Apply audit remediation

Apply audit remediation from the 2026-06-10 review.

Author: Pigbibi

.github/workflows/ci.yml

@@ -4,9 +4,13 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -16,4 +20,3 @@ jobs:
         run: python -m pip install -e ".[test]"
       - name: Run tests
         run: python -m pytest -q
-

.github/workflows/cross_repo_smoke.yml

@@ -10,9 +10,17 @@ on:
   schedule:
     - cron: "45 11 * * 6"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: cross-repo-advisory-smoke-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   cross-repo-smoke:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout advisor repository
         uses: actions/checkout@v6

.github/workflows/monthly_advisory_review.yml

@@ -50,10 +50,17 @@ on:
   schedule:
     - cron: "20 13 1 * *"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: monthly-advisory-review-${{ github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
   build-monthly-review:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Checkout advisor repository
         uses: actions/checkout@v6

.github/workflows/publish_advisory_site.yml

@@ -56,9 +56,14 @@ permissions:
   id-token: write
 
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   build-site:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/weekly_advisory_review.yml

@@ -45,10 +45,17 @@ on:
   schedule:
     - cron: "30 12 * * 6"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: weekly-advisory-review-${{ github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
   build-review:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Checkout advisor repository
         uses: actions/checkout@v6