fix: improve CI/CD reliability and security hygiene

.github/actions/setup-restore-build/action.yml

@@ -29,4 +29,4 @@ runs:
 
     - name: Build
       shell: pwsh
-      run: dotnet build --no-restore --configuration Release /p:Deterministic=true /p:UseSharedCompilation=false /p:BuildInParallel=false /nodeReuse:false /bl:./artifacts/logs/release/build.release.binlog
+      run: dotnet build --no-restore --configuration Release /p:Deterministic=true /p:ContinuousIntegrationBuild=true /p:UseSharedCompilation=false /p:BuildInParallel=false /nodeReuse:false /bl:./artifacts/logs/release/build.release.binlog

.github/workflows/devskim.yml

@@ -16,6 +16,7 @@ on:
 jobs:
   lint:
     name: DevSkim
+    # DevSkim requires x64 runner
     runs-on: ubuntu-latest
     permissions:
       actions: read

.github/workflows/linters.yml

@@ -2,13 +2,16 @@ name: Lint
 
 on:
   push:
+    branches: [main]
   pull_request:
 
 permissions: {}
 
 jobs:
   build:
     name: Lint
+    # super-linter requires x86_64; ARM64 is not supported upstream
+    # https://github.com/super-linter/super-linter/issues/5070
     runs-on: ubuntu-latest
 
     permissions:

.github/workflows/main.yml

@@ -175,6 +175,7 @@ jobs:
   # is generated with correct local paths.
   test:
     needs: [check-paths]
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -281,6 +282,7 @@ jobs:
   #   2. msbuild.exe - csc runs on .NET Framework (VS), tested on Windows x64
   analyzer-load-test:
     needs: [check-paths, build]
+    timeout-minutes: 20
     runs-on: ${{ matrix.runs-on }}
     strategy:
       fail-fast: false
@@ -453,6 +455,7 @@ jobs:
   # Builds from source on Linux ARM to get consistent benchmark results.
   perf:
     needs: [check-paths, build, test]
+    timeout-minutes: 60
     runs-on: ubuntu-24.04-arm
 
     env:

.github/workflows/powershell.yml

@@ -36,7 +36,7 @@ jobs:
         with:
           # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
           # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
-          path: .\
+          path: ./
           recurse: true
           # Include your own basic security rules. Removing this option will run all the rules
           includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'

.github/workflows/semantic-pr-check.yml

@@ -7,10 +7,14 @@ on:
       - edited
       - synchronize
 
+permissions: {}
+
 jobs:
   main:
     name: Validate PR title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:

build/targets/compiler/Compiler.props

@@ -1,6 +1,7 @@
 <Project>
   <PropertyGroup>
     <ImplicitUsings>enable</ImplicitUsings>
+    <!-- Use the default C# version for the SDK pinned in global.json -->
     <LangVersion>default</LangVersion>
     <Nullable>enable</Nullable>
   </PropertyGroup>