Add concurrency control and trim per-job overhead

Each run of this workflow fans out to 155 jobs and there was no concurrency
group, so a short series of pushes could queue several hundred jobs against
each other. Group the runs and cancel superseded ones.

Ghostscript ships with the GitHub hosted images, but every job ran
`apt-get update && apt-get install ghostscript` regardless — roughly 25
seconds a job across all 155. Skip it when `gs` is already on PATH and keep
the install as a fallback.

composer.json sets `"lock": false` and every requirement is `dev-main`, so
`composer update` resolves on every run while the cache key stays pinned to
composer.json and never changes on its own. Rotate the key weekly so third
party dependencies cannot be served out of an indefinitely stale cache.

Also give the job a `timeout-minutes` — it had none, so a hung Behat run
could hold a runner for the full six hour default — and stop the checkout
from persisting credentials into the job, matching the reusable workflows in
wp-cli/.github.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jy4dmjymj9VmoTBaqrV4iX

Author: claude

.github/workflows/reusable-testing.yml

@@ -27,6 +27,7 @@ jobs:
     name: WP ${{ inputs.wp }} | PHP ${{ inputs.php }} | ${{ inputs.dbtype == 'sqlite' && 'SQLite' || inputs.dbtype == 'mysql' && 'MySQL' || 'MariaDB' }}${{ inputs.use-phar && ' (Phar)' || '' }}${{ inputs.object_cache == 'sqlite' && ' (Obj Cache)' || '' }}
     runs-on: ubuntu-22.04
     continue-on-error: ${{ inputs.dbtype == 'sqlite' || inputs.object_cache == 'sqlite' }}
+    timeout-minutes: 90
 
     env:
       MYSQL_HOST: 127.0.0.1
@@ -42,14 +43,25 @@ jobs:
     steps:
       - name: Check out source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
 
       - name: Check existence of composer.json & behat.yml files
         id: check_files
         run: echo "files_exists=$([ -f composer.json ] && [ -f behat.yml ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
+      # Ghostscript ships with the GitHub hosted images, so the `apt-get update`
+      # this used to run unconditionally cost every job ~25s for a package that
+      # was already there. Keep the install as a fallback in case a future image
+      # drops it.
       - name: Install Ghostscript
         if: steps.check_files.outputs.files_exists == 'true'
         run: |
+          if command -v gs > /dev/null 2>&1; then
+            echo "Ghostscript $(gs --version) is already installed; skipping."
+            exit 0
+          fi
           sudo apt-get update
           sudo apt-get install ghostscript -y
 
@@ -62,9 +74,19 @@ jobs:
           coverage: none
           tools: composer
 
+      # composer.json sets `"lock": false` and every requirement is `dev-main`, so
+      # `composer update` resolves on every run while the cache key stays pinned to
+      # composer.json and never changes on its own. Rotate it weekly so third party
+      # dependencies cannot be served out of an indefinitely stale cache.
+      - name: Determine the weekly Composer cache suffix
+        id: composer-cache-suffix
+        run: echo "value=$(date -u +%Y-%W)" >> "$GITHUB_OUTPUT"
+
       - name: Install Composer dependencies & cache dependencies
         if: steps.check_files.outputs.files_exists == 'true'
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4
+        with:
+          custom-cache-suffix: ${{ steps.composer-cache-suffix.outputs.value }}
         env:
           COMPOSER_ROOT_VERSION: dev-${{ github.event.repository.default_branch }}
 

.github/workflows/testing.yml

@@ -10,6 +10,14 @@ on:
   schedule:
     - cron:  '0 0 * * *' # Run every day at midnight.
 
+# Each run fans out to 155 jobs, so overlapping runs are expensive.
+# Pull requests group per branch so a new push supersedes the previous run.
+# Everything else groups per event and commit, so a push to the default branch
+# and the nightly schedule never cancel one another.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: true
+
 jobs:
 
   functional: