Add concurrency control and job timeouts in CI

.github/dependabot.yml

@@ -10,6 +10,13 @@ updates:
     labels:
       - "semver: patch"
       - "docs: skip"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -21,3 +28,10 @@ updates:
     labels:
       - "semver: patch"
       - "docs: skip"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ci.yml

@@ -15,10 +15,18 @@ permissions:
   pull-requests: write
   checks: write
 
+# Cancel superseded runs on the same PR; never cancel push/tag/release runs
+# (each gets a unique group via run_id) so reusable workflow_call from the
+# release pipeline is never interrupted.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -36,6 +44,7 @@ jobs:
   goreleaser-check:
     name: GoReleaser Check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -50,6 +59,7 @@ jobs:
   test-unit:
     name: Unit Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -83,6 +93,7 @@ jobs:
   test-integration:
     name: Integration Tests (${{ matrix.os }}${{ matrix.shard && format(' shard {0}/{1}', matrix.shard, matrix.shard_total) || '' }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -186,6 +197,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-integration
     if: always()
+    timeout-minutes: 5
     steps:
       - name: Verify integration matrix succeeded
         run: |
@@ -203,6 +215,7 @@ jobs:
       - test-unit
       - test-integration
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
     steps:

test/integration/az_interception_test.go

@@ -56,7 +56,7 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 	requireAzCLI(t)
 	t.Parallel()
 	workDir := azureWorkDir(t)
-	home := t.TempDir() // fresh ~/.azure: active cloud is the default AzureCloud
+	home := azTempHome(t) // fresh ~/.azure: active cloud is the default AzureCloud
 
 	stdout, _, err := runLstk(t, testContext(t), workDir,
 		env.With(env.Home, home),

test/integration/setup_azure_test.go

@@ -22,6 +22,19 @@ func requireAzCLI(t *testing.T) {
 	}
 }
 
+// azTempHome returns a temporary HOME directory whose cleanup tolerates Windows
+// failures. The Azure CLI spawns background processes that keep handles open
+// under HOME\.azure, so Go's t.TempDir() auto-cleanup can fail with "being used
+// by another process" on Windows and wrongly fail an otherwise-passing test.
+// We remove it best-effort instead.
+func azTempHome(t *testing.T) string {
+	t.Helper()
+	dir, err := os.MkdirTemp("", "lstk-az-home-")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(dir) })
+	return dir
+}
+
 // azureWorkDir prepares a fresh workDir with a project-local `.lstk/config.toml`
 // containing an Azure container, and returns its path. Tests run `lstk` with
 // `cmd.Dir = workDir` so the project-local config search finds this file —