CI/CD: parallel quality jobs and Cloud Run deploy workflow (#3)

* ci: parallelize CI and add Cloud Run CD workflow

* ci: harden matrix task handling and CD secret checks

.github/workflows/ci.yml

@@ -8,11 +8,27 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   quality:
-    name: Quality Gates
+    name: Quality / ${{ matrix.task }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        task:
+          - format
+          - lint
+          - typecheck
+          - test
+          - build
 
     steps:
       - name: Checkout
@@ -23,20 +39,39 @@ jobs:
         with:
           bun-version: 1.3.10
 
+      - name: Restore Bun cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Check formatting
-        run: bun run format:check
-
-      - name: Lint
-        run: bun run lint
-
-      - name: Typecheck
-        run: bun run typecheck
-
-      - name: Test
-        run: bun run test
-
-      - name: Build
-        run: bun run build
+      - name: Run quality gate
+        run: |
+          case "${{ matrix.task }}" in
+            format)
+              bun run format:check
+              ;;
+            lint)
+              bun run lint
+              ;;
+            typecheck)
+              bun run typecheck
+              ;;
+            test)
+              bun run test
+              ;;
+            build)
+              bun run build
+              ;;
+            *)
+              echo "Unknown task: ${{ matrix.task }}"
+              exit 1
+              ;;
+          esac