ci: update workflows

.github/workflows/ci.yml

@@ -10,8 +10,28 @@ on:
         - 'docs/**'
         - '*.md'
 
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: "${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
 jobs:
-  build:
+  dependency-review:
+    name: Dependency Review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v1
+
+  test:
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
@@ -20,21 +40,28 @@ jobs:
         node-version: [12, 14, 16]
         os: [macos-latest, ubuntu-latest, windows-latest]
     steps:
-      - name: Checkout
+      - name: Check out repo
         uses: actions/checkout@v3
-      - name: Use Node.js
+        with:
+          persist-credentials: false
+
+      - name: Setup Node ${{ matrix.node-version }}
         uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
+
       - name: Restore cached dependencies
         uses: actions/cache@v3
         with:
           path: node_modules
           key: node-modules-${{ hashFiles('package.json') }}
+
       - name: Install dependencies
-        run: npm install
+        run: npm i --ignore-scripts
+
       - name: Run Tests
         run: npm run test-ci
+
       - name: Coveralls Parallel
         uses: coverallsapp/github-action@1.1.3
         with:
@@ -43,7 +70,7 @@ jobs:
           flag-name: run-${{ matrix.node-version }}-${{ matrix.os }}
 
   coverage:
-    needs: build
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - name: Coveralls Finished
@@ -53,11 +80,15 @@ jobs:
           parallel-finished: true
 
   automerge:
-    needs: build
-    runs-on: ubuntu-latest
+    name: Automerge Dependabot PRs
+    if: >
+        github.event_name == 'pull_request' &&
+        github.event.pull_request.user.login == 'dependabot[bot]'
+    needs: test
     permissions:
       pull-requests: write
       contents: write
+    runs-on: ubuntu-latest
     steps:
       - uses: fastify/github-action-merge-dependabot@v3
         with: