feat: Shorten workflow job names, add required checks, optimize runners, and restrict permissions

.github/workflows/CI.yml

@@ -19,8 +19,10 @@ concurrency:
 
 jobs:
   gaptest:
-    name: Code quality - unit-tests (${{ matrix.gap-branch }})
-    runs-on: ubuntu-latest
+    name: Code - units (${{ matrix.gap-branch }})
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -65,8 +67,10 @@ jobs:
         uses: gap-actions/process-coverage@v3
 
   gaplint:
-    name: Code quality - gaplint
-    runs-on: ubuntu-22.04
+    name: Code - lint
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -92,3 +96,31 @@ jobs:
           find . -name '*.gd' | xargs -n1 gaplint
           echo "::group:: gaplint -- *.tst"
           find . -name '*.tst' | xargs -n1 gaplint
+
+  required:
+    name: Required checks - pull-request
+    runs-on: ubuntu-slim
+    permissions: {}
+    needs:
+      - gaptest
+      - gaplint
+
+    steps:
+      - id: status
+        name: Determine status
+        run: |
+          results=$(tr -d '\n' <<< '${{ toJSON(needs.*.result) }}')
+          if ! grep -q -v -E '(failure|cancelled)' <<< "$results"; then
+            result="failed"
+          else
+            result="success"
+          fi
+          {
+            echo "result=${result}"
+            echo "results=${results}"
+          } | tee -a "$GITHUB_OUTPUT"
+      - if: always() && steps.status.outputs.result != 'success'
+        name: Check for failed status
+        run: |
+          echo "One or more required build workflows failed: ${{ steps.status.outputs.results }}"
+          exit 1

.github/workflows/labels.yml

@@ -16,8 +16,8 @@ permissions:
 
 jobs:
   label-auto:
-    name: Labels - auto-create
-    runs-on: ubuntu-latest
+    name: Labels - auto
+    runs-on: ubuntu-slim
     steps:
       - uses: TimonVS/pr-labeler-action@v5
         with:
@@ -27,7 +27,7 @@ jobs:
   label-test:
     name: Labels - test
     needs: label-auto
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - uses: mheap/github-action-required-labels@v5
         with:

.github/workflows/release-bump.yml

@@ -15,7 +15,7 @@ env:
 
 jobs:
   assets-build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-slim
     permissions:
       contents: write
     steps:
@@ -65,7 +65,7 @@ jobs:
 
 
   update-website:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-slim
     needs: assets-build
     permissions:
       contents: write

.github/workflows/release-draft.yml

@@ -16,11 +16,11 @@ permissions:
 
 jobs:
   update_release_draft:
-    name: Release draft - update release notes
+    name: Release - draft
     permissions:
       contents: write
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - uses: release-drafter/release-drafter@v6
         env:

.github/workflows/release.yml

@@ -18,8 +18,8 @@ permissions: write-all
 
 jobs:
   release:
-    name: "Release the GAP package"
-    runs-on: ubuntu-latest
+    name: Release
+    runs-on: ubuntu-slim
 
     steps:
       - uses: actions/checkout@v6