diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11706b9..cb9f2bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,10 +6,18 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test (${{ matrix.os }} - Python ${{ matrix.python-version }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -41,6 +49,7 @@ jobs:
   lint:
     name: Lint & Style Check
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b099d32..404ce81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - "v*.*.*"
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
@@ -12,6 +16,7 @@ jobs:
   build-and-release:
     name: Build & Create Release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -21,16 +26,31 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.11"
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip build twine
+          pip install -e ".[dev]"
+
+      - name: Verify package version matches git tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          python -c "import os, prepare_commit_msg_hooks; expected = os.environ['GITHUB_REF_NAME'].lstrip('v'); actual = prepare_commit_msg_hooks.__version__; assert actual == expected, f'__version__ {actual} != tag {expected}'"
 
-      - name: Install dependencies & build package
+      - name: Run quality gates, tests, build & twine check
         run: |
-          python -m pip install --upgrade pip build pytest
+          ruff check .
+          ruff format --check .
+          mypy --strict prepare_commit_msg_hooks
           pytest tests/ -v
           python -m build
+          twine check dist/*
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
-          files: dist/*
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
           generate_release_notes: true
diff --git a/prepare_commit_msg_hooks/__init__.py b/prepare_commit_msg_hooks/__init__.py
index 201a062..38eb04f 100644
--- a/prepare_commit_msg_hooks/__init__.py
+++ b/prepare_commit_msg_hooks/__init__.py
@@ -1,5 +1,5 @@
 """AI Commit message generator for pre-commit."""
 
-__version__ = "1.0.3"
+__version__ = "1.0.4"
 
 __all__ = ["__version__"]