From 293b93ff8c9aa8959bec4f158199b94136ee86d9 Mon Sep 17 00:00:00 2001
From: Amadeus Mader <amadeus@mozart409.com>
Date: Wed, 4 Mar 2026 12:42:13 +0100
Subject: [PATCH] ci: fix pr workflow

---
 .github/workflows/lint_and_test.yml | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint_and_test.yml b/.github/workflows/lint_and_test.yml
index c174559..c2176b1 100644
--- a/.github/workflows/lint_and_test.yml
+++ b/.github/workflows/lint_and_test.yml
@@ -9,10 +9,19 @@ on:
       - master
   workflow_dispatch:
 
+# Cancel in-progress runs for the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     name: Build, Lint, and Test
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
     env:
       COMPOSE_FILE: ./docker-compose.ci.yml
@@ -20,16 +29,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Pull prebuilt images
         run: docker compose pull
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Build docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: .
           file: ./docker/dev.Dockerfile
@@ -56,3 +65,7 @@ jobs:
 
       - name: Run code checks
         run: docker compose exec -T phx mix check --no-fix --no-retry
+
+      - name: Cleanup
+        if: always()
+        run: docker compose down --volumes --remove-orphans