ci: improve workflows

[luc122c]

🔗 Linked issue

📚 Description

ubuntu-slim runner

Use it for agent-scan.yml, provenance.yml, and ci.yml — the lighter 1-vCPU runner reduces queue times and resource usage.

Concurrency groups

Added to all PR-triggered workflows (autofix.yml, ci.yml) so runs for the same PR/branch queue sequentially. cancel-in-progress was intentionally omitted — GitHub's event system can fire duplicate pull_request events for a single push, and cancel-in-progress: true caused those duplicates to cancel the legitimate run after 1 second. Runs now queue instead.

persist-credentials: false

Set on actions/checkout in ci.yml, release.yml, and provenance.yml — none of those jobs perform subsequent git operations. autofix.yml is intentionally excluded since autofix-ci/action pushes lint fixes.

Pre-install corepack

Use npm i -g --force corepack && corepack enable instead of relying on the bundled version, which will be removed in Node 26. The --force flag is needed because the npm global prefix on Windows may already contain a yarn shim.

Consistent formatting

Add blank lines between all steps and between all top-level keys across every workflow.

[luc122c]

I'm not sure why autofix added this?

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflows now define explicit checkout, Corepack, Node.js, and dependency installation steps. Autofix and CI add concurrency groups. CI and provenance disable checkout credential persistence. The agent-scan and provenance jobs switch to ubuntu-slim. The Autofix action step receives an explicit name. Existing action revisions and dependency commands remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately identifies improvements to CI workflows, although it does not specify the individual workflow changes.
Description check	✅ Passed	The description clearly explains the workflow, runner, concurrency, checkout, Corepack, and formatting changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/autofix.yml (1)

19-20: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the Corepack bootstrap version across workflows.

npm i -g --force corepack resolves a mutable version on every run, undermining the repository’s otherwise pinned package-manager setup. Pin a vetted Corepack version consistently:

• .github/workflows/autofix.yml#L19-L20: use corepack@<approved-version>.
• .github/workflows/ci.yml#L26-L27: use the same exact Corepack version.
• .github/workflows/release.yml#L25-L26: use the same exact Corepack version before publishing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/autofix.yml around lines 19 - 20, Pin the Corepack
bootstrap dependency to one approved version instead of installing the mutable
latest version. Update the “Enable corepack” steps in
.github/workflows/autofix.yml lines 19-20, .github/workflows/ci.yml lines 26-27,
and .github/workflows/release.yml lines 25-26 to use the identical
corepack@<approved-version> specification before enabling Corepack.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/provenance.yml:
- Around line 18-21: Update the Checkout step in the provenance workflow to
fetch the full repository history, including the origin/main ref required by
provenance comparison. Add the appropriate checkout configuration alongside
persist-credentials without changing the existing action pin or credential
behavior.

---

Nitpick comments:
In @.github/workflows/autofix.yml:
- Around line 19-20: Pin the Corepack bootstrap dependency to one approved
version instead of installing the mutable latest version. Update the “Enable
corepack” steps in .github/workflows/autofix.yml lines 19-20,
.github/workflows/ci.yml lines 26-27, and .github/workflows/release.yml lines
25-26 to use the identical corepack@<approved-version> specification before
enabling Corepack.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 06a47b2c-9db9-4bd4-b20d-e11176b275e4

📥 Commits

Reviewing files that changed from the base of the PR and between 6ddbc7f and 4b67a7b.

📒 Files selected for processing (6)

• .github/workflows/agent-scan.yml
• .github/workflows/autofix.yml
• .github/workflows/ci.yml
• .github/workflows/provenance.yml
• .github/workflows/release.yml
• modules/nuxt-charts.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/autofix.yml (1)

19-20: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the Corepack bootstrap version.

npm i -g --force corepack installs Corepack without a version and defaults to the latest dist tag. Pin this in .github/workflows/autofix.yml and the matching setup commands in other workflows, then verify the selected Corepack version works with the workflow Node versions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/autofix.yml around lines 19 - 20, Pin the Corepack package
version in the “Enable corepack” step instead of installing the unversioned
latest release. Apply the same explicit version to matching Corepack setup
commands in the other workflows, and verify that the pinned version supports
each workflow’s configured Node.js version.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/autofix.yml:
- Around line 19-20: Pin the Corepack package version in the “Enable corepack”
step instead of installing the unversioned latest release. Apply the same
explicit version to matching Corepack setup commands in the other workflows, and
verify that the pinned version supports each workflow’s configured Node.js
version.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a17beff4-5de7-4c93-92a1-cc577d5ded1e

📥 Commits

Reviewing files that changed from the base of the PR and between 6f1d1c6 and 030ffcd.

📒 Files selected for processing (5)

• .github/workflows/agent-scan.yml
• .github/workflows/autofix.yml
• .github/workflows/ci.yml
• .github/workflows/provenance.yml
• .github/workflows/release.yml

🚧 Files skipped from review as they are similar to previous changes (4)

• .github/workflows/provenance.yml
• .github/workflows/release.yml
• .github/workflows/agent-scan.yml
• .github/workflows/ci.yml