ci: optimize GitHub workflows with caching, concurrency, timeouts, and permissions

.github/workflows/build-and-test.yml

@@ -2,20 +2,41 @@ name: Build and test code
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
   pull_request:
-    branches: [ "main" ]
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: 0
 
 jobs:
   build:
+    if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-    - uses: actions/checkout@v4
-    - name: Build
-      run: cargo test --workspace --verbose --no-run
-    - name: Run tests
-      run: cargo test --workspace --verbose
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo test --workspace --verbose --no-run
+      - name: Run tests
+        run: cargo test --workspace --verbose

.github/workflows/dependency-audit.yml

@@ -3,8 +3,16 @@ name: Dependency security audit
 on:
   push:
     paths:
-      - '**/Cargo.toml'
-      - '**/Cargo.lock'
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "deny.toml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
@@ -14,28 +22,14 @@ jobs:
   security_audit:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      checks: write
     steps:
       - name: Check out
         uses: actions/checkout@v4
 
-      - name: Cache audit-check build
-        id: cache-audit-check
-        uses: actions/cache@v4
-        continue-on-error: false
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-deny-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-deny
-
-      - name: Run audit-check action
-        run: |
-          which cargo-deny || cargo install cargo-deny
-          cargo deny check
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: Run cargo deny
+        run: cargo deny check

.github/workflows/docs.yml

@@ -5,27 +5,34 @@ name: Docs
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   # TODO(template) remove docs publishing, when the crate is published to crates.io
   docs:
-    permissions:
-        contents: write
     name: Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
           persist-credentials: false
 
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
       - name: Setup pages
         id: pages
         uses: actions/configure-pages@v5
 
-      - name: Clean docs folder
-        run: cargo clean --doc
-
       # Documentation with Latex support
       # TODO(template) if Latex is not needed
       # just remove katex-header.html at the root and RUSTDOCFLAGS here
@@ -49,8 +56,9 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     needs: docs
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v4

.github/workflows/linter.yml

@@ -1,23 +1,63 @@
 name: Linter check
 
-on: push
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: 0
-  # Make sure CI fails on all warnings, including Clippy lints
-  RUSTFLAGS: "-Dwarnings"
 
 jobs:
-  linter_check:
+  fmt:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
       - name: Run Fmt
         run: cargo fmt --all -- --check
 
+  clippy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # Make sure CI fails on all warnings, including Clippy lints
+      RUSTFLAGS: "-Dwarnings"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
       - name: Run Clippy
         run: cargo clippy --all-targets --all-features
 
+  typos:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
       - name: Check typos
         uses: crate-ci/typos@master

.github/workflows/ub-detection.yml

@@ -1,6 +1,27 @@
 name: UB (undefined behavior) detection
 
-on: push
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+      - "LICENSE*"
+      - ".github/workflows/docs.yml"
+      - "katex-header.html"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
@@ -16,9 +37,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - run: |
-          rustup +nightly component add miri
-          cargo +nightly miri setup
-          PROPTEST_DISABLE_FAILURE_PERSISTENCE=true \
-            MIRIFLAGS="-Zmiri-env-forward=PROPTEST_DISABLE_FAILURE_PERSISTENCE -Zmiri-strict-provenance" \
-            cargo +nightly miri test --lib
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: miri
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - name: Run Miri
+        run: MIRIFLAGS="-Zmiri-strict-provenance" cargo +nightly miri test --lib

template_crate/src/lib.rs

@@ -71,6 +71,7 @@ mod tests {
 
     proptest! {
         #[test]
+        #[cfg_attr(miri, ignore)]
         fn addition_proptest(a in 0_u8..20, b in 0_u8..20) {
             assert_eq!(
                 a.checked_add(b),