ci: fix every finding of jactionlint with the pedantic profile

- pull_request_target and workflow_run stay, these workflows run no code of the pull request

.github/jactionlint.yaml

@@ -0,0 +1 @@
+profile: pedantic

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -4,14 +4,21 @@ on:
   schedule:
     - cron: '0 1 * * *'
 
-permissions:
-  issues: write
-  discussions: write
-  pull-requests: write
+permissions: {}
+
+concurrency:
+  group: lock-threads
+  cancel-in-progress: false
 
 jobs:
   lock-threads:
-    runs-on: ubuntu-latest
+    name: Lock inactive threads
+    permissions:
+      issues: write # lock the inactive issues
+      discussions: write # lock the inactive discussions
+      pull-requests: write # lock the inactive pull requests
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
     steps:
       - name: Lock threads after 30 days of inactivity
         uses: dessant/lock-threads@v6.0.2

.github/workflows/chore-manage-pr-branch.yaml

@@ -4,14 +4,14 @@ name: Manage PR Branch
 # PR Quality may close a PR that fails its checks, so we must wait for it to
 # complete before deciding whether to retarget the PR's base branch.
 on:
+  # Only reads the PR Quality run and the pull request through the API, it checks out and runs no code of the pull request
+  # jactionlint ignore=dangerous-triggers
   workflow_run:
     workflows: ["PR Quality"]
     types:
       - completed
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 concurrency:
   group: manage-pr-branch-${{ github.event.workflow_run.head_sha }}
@@ -19,7 +19,12 @@ concurrency:
 
 jobs:
   manage-branch:
-    runs-on: ubuntu-latest
+    name: Retarget the pull request
+    permissions:
+      contents: read # read the branches of the repository
+      pull-requests: write # change the base branch of the pull request and comment on it
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
     steps:
       - name: Retarget PR base branch based on category
         uses: actions/github-script@v9.0.0

.github/workflows/chore-manage-stale-issues-and-prs.yml

@@ -4,13 +4,20 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
+
+concurrency:
+  group: manage-stale
+  cancel-in-progress: false
 
 jobs:
   manage-stale:
-    runs-on: ubuntu-latest
+    name: Manage stale issues and PRs
+    permissions:
+      issues: write # label, comment on and close the stale issues
+      pull-requests: write # label, comment on and close the stale pull requests
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
     steps:
       - name: Manage stale issues and PRs
         uses: actions/stale@v11.0.0

.github/workflows/chore-pr-comments.yml

@@ -1,15 +1,29 @@
 name: Add comment based on label
+
 on:
+  # Comments on pull requests from forks too, it checks out and runs no code of the pull request
+  # jactionlint ignore=dangerous-triggers
   pull_request_target:
     types:
       - labeled
 
-permissions:
-  pull-requests: write
+permissions: {}
+
+concurrency:
+  group: pr-comments-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
 
 jobs:
   add-comment:
-    runs-on: ubuntu-latest
+    name: Ask for the docs of ${{ matrix.label }}
+    permissions:
+      pull-requests: write # comment on the pull request
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
     strategy:
       matrix:
         include:
@@ -41,9 +55,9 @@ jobs:
     steps:
       - name: Add comment
         if: >-
-          (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR')
+          ${{ (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR')
           && contains(github.event.pull_request.labels.*.name, matrix.label)
-          && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR')
+          && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR') }}
         run: gh pr comment "$NUMBER" --body "$BODY"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-quality.yaml

@@ -1,17 +1,26 @@
 name: PR Quality
 
-permissions:
-  contents: read
-  issues: read
-  pull-requests: write
-
 on:
+  # Checks pull requests from forks too, it checks out and runs no code of the pull request
+  # jactionlint ignore=dangerous-triggers
   pull_request_target:
     types: [opened, reopened]
 
+permissions: {}
+
+concurrency:
+  group: pr-quality-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
 jobs:
   pr-quality:
-    runs-on: ubuntu-latest
+    name: Check the pull request
+    permissions:
+      contents: read # read the commits and files of the pull request
+      issues: read # read the linked issues
+      pull-requests: write # comment on, label and close the pull request
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
     steps:
       - uses: peakoss/anti-slop@v0.3.0
         with: