@@ -21,15 +21,19 @@ Reusable workflows for all Aam-Digital repositories, so that each repository kee
   This way a push to this repository (e.g. an edit of the org profile README) does not change CI everywhere.
 - **Permissions:** a called workflow cannot get more permissions than the calling job has.
   The calling job (or the caller workflow's top-level `permissions`) must grant at least what is listed for each
-  workflow below, otherwise the run fails before it starts.
+  workflow below, otherwise the run fails before it starts. Callers should set `permissions: {}` at the top level of
+  the workflow and grant the permissions per job (as in all examples below); without a top-level `permissions`,
+  checkov (`CKV2_GHA_1`, blocking in `qlty check`) flags the workflow. Jobs of the caller that are not shown in an
+  example (tests, ...) need their own `permissions`, e.g. `contents: read`.
 - **Secrets and `env`** of the caller are not passed through. Everything a workflow needs is an input or an explicitly
   passed secret.
 - **Check names:** GitHub names the check of a job in a called workflow `<caller job> / <called job>`, where each part is
   the job's `name` if it has one, else its id. The called job ids/names listed above are part of the `v1` contract.
   If you move an existing job into one of these workflows, either keep the caller job's name so that the check name is
   what the repository's ruleset expects, or update the required status checks in the same PR. Otherwise PRs wait
-  forever for a check that never reports. Jobs of the mode that is not used (e.g. `merge` without `native-runners`)
-  report as skipped; a skipped required check counts as passed.
+  forever for a check that never reports. Jobs of the mode that is not used (e.g. `merge` and `build-native` without
+  `native-runners`) report as skipped (`<caller job> / build-native`, without the platform); a skipped required check
+  counts as passed.
 
 ## Release model
 
@@ -124,6 +128,8 @@ needed). `pr-image-cleanup.yml` never deletes an image that carries another tag.
 on:
   pull_request:
 
+permissions: {} # each job grants what it needs
+
 jobs:
   build:
     uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1
@@ -144,6 +150,8 @@ on:
   release:
     types: [published] # the release must be created with a PAT, GITHUB_TOKEN releases trigger no workflows
 
