ci: fix pr workflow

.github/workflows/lint_and_test.yml

@@ -9,10 +9,19 @@ on:
       - master
   workflow_dispatch:
 
+# Cancel in-progress runs for the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     name: Build, Lint, and Test
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
     env:
       COMPOSE_FILE: ./docker-compose.ci.yml
@@ -20,16 +29,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Pull prebuilt images
         run: docker compose pull
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Build docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./docker/dev.Dockerfile
@@ -56,3 +65,7 @@ jobs:
 
       - name: Run code checks
         run: docker compose exec -T phx mix check --no-fix --no-retry
+
+      - name: Cleanup
+        if: always()
+        run: docker compose down --volumes --remove-orphans