feat(workflows): add runner input, timeouts and release concurrency

The release, release-cgo and autoupdate workflows must run on a runner
the caller chooses. Each workflow now takes a runner input. It accepts
a label or a JSON object that selects a runner group.

The workflow uses inputs.runner first. It then uses the
SHARED_ACTIONS_RUNNER variable and falls back to ubuntu-latest. Callers
that set nothing keep the old behaviour.

Every job now has a timeout. Release and autoupdate runs use a
concurrency group that never cancels a running job.

.github/workflows/go-autoupdate.yaml

@@ -19,11 +19,22 @@ on:
         type: boolean
         default: false
 
+      runner:
+        description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
+        required: false
+        type: string
+        default: ""
+
+concurrency:
+  group: autoupdate-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   autoupdate:
     name: Update dependencies and test
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
 
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/go-release-cgo.yaml

@@ -60,6 +60,11 @@ on:
                 required: false
                 type: boolean
                 default: false
+            runner:
+                description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
+                required: false
+                type: string
+                default: ""
         outputs:
             version:
                 description: "The calculated version (without v prefix)"
@@ -68,10 +73,15 @@ on:
                 description: "The version tag (with v prefix)"
                 value: ${{ jobs.version.outputs.version_tag }}
 
+concurrency:
+    group: release-cgo-${{ github.repository }}-${{ github.ref }}
+    cancel-in-progress: false
+
 jobs:
     test:
         name: Test
-        runs-on: ubuntu-latest
+        runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
+        timeout-minutes: 30
         steps:
             - name: Checkout
               uses: actions/checkout@v6
@@ -96,7 +106,8 @@ jobs:
     frontend:
         name: Build Frontend
         if: inputs.node-enabled && inputs.node-build-script != ''
-        runs-on: ubuntu-latest
+        runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
+        timeout-minutes: 20
         steps:
             - name: Checkout
               uses: actions/checkout@v6
@@ -132,10 +143,11 @@ jobs:
     version:
         name: Calculate Version
         needs: test
-        runs-on: ubuntu-latest
+        runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
         outputs:
             version: ${{ steps.semver.outputs.version }}
             version_tag: ${{ steps.semver.outputs.version_tag }}
+        timeout-minutes: 10
         steps:
             - name: Checkout
               uses: actions/checkout@v6
@@ -170,6 +182,7 @@ jobs:
             matrix:
                 include: ${{ fromJson(inputs.platforms) }}
         runs-on: ${{ matrix.os }}
+        timeout-minutes: 60
         steps:
             - name: Checkout
               uses: actions/checkout@v6
@@ -242,11 +255,12 @@ jobs:
             always() &&
             needs.version.result == 'success' &&
             needs.build.result == 'success'
-        runs-on: ubuntu-latest
+        runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
         permissions:
             contents: write
             packages: write
             id-token: write
+        timeout-minutes: 60
         steps:
             - name: Checkout
               uses: actions/checkout@v6

.github/workflows/go-release.yaml

@@ -34,10 +34,10 @@ on:
         type: boolean
         default: false
       runner:
-        description: "Runner label(s) for the release jobs. Defaults to ubuntu-latest; set to a self-hosted label (e.g. self-hosted) to run on your own runner."
+        description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
         required: false
         type: string
-        default: "ubuntu-latest"
+        default: ""
     outputs:
       version:
         description: "The calculated version (without v prefix)"
@@ -46,10 +46,15 @@ on:
         description: "The version tag (with v prefix)"
         value: ${{ jobs.version.outputs.version_tag }}
 
+concurrency:
+  group: release-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   test:
     name: Test
-    runs-on: ${{ inputs.runner }}
+    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -72,10 +77,11 @@ jobs:
   version:
     name: Calculate Version
     needs: test
-    runs-on: ${{ inputs.runner }}
+    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
     outputs:
       version: ${{ steps.semver.outputs.version }}
       version_tag: ${{ steps.semver.outputs.version_tag }}
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -101,11 +107,12 @@ jobs:
     name: Release
     needs: version
     if: needs.version.outputs.version_tag != ''
-    runs-on: ${{ inputs.runner }}
+    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest' || toJSON(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
     permissions:
       contents: write
       packages: write
       id-token: write
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v6