redhat-actions/openshift-tools-installer GitHub Actions scorecard

# Missing dependency cache (npm) (applies to: CI Checks, Security Scan, Rebuild Dist for Dependabot)
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'

# No job timeout (applies to: CI Checks, Rebuild Dist for Dependabot, Install from GitHub Example, Install from Mirror Example, Link checker, Security Scan)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Scheduled at the top of the hour (applies to: CI Checks)
on:
  schedule:
    - cron: '22 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled workflow runs in forks (applies to: CI Checks, Install from GitHub Example, Install from Mirror Example, Link checker, Security Scan)
jobs:
  nightly:
    if: github.repository == 'owner/repo'
    runs-on: ubuntu-latest

# No path filters on triggers (applies to: Install from GitHub Example, Install from Mirror Example, Security Scan)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Premium runners (macOS / Windows) (applies to: Install from GitHub Example, Install from Mirror Example)
jobs:
  build:
    runs-on: ubuntu-latest  # ~10x cheaper than macos-latest

# Scheduled at the top of the hour (applies to: Install from GitHub Example)
on:
  schedule:
    - cron: '10 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Install from Mirror Example)
on:
  schedule:
    - cron: '38 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Link checker)
on:
  schedule:
    - cron: '31 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

# Scheduled at the top of the hour (applies to: Security Scan)
on:
  schedule:
    - cron: '29 0 * * *'  # was '0 0 * * *' — any non-:00 minute avoids the herd

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.