ci: optimize GitHub Actions workflows (#30)

* ci: optimize GitHub Actions workflows

- Add path filters to CI to reduce unnecessary runs
- Add concurrency groups across all workflows
- Add job timeouts
- Pin govulncheck version
- Remove redundant go mod download

Co-authored-by: Copilot <[email protected]>

* fix: use govulncheck@latest for Go 1.26 compatibility

The pinned v1.1.3 version has x/tools incompatibility with Go 1.26.
Using @latest ensures govulncheck stays compatible with the Go version.

Co-authored-by: Copilot <[email protected]>

* fix: bump Go version to 1.26.1 for security patches

Go 1.26.0 has known stdlib vulnerabilities (GO-2026-4599,
GO-2026-4600, GO-2026-4601, GO-2026-4602) fixed in Go 1.26.1.
This was causing govulncheck failures in CI.

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

Author: jongio

.github/workflows/ci.yml

@@ -3,20 +3,27 @@ name: CI
 on:
   push:
     branches: [main]
+    paths: ['**.go', 'go.mod', 'go.sum', '.github/workflows/ci.yml']
   pull_request:
     branches: [main]
+    paths: ['**.go', 'go.mod', 'go.sum', '.github/workflows/ci.yml']
   workflow_dispatch:
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   test:
     name: Test
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
       matrix:
-        go-version: ['1.26.0']
+        go-version: ['1.26.1']
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
@@ -29,9 +36,6 @@ jobs:
           go-version: ${{ matrix.go-version }}
           cache: true
 
-      - name: Download dependencies
-        run: go mod download
-
       - name: Run go vet
         run: go vet ./...
 

.github/workflows/codeql.yml

@@ -13,10 +13,15 @@ permissions:
   security-events: write
   actions: read
 
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       contents: read
       security-events: write
@@ -29,7 +34,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.0'
+          go-version: '1.26.1'
           cache: true
 
       - name: Initialize CodeQL

.github/workflows/govulncheck.yml

@@ -11,10 +11,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: govulncheck-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   govulncheck:
     name: Run govulncheck
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout code
@@ -23,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.0'
+          go-version: '1.26.1'
           cache: true
 
       - name: Install govulncheck

.github/workflows/release.yml

@@ -33,13 +33,18 @@ permissions:
   issues: read
   pull-requests: write
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 env:
-  GO_VERSION: '1.26.0'
+  GO_VERSION: '1.26.1'
 
 jobs:
   test:
     name: Run Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -53,9 +58,6 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Download dependencies
-        run: go mod download
-
       - name: Verify dependencies
         run: go mod verify
 
@@ -71,6 +73,7 @@ jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: test
     steps:
       - name: Checkout code