CI: no concurrency group or job timeouts; superseded runs and hung jobs burn runners

[akshat-kumar-singhal]

Summary

None of the four workflows (go.yml, typos.yml, website-prod.yml, website-stage.yml) declare a concurrency group or timeout-minutes. Verified: grep -rn "concurrency\|timeout-minutes" .github/workflows/ returns nothing.

1. No concurrency group

Every push to a PR branch starts a full run while the previous one keeps going. Workflow-Pipeline is 14 jobs, and Example-Unit-Testing alone brings up Kafka, Redis, MySQL (as services:) plus Zipkin and MinIO (as docker run) on each of three matrix legs. Two pushes a minute apart means all of that runs twice, and only the second result is ever looked at.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

cancel-in-progress: true is right for pull_request, and safe for the push legs here too since upload_coverage is already gated on github.ref == 'refs/heads/development' and a cancelled coverage upload is simply redone by the next push. If that is felt to be too aggressive for development, the usual form is cancel-in-progress: ${{ github.event_name == 'pull_request' }}.

The website workflows trigger on v*.*.* tags, so they need a group but should not cancel in progress — cancelling a half-finished deploy is worse than letting it complete.

2. No timeout-minutes on any job

A job that hangs runs to GitHub's 6-hour default before the runner is released. The test steps have their own bound (nick-fields/retry timeout_minutes: 5) but nothing else does — Get dependencies, Start MinIO's 60s poll loop, the lint jobs, and the coverage jobs are all unbounded. A timeout-minutes: 20 (30 for the matrix legs) at job level costs nothing and caps the damage.

3. typos.yml runs twice per PR

on:
  push:
  pull_request:

No branch filter and no paths-ignore, so a PR from a branch in the repo triggers it once for the push and once for the PR. go.yml's trigger block is the shape to mirror.

Why file it

This is pure waste rather than a correctness bug, which is why it has stayed invisible — but it is also about the cheapest fix available in CI here: three small, purely additive blocks with no behaviour change to any test.

Context

Found while reviewing run 31266842627 for the Node 20 deprecation warning (fixed in #3864).