nodejs/node GitHub Actions scorecard

# Missing dependency cache (pip) (applies to: Test macOS)
- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'

# Missing dependency cache (npm) (applies to: Commit Queue, Auto Start CI)
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'

# No concurrency control (applies to: First commit message adheres to guidelines, Comment on issues and PRs when labeled, Notify on Review Wanted)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: First commit message adheres to guidelines, Linters, Test Linux, Test macOS, Build from tarball, Auto Start CI, Commit Queue, Coverage Linux, Coverage Windows, Label PRs, Comment on issues and PRs when labeled, Test and upload documentation to artifacts, Test internet, Notify on Push, Scorecard supply-chain security, Notify on Review Wanted, Test Shared libraries, Test Linux (with QUIC))
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# No path filters on triggers (applies to: Linters, Test and upload documentation to artifacts)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Premium runners (macOS / Windows) (applies to: Test macOS, Coverage Windows, Test Shared libraries)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# Artifacts at default retention (applies to: Build from tarball, Test and upload documentation to artifacts, Test Shared libraries)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# Frequent scheduled runs (applies to: Auto Start CI, Commit Queue)
on:
  schedule:
    - cron: '*/30 * * * *'  # every 30 min instead of every minute

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.