From 96b453983371dc66c363c20d70c57ad5a1df5a33 Mon Sep 17 00:00:00 2001
From: Bryan English <bryan@bryanenglish.com>
Date: Tue, 3 Nov 2026 13:22:47 -0500
Subject: [PATCH] ci: limit token permissions, add timeouts, and test the
 engines floor

Previously, both workflows ran with the repository's default token
permissions, the CI jobs had no timeouts, and nothing tested the oldest
Node.js version package.json allows. Now both workflows set
permissions: contents: read, which is all any step needs, every CI job
has a 5 minute timeout, and the test job runs on both latest and
26.9.0, the engines floor.

Signed-off-by: Bryan English <bryan@bryanenglish.com>
---
 .github/workflows/benchmark.yml |  3 +++
 .github/workflows/ci.yml        | 13 ++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 2c5b8ad..3a22bb7 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -6,6 +6,9 @@ on:
       - '**'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74a5657..ca13079 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ on:
       - '**'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -16,6 +19,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
@@ -27,16 +31,23 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      fail-fast: false
+      matrix:
+        # 26.9.0 is the oldest version package.json's engines field allows.
+        node-version: [latest, 26.9.0]
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: latest
+          node-version: ${{ matrix.node-version }}
       - run: npm ci
       - run: npm test
 
   prettier:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7