vesperp4/mono GitHub Actions scorecard

# Docker build without layer cache (applies to: Portal API Security Scan)
- uses: docker/build-push-action@v6
  with:
    cache-from: type=gha
    cache-to: type=gha,mode=max

# No concurrency control (applies to: CodeQL, Slack Notify)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: CI, PR Title, OpenSSF Scorecard, Dependency Review, Secret Scan, Release Please, Mainsite Web Test, CodeQL, Portal Web Test, Portal API Test, Portal API Security Scan, TV Engine Test, TV Web Test, npm Audit, Slack Notify, Uptime Check)
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# Artifacts at default retention (applies to: OpenSSF Scorecard)
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# Scheduled at the top of the hour (applies to: OpenSSF Scorecard)
on:
  schedule:
    - cron: '21 6 * * 1'  # was '0 6 * * 1' — any non-:00 minute avoids the herd

# Scheduled workflow runs in forks (applies to: OpenSSF Scorecard, CodeQL)
jobs:
  nightly:
    if: github.repository == 'owner/repo'
    runs-on: ubuntu-latest

# Full-history clone (fetch-depth: 0) (applies to: Secret Scan)
- uses: actions/checkout@v4
  # fetch-depth: 0 removed — default shallow clone is enough here

# Scheduled at the top of the hour (applies to: CodeQL)
on:
  schedule:
    - cron: '29 6 * * 2'  # was '0 6 * * 2' — any non-:00 minute avoids the herd

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.