From d6bff2e95e7b10142d7fe9c5aad686296bcfee8b Mon Sep 17 00:00:00 2001
From: Luke Nelson <luke@nelson.zone>
Date: Fri, 26 Jun 2026 23:26:27 +0100
Subject: [PATCH 1/3] ci: use `parallel` where possible

---
 .github/workflows/dependency-review.yml | 21 +++++++++++----------
 .github/workflows/triage-comment.yml    | 24 ++++++++++++------------
 .github/workflows/triage-edited.yml     | 21 +++++++++++----------
 .github/workflows/triage-opened.yml     | 21 +++++++++++----------
 4 files changed, 45 insertions(+), 42 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 630266d..3108bbe 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -19,14 +19,15 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Check provenance downgrades
-        uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
-        with:
-          fail-on-provenance-change: ${{ inputs.fail-on-provenance-change }}
+      - parallel:
+          - name: Check provenance downgrades
+            uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
+            with:
+              fail-on-provenance-change: ${{ inputs.fail-on-provenance-change }}
 
-      - name: Dependency review
-        if: github.event.pull_request || github.event.merge_group
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          base-ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-          head-ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
+          - name: Dependency review
+            if: github.event.pull_request || github.event.merge_group
+            uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+            with:
+              base-ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+              head-ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
diff --git a/.github/workflows/triage-comment.yml b/.github/workflows/triage-comment.yml
index c9fc557..4e972cc 100644
--- a/.github/workflows/triage-comment.yml
+++ b/.github/workflows/triage-comment.yml
@@ -47,20 +47,20 @@ jobs:
           echo "Comment from collaborator/member/owner - no automated analysis performed." >> $GITHUB_STEP_SUMMARY
 
       - if: steps.check-auth.outputs.is_collaborator != 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
+        parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - if: steps.check-auth.outputs.is_collaborator != 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
-
-      - name: Analyze comment
-        if: steps.check-auth.outputs.is_collaborator != 'true'
+        name: Analyze comment
         id: analyze
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
diff --git a/.github/workflows/triage-edited.yml b/.github/workflows/triage-edited.yml
index d4cc204..9e2ec93 100644
--- a/.github/workflows/triage-edited.yml
+++ b/.github/workflows/triage-edited.yml
@@ -24,16 +24,17 @@ jobs:
       contains(github.event.issue.labels.*.name, 'needs reproduction')
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
+      - parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - name: Analyze edited issue
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/triage-opened.yml b/.github/workflows/triage-opened.yml
index 33e3110..e335a31 100644
--- a/.github/workflows/triage-opened.yml
+++ b/.github/workflows/triage-opened.yml
@@ -67,16 +67,17 @@ jobs:
       !github.event.issue.pull_request
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
+      - parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - name: Analyze and triage issue
         id: triage

From 154c6674711137192d05ef5a18996e7f690fb77d Mon Sep 17 00:00:00 2001
From: Luke Nelson <luke@nelson.zone>
Date: Fri, 26 Jun 2026 23:26:44 +0100
Subject: [PATCH 2/3] ci: use `ubuntu-slim` where possible

---
 .github/workflows/agent-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/agent-scan.yml b/.github/workflows/agent-scan.yml
index a98cabe..04b5c9c 100644
--- a/.github/workflows/agent-scan.yml
+++ b/.github/workflows/agent-scan.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   agentscan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: AgentScan
         id: agentscan

From 71101c372a25602ae8c869760c9bfd13c6655115 Mon Sep 17 00:00:00 2001
From: Luke Nelson <luke@nelson.zone>
Date: Fri, 26 Jun 2026 23:30:28 +0100
Subject: [PATCH 3/3] ci: use `persist-credentials: false` where possible

---
 .github/workflows/dependency-review.yml | 1 +
 .github/workflows/reusable-release.yml  | 1 +
 .github/workflows/triage-comment.yml    | 1 +
 .github/workflows/triage-edited.yml     | 1 +
 .github/workflows/triage-opened.yml     | 1 +
 5 files changed, 5 insertions(+)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 3108bbe..9994c65 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -18,6 +18,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - parallel:
           - name: Check provenance downgrades
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
index 4ef0bde..ba0e238 100644
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -80,6 +80,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - run: corepack enable
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/triage-comment.yml b/.github/workflows/triage-comment.yml
index 4e972cc..32f2874 100644
--- a/.github/workflows/triage-comment.yml
+++ b/.github/workflows/triage-comment.yml
@@ -54,6 +54,7 @@ jobs:
               ref: ${{ inputs.scripts-ref }}
               sparse-checkout: scripts/triage
               path: .shared
+              persist-credentials: false
 
           - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
             with:
diff --git a/.github/workflows/triage-edited.yml b/.github/workflows/triage-edited.yml
index 9e2ec93..fe4353e 100644
--- a/.github/workflows/triage-edited.yml
+++ b/.github/workflows/triage-edited.yml
@@ -31,6 +31,7 @@ jobs:
               ref: ${{ inputs.scripts-ref }}
               sparse-checkout: scripts/triage
               path: .shared
+              persist-credentials: false
 
           - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
             with:
diff --git a/.github/workflows/triage-opened.yml b/.github/workflows/triage-opened.yml
index e335a31..da05015 100644
--- a/.github/workflows/triage-opened.yml
+++ b/.github/workflows/triage-opened.yml
@@ -74,6 +74,7 @@ jobs:
               ref: ${{ inputs.scripts-ref }}
               sparse-checkout: scripts/triage
               path: .shared
+              persist-credentials: false
 
           - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
             with: