[Jertlok]

What and why

change	practice it follows
concurrency: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}, cancel-in-progress only for pull requests	Home Assistant core and astral-sh/uv use the same group. The old group (ci-<ref>, always cancelling) let a second push to main cancel the first push's run: tap run 35024225791 shows it happening.
timeout-minutes on every job	GitHub's default is 360 minutes; rust-lang/rust and Home Assistant set explicit timeouts. Sized a few times the measured job duration.
merge_group trigger (CI and Build; a merge group builds what its pull requests change)	Required for a merge queue (GitHub docs).
Commit check from porthole-dev/.github/actions/commit-check, pinned by commit	One copy instead of six byte-identical ones. It fetches the whole commit history with --filter=tree:0, so a base older than the former fetch-depth: 100 fails loudly instead of reporting "no new commits". Check name stays Commit check.
base-commit.sh fails when the base it should print is outside the fetch-depth: 100 checkout	It printed nothing, and lint and the patch check then checked no aport and passed. New test-base-commit.sh runs in the lint job (and fails against the old script).
patch check: actions/cache/restore always, actions/cache/save only on push	A pull request's cache is readable only by that pull request; saving one per pull request run evicts the useful ones from the 10 GB repository limit. The Build job's caches are left as they are (the build speed work owns them).
Workflow lint job: actionlint + zizmor	uv runs zizmor on every pull request (check-zizmor.yml); both tools are what the OpenSSF Scorecard and GitHub's security hardening guide checks are about (pinning, token permissions, injection).
CI passed (CI) and Build passed (Build) aggregate jobs; the matrix jobs are named Build (<package>), so nothing else is requirable	uv's "all required jobs passed": one required check, so adding or renaming a job never needs a ruleset change, and a failed or cancelled job cannot be skipped past.
.github/dependabot.yml: GitHub Actions weekly, grouped, 7-day cooldown	Scorecard "Pinned-Dependencies" expects SHA pins to be kept current; the cooldown is zizmor's dependabot-cooldown recommendation. Dependabot commits need the maintainer's sign-off before merge like any other.
persist-credentials: false, least-privilege permissions	zizmor artipacked / excessive-permissions.

Stacked on #9

The first commit is #9's (the publish fix); review the last commit here, and merge #9 first.

Depends on

1. ci: add shared commit check, workflow lint and app release .github#2 merged.
2. While porthole-dev/.github is private: its Settings > Actions > General > Access set to "Accessible from repositories in the porthole-dev organization". Until then Commit check, Workflow lint and CI passed fail with "Unable to resolve action porthole-dev/.github, repository not found".
3. The pins (@43919fe... # main) moved to the merged commit and its tag (# v1.0.0); zizmor's ref-version-mismatch warns until the comment names a tag.

Merge note

The Commit check fails until the commit carries the maintainer's Signed-off-by (git rebase --signoff taimen-bringup).