ci: improve workflows

[luc122c]

🔗 Linked issue

📚 Description

ubuntu-slim runner

Use it for agent-scan.yml, provenance.yml, and size-comment.yml — the lighter 1-vCPU runner reduces queue times and resource usage. The ci.yml lint job was also switched but moved back to ubuntu-latest since knip/oxc-parser requires more memory.

Concurrency groups

Added to all PR-triggered workflows (autofix.yml, bench.yml, ci.yml, size.yml) so runs for the same PR/branch queue sequentially. cancel-in-progress was intentionally omitted — GitHub's event system can fire duplicate pull_request events for a single push, and cancel-in-progress: true caused those duplicates to cancel the legitimate run after 1 second. Runs now queue instead.

persist-credentials: false

Set on actions/checkout in ci.yml, release.yml, and provenance.yml — none of those jobs perform subsequent git operations. autofix.yml is intentionally excluded since autofix-ci/action pushes lint fixes.

Pre-install corepack

Use npm i -g --force corepack && corepack enable instead of relying on the bundled version, which will be removed in Node 26. The --force flag is needed because the npm global prefix on Windows may already contain a yarn shim.

Remove unnecessary fetch-depth: 0

Drop from jobs that don't need git history (lint, autofix, provenance checks). Kept where needed (release with changelogen, benchmarks with CodSpeed).

parallel keyword

Use for independent steps — setup-bun/setup-deno in the ci matrix job, and the two artifact uploads in size.yml.

Consistent formatting

Add blank lines between all top-level keys and between all steps across every workflow.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflows now coordinate concurrent runs, install Corepack before enabling it, disable checkout credential persistence in selected jobs, and use ubuntu-slim for several jobs. The CI matrix updates Node and Deno versions while retaining Bun setup. The size workflow uploads two artifacts concurrently. Provenance permissions remain unchanged while their declaration is reordered.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and broadly matches the workflow-focused changes in the pull request.
Description check	✅ Passed	The description clearly covers the CI workflow updates, runner changes, concurrency, Corepack, and formatting changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

• nuxt-cli-playground

  npm i https://pkg.pr.new/create-nuxt@1381
  

  npm i https://pkg.pr.new/nuxi@1381
  

  npm i https://pkg.pr.new/@nuxt/cli@1381
  

commit: abd5fb2

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing luc122c:fix/improve-actions (333a19c) with main (2bdae69)}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@2bdae69). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1381   +/-   ##
=======================================
  Coverage        ?   46.41%           
=======================================
  Files           ?       52           
  Lines           ?     1717           
  Branches        ?      499           
=======================================
  Hits            ?      797           
  Misses          ?      738           
  Partials        ?      182           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

22-22: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the Corepack bootstrap version across all workflows.

npm i -g --force corepack installs an unpinned dependency before setup-node selects each job’s Node version. A future Corepack release or runner-image change can therefore alter or break CI bootstrap behavior. Pin a verified Corepack version, or use a pinned package-manager setup action, consistently at every site.

Proposed fix

-      - run: npm i -g --force corepack && corepack enable
+      - run: npm i -g --force corepack@<verified-version> && corepack enable

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 22, Pin the Corepack bootstrap version
consistently at every listed site: .github/workflows/ci.yml lines 22-22, 54-54,
and 105-105; .github/workflows/autofix.yml lines 18-18;
.github/workflows/bench.yml lines 25-25; and .github/workflows/size.yml lines
29-29 and 71-71. Replace the unpinned global Corepack installation with the same
verified pinned version or a pinned package-manager setup action across all
workflows.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 22: Pin the Corepack bootstrap version consistently at every listed site:
.github/workflows/ci.yml lines 22-22, 54-54, and 105-105;
.github/workflows/autofix.yml lines 18-18; .github/workflows/bench.yml lines
25-25; and .github/workflows/size.yml lines 29-29 and 71-71. Replace the
unpinned global Corepack installation with the same verified pinned version or a
pinned package-manager setup action across all workflows.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5e3788d6-a583-4891-a505-cefe1cdaee46

📥 Commits

Reviewing files that changed from the base of the PR and between a8a5de9 and abd5fb2.

📒 Files selected for processing (6)

• .github/workflows/autofix.yml
• .github/workflows/bench.yml
• .github/workflows/ci.yml
• .github/workflows/provenance.yml
• .github/workflows/release.yml
• .github/workflows/size.yml

💤 Files with no reviewable changes (1)

• .github/workflows/provenance.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yml