From 8d8eca653a07c8c6ce990861c75aee74343bc692 Mon Sep 17 00:00:00 2001
From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:57:48 -0400
Subject: [PATCH 1/4] chore: bump umm-actually to v0.4.5

---
 .github/workflows/umm_review.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/umm_review.yml b/.github/workflows/umm_review.yml
index 67bef91..e092536 100644
--- a/.github/workflows/umm_review.yml
+++ b/.github/workflows/umm_review.yml
@@ -89,7 +89,7 @@ jobs:
       # to the action's defaults. Inputs whose default is empty
       # (fallback_model, max_findings) pass empty when the var is unset —
       # identical to omitting them.
-      - uses: aliasunder/umm-actually@a2b6b24cf1e7d7b6f9892b092e240780c7a2118e # v0.4.4
+      - uses: aliasunder/umm-actually@d3d9d89743d627e41a07586e97ceace216c7a721 # v0.4.5
         with:
           github_token: ${{ steps.app-token.outputs.token }}
           openrouter_api_key: ${{ secrets.OPENROUTER_KEY }}
@@ -100,8 +100,11 @@ jobs:
           # output. Empty = no fallback
           fallback_model: ${{ vars.UMM_FALLBACK_MODEL }}
           # Per-attempt cap on a single model request; a timed-out attempt
-          # aborts and advances the retry/fallback ladder. Empty = 600
+          # aborts and advances the retry/fallback ladder. Empty = 900
           request_timeout_seconds: ${{ vars.UMM_REQUEST_TIMEOUT_SECONDS }}
+          # Shared cap across review work. Empty = 1500, leaving time to
+          # publish completed findings before the 30-minute job timeout
+          review_timeout_seconds: ${{ vars.UMM_REVIEW_TIMEOUT_SECONDS }}
           # Positive integer cap on posted findings (highest severity
           # first). Empty = uncapped
           max_findings: ${{ vars.UMM_MAX_FINDINGS }}

From 3b12700855acdfc129547f7d88d76efefb9db9c5 Mon Sep 17 00:00:00 2001
From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com>
Date: Wed, 16 Sep 2026 22:06:15 -0400
Subject: [PATCH 2/4] docs(ci): clarify review timeout ceiling

---
 .github/workflows/umm_review.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/umm_review.yml b/.github/workflows/umm_review.yml
index e092536..8b38129 100644
--- a/.github/workflows/umm_review.yml
+++ b/.github/workflows/umm_review.yml
@@ -102,8 +102,8 @@ jobs:
           # Per-attempt cap on a single model request; a timed-out attempt
           # aborts and advances the retry/fallback ladder. Empty = 900
           request_timeout_seconds: ${{ vars.UMM_REQUEST_TIMEOUT_SECONDS }}
-          # Shared cap across review work. Empty = 1500, leaving time to
-          # publish completed findings before the 30-minute job timeout
+          # Shared cap across review work. Empty = 1500; keep below 1800
+          # to leave time to publish before the 30-minute job timeout.
           review_timeout_seconds: ${{ vars.UMM_REVIEW_TIMEOUT_SECONDS }}
           # Positive integer cap on posted findings (highest severity
           # first). Empty = uncapped

From e1dc5bd5d9231a49af180ddcfc8e6936ad900bd5 Mon Sep 17 00:00:00 2001
From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com>
Date: Wed, 16 Sep 2026 22:17:23 -0400
Subject: [PATCH 3/4] docs(ci): clarify workflow defaults

---
 .github/workflows/umm_review.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/umm_review.yml b/.github/workflows/umm_review.yml
index 8b38129..d253042 100644
--- a/.github/workflows/umm_review.yml
+++ b/.github/workflows/umm_review.yml
@@ -85,10 +85,10 @@ jobs:
           permission-checks: write
 
       # Every optional input is overridable via a repo variable (Settings →
-      # Secrets and variables → Actions → Variables); unset vars fall back
-      # to the action's defaults. Inputs whose default is empty
-      # (fallback_model, max_findings) pass empty when the var is unset —
-      # identical to omitting them.
+      # Secrets and variables → Actions → Variables). Unset vars use the action
+      # default unless the expression below supplies an explicit workflow default.
+      # Inputs whose default is empty (fallback_model, max_findings) pass empty
+      # when the var is unset — identical to omitting them.
       - uses: aliasunder/umm-actually@d3d9d89743d627e41a07586e97ceace216c7a721 # v0.4.5
         with:
           github_token: ${{ steps.app-token.outputs.token }}

From 9dc6fbc79c123d2d790ebb661eb953d72920ca0a Mon Sep 17 00:00:00 2001
From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com>
Date: Wed, 16 Sep 2026 22:35:37 -0400
Subject: [PATCH 4/4] docs(ci): tighten review timeout guidance

---
 .github/workflows/umm_review.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/umm_review.yml b/.github/workflows/umm_review.yml
index d253042..d914bbf 100644
--- a/.github/workflows/umm_review.yml
+++ b/.github/workflows/umm_review.yml
@@ -102,8 +102,8 @@ jobs:
           # Per-attempt cap on a single model request; a timed-out attempt
           # aborts and advances the retry/fallback ladder. Empty = 900
           request_timeout_seconds: ${{ vars.UMM_REQUEST_TIMEOUT_SECONDS }}
-          # Shared cap across review work. Empty = 1500; keep below 1800
-          # to leave time to publish before the 30-minute job timeout.
+          # Shared cap across review work. Empty = 1500. Use 1500 or less
+          # to leave publication headroom before the 30-minute job timeout.
           review_timeout_seconds: ${{ vars.UMM_REVIEW_TIMEOUT_SECONDS }}
           # Positive integer cap on posted findings (highest severity
           # first). Empty = uncapped