From 8e9669c7485b4fb06ab45cb3b9893542bba40fb4 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Wed, 27 May 2026 12:00:40 +0800
Subject: [PATCH] ci: harden workflow defaults

---
 .github/workflows/lint.yml       |  8 ++++++++
 .github/workflows/playwright.yml | 11 +++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ac4f85571..add69f2ad 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,9 +4,17 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   quality:
     runs-on: ubuntu-22.04
+    timeout-minutes: 20
     strategy:
       matrix:
         node-version: [20]
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 532094623..725c9ea16 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -5,10 +5,17 @@ on:
   pull_request:
     branches: [main, master]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: playwright-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     timeout-minutes: 30
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     if: >-
       github.event_name == 'push' ||
       github.event.pull_request.head.repo.full_name == github.repository
@@ -38,7 +45,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright