 10
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - run: go test ./... -race -coverprofile=coverage.out -covermode=atomic
       - uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
 
   build:
+    timeout-minutes: 10
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          fetch-depth: 0
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - run: go build .
 
   lint:
+    timeout-minutes: 10
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - run: golangci-lint run --verbose ./...
 
   goreleaser:
+    timeout-minutes: 10
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - run: goreleaser check

.github/workflows/release.yml

@@ -1,22 +1,33 @@
-name: release
+name: Release
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
 
 on:
   push:
     tags:
       - "v*"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
-    runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: ./.github/actions/setup
-      - name: release
-        run: goreleaser release --clean
+      - run: goreleaser release --clean
         env:
           GITHUB_TOKEN: ${{ github.token }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}