Merge pull request 'ci: apply standard v1 (concurrency + permissions + cache policy)' (#23) from ci/standardize-v1 into main

.github/workflows/build.yml

@@ -18,9 +18,12 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}
 
 # Organisation-wide Stratum settings (registry, group, runner routes) are organisation variables.
 env:
@@ -49,6 +52,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb
         with:
           cache-provider: basic
+        cache-disabled: "${{ github.server_url != 'https://github.com' }}"
 
       - name: Build
         env:
@@ -83,6 +87,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb
         with:
           cache-provider: basic
+        cache-disabled: "${{ github.server_url != 'https://github.com' }}"
 
       - name: Check the publish credentials
         run: |