From 549cfd65bdd49fe68b0e47b42129e5600ef82028 Mon Sep 17 00:00:00 2001
From: Eric Sun <141227631+EricSun0218@users.noreply.github.com>
Date: Tue, 4 Aug 2026 19:43:14 +0800
Subject: [PATCH 1/3] ci: harden dependency restore and token defaults

---
 .github/workflows/ci.yml                     | 2 +-
 .github/workflows/trusted-source-privacy.yml | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 098b3a6..8bd5556 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
         with:
           dotnet-version: 8.0.x
       - name: Restore portable runtime
-        run: dotnet restore GameAgentRuntime.sln
+        run: dotnet restore GameAgentRuntime.sln --locked-mode
       - name: Build portable runtime
         run: >-
           dotnet build GameAgentRuntime.sln -c Release
diff --git a/.github/workflows/trusted-source-privacy.yml b/.github/workflows/trusted-source-privacy.yml
index 72842fd..8501fef 100644
--- a/.github/workflows/trusted-source-privacy.yml
+++ b/.github/workflows/trusted-source-privacy.yml
@@ -11,6 +11,8 @@ concurrency:
   group: trusted-release-gate-${{ github.event.workflow_run.id }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   DOTNET_CLI_TELEMETRY_OPTOUT: "1"
   DOTNET_NOLOGO: "1"
@@ -218,7 +220,7 @@ jobs:
         with:
           dotnet-version: 8.0.x
       - name: Restore portable runtime
-        run: dotnet restore GameAgentRuntime.sln
+        run: dotnet restore GameAgentRuntime.sln --locked-mode
       - name: Build portable runtime
         run: >-
           dotnet build GameAgentRuntime.sln -c Release

From 64f177f3b7e123ac778c2e98ae56862c7981d3d7 Mon Sep 17 00:00:00 2001
From: Eric Sun <141227631+EricSun0218@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:02:20 +0800
Subject: [PATCH 2/3] test: remove timing races in cleanup coverage

---
 .../DurableAgentRuntimeTests.cs                  | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs b/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
index 939bf66..8026fbf 100644
--- a/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
+++ b/tests/GameAgent.Persistence.Tests/DurableAgentRuntimeTests.cs
@@ -6410,12 +6410,17 @@ public async Task DurationDeadlineIgnoresThrowingCancellationCallbacks()
                 maxProviderAttempts: 2,
                 delay);
             var run = Run(clock.UtcNow);
-            run.Budget.MaxDurationMs = 500;
+            run.Budget.MaxDurationMs = 2_000;
 
-            var outcome = await runtime.RunAsync(
+            var running = runtime.RunAsync(
                     new DurableRunRequest { Run = run }, cancellationToken: TestContext.Current.CancellationToken)
-                .AsTask()
-                .WaitAsync(TimeSpan.FromSeconds(3), cancellationToken: TestContext.Current.CancellationToken);
+                .AsTask();
+            await delay.Started.Task.WaitAsync(
+                TestWaitTimeout,
+                cancellationToken: TestContext.Current.CancellationToken);
+            var outcome = await running.WaitAsync(
+                TimeSpan.FromSeconds(10),
+                cancellationToken: TestContext.Current.CancellationToken);
 
             Assert.Equal(RunStates.BudgetExhausted, outcome.Run.State);
             Assert.Equal("max_duration", outcome.Run.TerminalReason);
@@ -6937,6 +6942,9 @@ public async Task DetachedPreparationDoesNotStarveGlobalProviderAdmission()
 
             second.Release();
             await second.Settled.WaitAsync(TestWaitTimeout, cancellationToken: TestContext.Current.CancellationToken);
+            Assert.True(
+                await WaitUntilAsync(
+                    () => runtime.DetachedProviderCleanupCount == 1));
             var next = runtime.RunAsync(
                     new DurableRunRequest { Run = Run(clock.UtcNow) }, cancellationToken: TestContext.Current.CancellationToken)
                 .AsTask();

From bb39638cbbec637c2b688b84a4a79fd59ef9aad2 Mon Sep 17 00:00:00 2001
From: Eric Sun <141227631+EricSun0218@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:04:23 +0800
Subject: [PATCH 3/3] ci: deduplicate branch and pull request runs

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8bd5556..f5d3e01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 env: