biomejs/biome GitHub Actions scorecard

# Missing dependency cache (cargo) (applies to: Pull request, Benchmarks, CI on main, Parser conformance and comparison)
- uses: Swatinem/rust-cache@v2

# No concurrency control (applies to: Benchmarks, autofix.ci, Needs reproduction, GitHub Actions Security Analysis with zizmor 🌈, Label PRs, Lint Pull Request Titles, Pull request Markdown, Label issue)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: Pull request, Pull request JS, Label PRs, CI on main, Parser conformance and comparison, Label issue, Lint Pull Request Titles, Needs reproduction, Release, Pull request Node.js, Pull request Markdown, autofix.ci, Publish crates, Lint rule docs, GitHub Actions Security Analysis with zizmor 🌈, Pull request Tailwind preset)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Premium runners (macOS / Windows) (applies to: Pull request, CI on main, Release)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# Artifacts at default retention (applies to: Release)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# No path filters on triggers (applies to: GitHub Actions Security Analysis with zizmor 🌈)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.