ci: improve workflows

[luc122c]

🔗 Linked issue

📚 Description

Hi, there are a few improvements that can be made to the workflows.

ubuntu-slim runner

Use ubuntu-slim for agent-scan.yml, reproduction.-close.yml and some inci.yml. The runner readme provides more info about the tools and the blog post gives some potential use cases.

persist-credentials: false

Use persist-credentials: false on every actions/checkout in ci.yml (none of the jobs perform subsequent git operations). See usage for more info.

Concurrency

Add concurrency to the PR-triggered workflows so a new push cancels the previous in-flight run of the same workflow. release-nightly.yml uses the cancel-in-progress: false as to not interrupt the release. Instead, it will queue the next release.

Related

• chore: improve actions .github#41
• chore: improve actions #2 .github#42
• ci: improve actions workflows nitrojs/nitro#4388
• ci: use parallel keyword for concurrent workflow steps nuxt#35448
• chore(ci): improve workflows vuejs/core#15037
• chore(github): improve workflows ui#6764

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/image@2288

commit: d330615

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 32.61%. Comparing base (41790ef) to head (d330615).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2288   +/-   ##
=======================================
  Coverage   32.61%   32.61%           
=======================================
  Files           7        7           
  Lines         371      371           
  Branches      131      131           
=======================================
  Hits          121      121           
  Misses        194      194           
  Partials       56       56           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f4856948-3691-4345-8a27-5239a21b1533

📥 Commits

Reviewing files that changed from the base of the PR and between 7d79bc1 and d330615.

📒 Files selected for processing (1)

• .github/workflows/release-nightly.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions workflows now define concurrency behavior for CI and nightly releases. Checkout steps disable persisted credentials, the lint job uses the Node.js 24 release line, and selected jobs run on ubuntu-slim instead of ubuntu-latest.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and matches the workflow-focused changes, though it's broader than the specific runner and concurrency tweaks.
Description check	✅ Passed	The description clearly matches the workflow updates described in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 55-56: Update the actions/checkout step in the changes job to set
persist-credentials to false, matching the hardened checkout configuration used
elsewhere in the workflow.

In @.github/workflows/release-nightly.yml:
- Around line 13-15: Update the workflow’s concurrency configuration to set the
pending-run queue behavior to max, preserving cancel-in-progress: false, so all
nightly release events are retained and processed sequentially in FIFO order.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eb1dd76-1901-44b3-9d51-339741b76c84

📥 Commits

Reviewing files that changed from the base of the PR and between 41790ef and 5c71993.

📒 Files selected for processing (4)

• .github/workflows/agent-scan.yml
• .github/workflows/ci.yml
• .github/workflows/release-nightly.yml
• .github/workflows/reproduction-close.yml