Homebrew/brew GitHub Actions scorecard

# No concurrency control (applies to: Docker, Documentation, CodeQL, Licenses, Commit Style)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No path filters on triggers (applies to: CI, Docker, CodeQL, Documentation, Actionlint, Commit Style)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Premium runners (macOS / Windows) (applies to: CI, Update Sorbet files, Vendor Gems, Release)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# No job timeout (applies to: Docker, Update SPDX license data, Update Sorbet files, Vendor Gems, CodeQL, Autogenerated files check, Actionlint, Sync default branches, Update SBOM schema, Release, Check pull requests, Manage stale issues and pull requests, Commit Style)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Artifacts at default retention (applies to: Docker, Actionlint, Release)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# Scheduled at the top of the hour (applies to: Update SPDX license data)
on:
  schedule:
    - cron: '10 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Update Sorbet files)
on:
  schedule:
    - cron: '13 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Update SBOM schema)
on:
  schedule:
    - cron: '55 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Manage stale issues and pull requests)
on:
  schedule:
    - cron: '54 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.