More workflow tweaks.

Author: johnbillion

.github/workflows/deploy.yml

@@ -7,6 +7,10 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   vsce:
     name: VS Code Marketplace

.github/workflows/lint-workflows.yml

@@ -20,7 +20,7 @@ jobs:
   lint:
     name: Lint
     permissions:
-      security-events: write
-      actions: read
-      contents: read
+      security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
+      contents: read         # Needed to clone the repo.
+      actions: read          # Needed for codeql-action/upload-sarif to read workflow run info.
     uses: johnbillion/plugin-infrastructure/.github/workflows/reusable-workflow-lint.yml@trunk

.github/workflows/test.yml

@@ -8,6 +8,10 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
@@ -19,6 +23,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: setup node
       uses: actions/setup-node@v4