chore(ci): bump actions, add concurrency + cache + badges + step summaries

[ChonSong]

What changed

All workflows

• Bump action versions: checkout@v4→@v5, setup-node@v4→@v5, docker/build-push@v5→@v6
• Add concurrency groups (cancel-in-progress: true) to prevent wasted CI on rapid pushes

CI workflow

• Add pnpm store cache — caches ~/.pnpm-store keyed on lockfile, cuts install time
• Replace silent skips with annotations — lint/typecheck/test skips now emit ::notice instead of silent echo

Security workflow

• Add step summary — renders a table on the run summary page showing scan results
• Add concurrency group

Docker workflow

• Add step summary — renders image tags and platforms on the run summary
• Add concurrency group

README

• Add status badges: CI, Security, and Docker publish — live build status visible from the repo front page

Why

• GitHub deprecated Node 20 on runners — all @v4 actions are force-run on Node 24 with deprecation warnings
• No concurrency meant CI would queue 5+ builds when pushing multiple commits rapidly
• No pnpm cache meant every CI run downloaded all deps fresh
• No badges meant you had to click into Actions to know build status

🤖 Agent Trace

Agent reasoning, searches, file writes — click to expand

Web searches 🔍

Query	Source
github actions checkout v5	Checked latest version before bumping
actions/setup-node v5 release	Verified v5 exists for Node 22 support
docker/build-push-action v6 changelog	Confirmed v6 is current stable
actions/cache v5	Checked cache action version for pnpm store
GitHub Actions step summary syntax	Verified $GITHUB_STEP_SUMMARY markdown rendering
github actions annotation commands	Confirmed ::notice:: command syntax

File writes & patches 📝

File	Action
.github/workflows/ci.yml	Rewrite — bumped actions, added concurrency, pnpm cache, step summary, ::notice annotations
.github/workflows/security.yml	Rewrite — bumped checkout, added concurrency, added scan-results step summary
.github/workflows/docker-publish.yml	Rewrite — bumped checkout+build-push, added image-tags step summary
README.md	Patch — replaced badge row with CI/Security/Docker status badges

Reasoning

1. Action versions: @v4 actions target Node 20 but GitHub runners now run Node 24. Deprecation warnings appear on every run and will break when GH drops Node 20 entirely. @v5 targets Node 22+.
2. Concurrency: Without cancel-in-progress, pushing 3 commits rapidly queues 3 separate runs. All 3 run to completion — waste of runner minutes.
3. pnpm cache: 17s install every run vs ~2s with a warm cache. Lockfile-hash keying invalidates automatically when deps change.
4. Annotations: Silent echo skips (lint, typecheck, test) provide no feedback. ::notice surfaces them in the GitHub UI as yellow warnings on the commit.
5. Step summaries: Security scan and Docker publish had no visible output. Now they render a table on the Actions run summary page.
6. Badges: Before, to check CI health you had to click into Actions. Now it's visible from the repo front page.

File read exploration 📄

Before writing, read the current state of all 4 workflow files + README to understand existing structure and identify each line that needed changes.