Improve release workflows and cache usage

.github/workflows/create-release.yml

@@ -12,6 +12,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: release-${{ github.event.inputs.version || github.ref || github.run_id }}
+  cancel-in-progress: false
+
 jobs:
   extract_version:
     runs-on: ubuntu-latest
@@ -62,6 +66,9 @@ jobs:
     needs: version_guard
     runs-on: ubuntu-latest
     timeout-minutes: 90
+    permissions:
+      contents: read
+      packages: read
     env:
       FRONTEND_DIST: frontend-modern/dist
     steps:
@@ -127,6 +134,16 @@ jobs:
       - name: Build Pulse for integration tests
         run: make build
 
+      - name: Log in to GHCR for build cache
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::GITHUB_TOKEN not available for GHCR login"
+            exit 1
+          fi
+          echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
       - name: Build Docker images for integration tests
         run: |
           docker build -t pulse-mock-github:test tests/integration/mock-github-server
@@ -314,11 +331,14 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.24'
+          cache: true
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: 'frontend-modern/package-lock.json'
 
       - name: Install dependencies
         run: |
@@ -326,8 +346,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y zip
 
-          # Install Helm for chart packaging
+      - name: Set up Helm
-          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+        uses: azure/setup-helm@v4
+        with:
+          version: 'v3.15.2'
 
       - name: Build release artifacts
         run: |

.github/workflows/release-dry-run.yml

@@ -13,6 +13,9 @@ jobs:
     name: Preflight Release Checks (No Publish)
     runs-on: ubuntu-latest
     timeout-minutes: 90
+    permissions:
+      contents: read
+      packages: read
 
     steps:
       - name: Checkout repository
@@ -22,6 +25,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: 'frontend-modern/package-lock.json'
 
       - name: Install frontend dependencies
         run: npm --prefix frontend-modern ci
@@ -45,6 +50,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.24'
+          cache: true
 
       - name: Run backend tests
         run: go test ./...
@@ -58,10 +64,20 @@ jobs:
       - name: Build Pulse binaries for integration tests
         run: make build
 
+      - name: Log in to GHCR for build cache
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::GITHUB_TOKEN not available for GHCR login"
+            exit 1
+          fi
+          echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
       - name: Build Docker images for integration tests
         run: |
           docker build -t pulse-mock-github:test tests/integration/mock-github-server
-          docker build -t pulse:test -f Dockerfile .
+          docker build -t pulse:test -f Dockerfile --target runtime --cache-from ghcr.io/${{ github.repository_owner }}/pulse:buildcache --build-arg BUILDKIT_INLINE_CACHE=1 .
 
       - name: Run integration diagnostics
         working-directory: tests/integration