+permissions: {} # each job grants what it needs
+
 jobs:
   build:
     uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1
@@ -170,6 +178,8 @@ jobs:
 ### Example: several registries, artifact from an earlier job
 
 ```yaml
+permissions: {} # each job grants what it needs
+
 jobs:
   build-webapp:
     # ... uploads the artifact "webapp-files"
@@ -201,8 +211,10 @@ Creates the next release or prerelease with semantic-release
 ([`cycjimmy/semantic-release-action`](https://github.com/cycjimmy/semantic-release-action)). Only the semantic-release
 `branches` setting comes from this workflow (the caller's default branch); the plugins and everything else stay in the
 repository's own configuration (`.releaserc*`, `release.config.*` or `release` in package.json), including `tagFormat`
-(which must end with the version). Releases are only created from the default branch; on any other ref the job does
-nothing (`published: false`).
+(which must end with the version). Releases are only created from the default branch: on any other ref the job is
+**skipped** by the workflow itself (no gate needed in the caller; the outputs are empty then). Skipping, rather than
+a no-op run, matters: GitHub keeps only one *pending* run per concurrency group, so a no-op run of a push to another
+branch could otherwise replace a release that is waiting. The concurrency group is per repository, ref and type.
 
 - `type: release`: a full release of the default branch (`branches: [{name: <default>, prerelease: false}]`).
   With `cleanup-prereleases` (default), the GitHub prereleases and git tags matching `*-<prerelease-id>.*` or
@@ -234,7 +246,7 @@ write access). Releases of one repository and type are serialised (concurrency g
 | `token`         | (required) PAT for tags, releases (and comments). Not the `GITHUB_TOKEN`. |
 | `slack-webhook` | Optional, available to plugins as `SLACK_WEBHOOK` (e.g. `semantic-release-slack-bot`) |
 
-Outputs: `version` (the released version, empty if none), `published` (`true`/`false`).
+Outputs: `version` (the released version, empty if none), `published` (`true`/`false`; empty if the job was skipped on a non-default branch).
 
 ### Example: manual release mode
 
@@ -244,6 +256,8 @@ on:
   push:
     branches: [main]
 
+permissions: {} # each job grants what it needs
+
 jobs:
   # ... tests
   prerelease:
@@ -262,6 +276,8 @@ jobs:
 on:
   workflow_dispatch:
 
+permissions: {} # each job grants what it needs
+
 jobs:
   release:
     uses: Aam-Digital/.github/.github/workflows/release.yml@v1
@@ -283,6 +299,8 @@ on:
   push:
     branches: [main]
 
+permissions: {} # each job grants what it needs
+
 jobs:
   # ... tests
   release:
@@ -350,6 +368,8 @@ on:
   pull_request:
     types: [closed]
 
+permissions: {} # each job grants what it needs
+
 jobs:
   cleanup-image:
     # PRs from forks have no image (and their token cannot delete packages)
@@ -383,6 +403,8 @@ on:
   pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out PR code, only reads the PR title from the event payload
     types: [opened, edited, synchronize, reopened]
 
+permissions: {} # each job grants what it needs
+
 jobs:
   pr-title:
     uses: Aam-Digital/.github/.github/workflows/pr-title-lint.yml@v1
@@ -404,6 +426,8 @@ on:
   push:
     branches: [main]
 
+permissions: {} # each job grants what it needs
+
 jobs:
   actionlint:
     uses: Aam-Digital/.github/.github/workflows/actionlint.yml@v1
 
@@ -535,7 +535,9 @@ jobs:
   # pushes its image by digest only. Do not rename within v1.
   build-native:
     if: inputs.native-runners
-    name: build-native (${{ matrix.platform }})
+    # No `name` with a matrix expression: GitHub appends the matrix value itself (`build-native (linux/amd64)`),
+    # while the jobs skipped without native-runners would show the unexpanded expression.
+    name: build-native
     strategy:
       fail-fast: false
       matrix:
 
@@ -61,19 +61,24 @@ on:
         description: The version that was released (empty if none)
         value: ${{ jobs.release.outputs.version }}
       published:
-        description: "`true` if a release or prerelease was created, else `false`"
+        description: "`true` if a release or prerelease was created, `false` if there was nothing to release (empty if the job was skipped because the ref is not the default branch)"
         value: ${{ jobs.release.outputs.published }}
 
 jobs:
   # The job id is part of the check name (`<caller job> / release`). Do not rename it within v1.
   release:
+    # Only the default branch is released. Skipping the job on any other ref (instead of a no-op run inside it)
+    # also keeps it out of the concurrency group below: GitHub keeps just one *pending* run per group, so a no-op run
+    # of a push to another branch would otherwise replace a release that is waiting for the default branch.
+    # (`published` is empty, not `false`, when the job is skipped.)
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     runs-on: ubuntu-latest
     permissions:
       contents: read # everything that writes uses the `token` secret
     # Releases of one repository must not run in parallel (they would compute the same version).
-    # Separate groups per type, so that a prerelease of a later push never replaces a pending manual release.
+    # Separate groups per type and ref, so that a prerelease of a later push never replaces a pending manual release.
     concurrency:
-      group: semantic-release-${{ github.repository }}-${{ inputs.type }}
+      group: semantic-release-${{ github.repository }}-${{ github.ref }}-${{ inputs.type }}
       cancel-in-progress: false
     outputs:
       version: ${{ steps.result.outputs.version }}
 
@@ -5,7 +5,7 @@ Shared configuration for the repositories of the Aam-Digital organisation.
 
 | Folder / file | What |
 | --- | --- |
-| [`.github/workflows/`](.github/workflows) | Reusable GitHub Actions workflows (container images, releases, image cleanup, PR title and workflow linting). See its [README](.github/workflows/README.md) for inputs, permissions, check names, the release model and how the `v1` tag is moved. |
+| [`.github/workflows/`](.github/workflows) | Reusable GitHub Actions workflows (container images, releases, image cleanup, PR title and workflow linting). See its [README](.github/workflows/README.md) for inputs, permissions, check names, the release model and how the `v1` tag is moved. Callers set top-level `permissions: {}` and grant permissions per job. |
 | [`renovate/`](renovate) | Shared Renovate presets (below) |
 | [`.github/ISSUE_TEMPLATE/`](.github/ISSUE_TEMPLATE), [`SECURITY.md`](SECURITY.md), [`CONTRIBUTING.md`](CONTRIBUTING.md) | Organisation-wide defaults (below) |