CI: release.yml uses outdated action versions, lacks timeout-minutes on every job, and uses literal cancel-in-progress: true

[konard]

Summary

Three CI/CD anti-patterns in release.yml (and partially docs.yml), all already addressed in the sibling JS/Rust/C# templates and worth pulling forward here.

1. cancel-in-progress: true (literal)

release.yml:26 uses:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

This cancels in-flight runs on every ref, including main. A follow-up push to main while a release is publishing to PyPI / creating a GitHub Release will abort that release mid-flight.

Recommended fix:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

2. No timeout-minutes on any job

release.yml defines 7 jobs (detect-changes, lint, test, build, changelog, auto-release, manual-release at lines 30, 65, 104, 139, 180, 228, 288). None of them declare timeout-minutes, so a hung step gets the workflow default (360 minutes = 6 hours) before the runner reclaims it.

Recommended fix: Add an explicit timeout-minutes: to each job (e.g. 5 for detect-changes, 20 for lint, 30 for test, etc.).

3. Outdated action versions

File	Line(s)	Current	Should be
release.yml	42, 78, 116, 154, 186, 237, 297	actions/checkout@v4	@v6
release.yml	173	actions/upload-artifact@v4	@v7
release.yml	269	actions/download-artifact@v4	@v7
docs.yml	44	actions/checkout@v4	@v6
docs.yml	61	actions/upload-artifact@v4	@v7
docs.yml	69	actions/configure-pages@v5	@v6
docs.yml	73	actions/upload-pages-artifact@v3	@v5
docs.yml	89	actions/deploy-pages@v4	@v5

Where this was discovered

Found while applying template best practices to link-assistant/calculator PR #157 (link-assistant/calculator#157). Reported in sibling templates for consistency:

• link-foundation/js-ai-driven-development-pipeline-template (partially affected — reversed cancel-in-progress + screenshot artifact gap)
• link-foundation/rust-ai-driven-development-pipeline-template (reversed cancel-in-progress)
• link-foundation/csharp-ai-driven-development-pipeline-template (same set of issues as this one)