nodejs/node GitHub Actions scorecard

# Missing dependency cache (pip) (applies to: Test macOS)
- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'

# Missing dependency cache (npm) (applies to: Commit Queue)
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'

# Concurrency without cancel-in-progress (applies to: Commit Queue)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: First commit message adheres to guidelines, Linters, Test Linux, Test macOS, Build from tarball, Commit Queue, Coverage Linux, Coverage Windows, Label PRs, Comment on issues and PRs when labeled, Test and upload documentation to artifacts, Notify on Push, Scorecard supply-chain security, Notify on Review Wanted, Test Shared libraries, Contributor guidance)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# No path filters on triggers (applies to: Linters, Test and upload documentation to artifacts)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Premium runners (macOS / Windows) (applies to: Test macOS, Coverage Windows, Test Shared libraries)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# Artifacts at default retention (applies to: Build from tarball, Test and upload documentation to artifacts, Test Shared libraries)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# No concurrency control (applies to: Comment on issues and PRs when labeled, Notify on Review Wanted)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.