biomejs/biome GitHub Actions scorecard

# Missing dependency cache (cargo) (applies to: Benchmarks, Pull request, Parser conformance and comparison)
- uses: Swatinem/rust-cache@v2

# No concurrency control (applies to: Benchmarks, autofix.ci, Benchmarks Markdown, Lint Pull Request Titles, Label PRs, GitHub Actions Security Analysis with zizmor 🌈, Pull request Markdown, Label issue, AgentScan)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: Pull request, Pull request JS, Label PRs, Parser conformance and comparison, Label issue, Lint Pull Request Titles, Needs reproduction, Pull request Node.js, Pull request Markdown, autofix.ci, Lint rule docs, GitHub Actions Security Analysis with zizmor 🌈, AgentScan)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Premium runners (macOS / Windows) (applies to: Pull request)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# No path filters on triggers (applies to: GitHub Actions Security Analysis with zizmor 🌈)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.