ci: harden GitHub Actions workflows