From 2caf3323562c345c4ca2d1b668c0a41fe9312bb5 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 20 Jun 2026 18:00:33 +0000 Subject: [PATCH] ci(workflows): add job-level timeout-minutes (Hypatia workflow_audit) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears the Hypatia `missing_timeout_minutes` (workflow_audit, medium) findings by giving every normal job a job-level timeout-minutes — 23 jobs across 11 workflows. Generous upper bounds that cap runaway jobs without affecting normal runs: boj-build 10, instant-sync 10, dogfood-gate 15, rhodibot 15, scorecard-enforcer 15, codeql 30, casket-pages 30, hypatia-scan 30, release 30, static-analysis-gate 30, cross-platform 30 Reusable-workflow caller jobs (governance, mirror, scorecard, secret-scanner) are intentionally untouched: GitHub rejects timeout-minutes on a job that calls a reusable workflow via `uses:` — that timeout belongs in the called workflow (hyperpolymath/standards), which is out of scope for this repo. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 2 ++ .github/workflows/codeql.yml | 1 + .github/workflows/cross-platform.yml | 1 + .github/workflows/dogfood-gate.yml | 6 ++++++ .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/release.yml | 3 +++ .github/workflows/rhodibot.yml | 1 + .github/workflows/scorecard-enforcer.yml | 2 ++ .github/workflows/static-analysis-gate.yml | 4 ++++ 11 files changed, 23 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index a41476c..c8e0fe5 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -14,6 +14,7 @@ on: jobs: trigger-boj: runs-on: ubuntu-latest + timeout-minutes: 10 if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }} steps: - name: Checkout diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index ad8fd14..c5ac5c1 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -109,6 +110,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 30 needs: build steps: - name: Deploy to GitHub Pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1935d55..5ea8ec1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,6 +23,7 @@ permissions: jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: read security-events: write diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml index 8983253..1fdf517 100644 --- a/.github/workflows/cross-platform.yml +++ b/.github/workflows/cross-platform.yml @@ -31,6 +31,7 @@ jobs: name: ${{ matrix.name }} runs-on: ${{ matrix.os }} + timeout-minutes: 30 steps: - name: Checkout diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index b0ef40e..00790de 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -22,6 +22,7 @@ jobs: a2ml-validate: name: Validate A2ML manifests runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -66,6 +67,7 @@ jobs: k9-validate: name: Validate K9 contracts runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -115,6 +117,7 @@ jobs: empty-lint: name: Empty-linter (invisible characters) runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -179,6 +182,7 @@ jobs: groove-check: name: Groove manifest check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -237,6 +241,7 @@ jobs: eclexiaiser-validate: name: Validate eclexiaiser manifest runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -300,6 +305,7 @@ print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))') dogfood-summary: name: Dogfooding compliance summary runs-on: ubuntu-latest + timeout-minutes: 15 needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate] if: always() diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index dfacf3b..2c8c9a8 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -43,6 +43,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Checkout repository diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 228dc43..00531c1 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e5b5276..f42f24c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,6 +18,7 @@ jobs: build: name: Build Artifacts runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: read steps: @@ -44,6 +45,7 @@ jobs: changelog: name: Generate Changelog runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: read outputs: @@ -90,6 +92,7 @@ jobs: name: Create GitHub Release needs: [build, changelog] runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: write steps: diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 1d77bfa..09beed1 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -27,6 +27,7 @@ permissions: jobs: rhodibot: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 6933b78..57535d0 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -23,6 +23,7 @@ permissions: jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -61,6 +62,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index feaaa90..8a5c723 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -19,6 +19,7 @@ jobs: panic-attack-assail: name: panic-attack assail runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Checkout repository @@ -123,6 +124,7 @@ jobs: hypatia-scan: name: Hypatia neurosymbolic scan runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Checkout repository @@ -235,6 +237,7 @@ jobs: patch-bridge-triage: name: Patch Bridge CVE triage runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Checkout repository @@ -324,6 +327,7 @@ jobs: deposit-findings: name: Deposit findings for gitbot-fleet runs-on: ubuntu-latest + timeout-minutes: 30 needs: [panic-attack-assail, hypatia-scan, patch-bridge-triage] if: always()