Homebrew/brew GitHub Actions scorecard

# No concurrency control (applies to: Docker, Documentation, CodeQL, Licenses, Commit Style)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No path filters on triggers (applies to: CI, Docker, CodeQL, Documentation, Actionlint, Commit Style)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Premium runners (macOS / Windows) (applies to: CI, Update Sorbet files)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# No job timeout (applies to: Docker, Update SPDX license data, Update Sorbet files, CodeQL, Update sponsors, maintainers, manpage and completions, Autogenerated files check, Actionlint, Update SBOM schema, Check pull requests, Manage stale issues and pull requests, Commit Style)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Artifacts at default retention (applies to: Docker, Actionlint)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# Scheduled at the top of the hour (applies to: Update SPDX license data)
on:
  schedule:
    - cron: '10 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Update Sorbet files)
on:
  schedule:
    - cron: '13 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Update sponsors, maintainers, manpage and completions)
on:
  schedule:
    - cron: '47 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# System packages reinstalled every run (applies to: Actionlint)
- uses: awalsh128/cache-apt-pkgs-action@latest
  with:
    packages: <your packages>
    version: 1.0

# Scheduled at the top of the hour (applies to: Update SBOM schema)
on:
  schedule:
    - cron: '55 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Manage stale issues and pull requests)
on:
  schedule:
    - cron: '54 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.