ci: set an explicit timeout-minutes on every job - #637
Merged
Conversation
Only weekly-summary.yml set a timeout, so every other job inherited GitHub's six-hour default. The browser-driven smoke jobs are the real exposure: a wedged Playwright session or a Workbench container that never becomes healthy had no ceiling short of six hours. Values are sized from observed durations on main with headroom -- Workbench smoke 30 minutes against a 14.9 minute worst case, mock-IdP 15 against 6.8, and 5 for the small coordination and status jobs. Closes #633
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The added timeout-minutes values are consistently applied to all runs-on jobs without violating GitHub’s reusable-workflow constraints, and the changes are low-risk configuration-only safeguards.
Pull request overview
This PR adds explicit timeout-minutes caps to GitHub Actions jobs across the repository’s workflows to prevent hung CI (especially Playwright- and container-driven smoke suites) from consuming the full 6-hour default runner allocation.
Changes:
- Add
timeout-minutesto allruns-onjobs across the workflows, with longer ceilings for the heaviest smoke jobs. - Keep reusable-workflow caller jobs (
jobs.<name>.uses) free oftimeout-minutes(since GitHub rejects that combination), placing timeouts only on the concreteruns-onjobs. - Document the rationale for larger timeouts (measured runtime + headroom) inline on the longer-running jobs.
File summaries
| File | Description |
|---|---|
| .github/workflows/ci.yml | Adds per-job timeouts (incl. higher ceilings for the heavier jobs) to cap CI runtime on hangs. |
| .github/workflows/connect-integration.yml | Adds timeouts to the integration matrix and Slack notification job. |
| .github/workflows/connect-smoke.yml | Adds timeouts to change-detection, matrix, smoke matrix legs, and status aggregation. |
| .github/workflows/packagemanager-smoke.yml | Adds timeouts to change-detection, matrix, smoke matrix legs, and status aggregation. |
| .github/workflows/workbench-smoke.yml | Adds timeouts throughout; sets a higher ceiling for the heaviest smoke matrix job. |
| .github/workflows/mock-idp-e2e.yml | Adds timeouts throughout; sets a higher ceiling for the Keycloak/Connect/Workbench E2E job. |
| .github/workflows/example-report.yml | Adds a timeout to cap the example report build workflow runtime. |
| .github/workflows/preview.yml | Adds timeouts to the preview/cleanup jobs (reusable workflow caller remains without timeout). |
| .github/workflows/website.yml | Adds a timeout to the deploy job (reusable workflow caller remains without timeout). |
| .github/workflows/website-preview.yml | Adds timeouts to preview/cleanup jobs (reusable workflow caller remains without timeout). |
| .github/workflows/docker.yml | Adds a timeout to prevent a hung Docker build from running unbounded. |
| .github/workflows/install-flow-smoke.yml | Adds timeouts to the install-flow smoke jobs on Ubuntu and macOS. |
| .github/workflows/linux-smoke.yml | Adds a timeout sized for variable distro image builds. |
| .github/workflows/mac-smoke.yml | Adds a timeout for the macOS smoke job. |
| .github/workflows/publish.yml | Adds timeouts to build/release/publish/smoke-test jobs to prevent long stalls during release automation. |
| .github/workflows/release.yml | Adds a timeout covering version bump + changelog + relock + tag/push operations. |
| .github/workflows/security-audit.yml | Adds a timeout to cap dependency audit runtime. |
| .github/workflows/pr-title.yml | Adds a timeout to prevent the title-check job from hanging unbounded. |
| .github/workflows/add-to-team-project.yml | Adds a timeout to cap the label→project automation job. |
| .github/workflows/copilot-setup-steps.yml | Adds a timeout to cap the Copilot setup job runtime. |
Review details
- Files reviewed: 20/20 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The artipacked suppressions in .github/zizmor.yml are keyed by file:line:col, and inserting timeout-minutes shifted the checkout steps they point at, so the suppressions stopped matching and CI's enforced artipacked audit failed on website-preview.yml:37 and :102. Realigns all five entries: release.yml 35 to 38, preview.yml 38 to 39 and 58 to 60, website-preview.yml 36 to 37 and 100 to 102. Verified with CI's exact gate: unpinned-uses 0, artipacked 0.
Contributor
|
ian-flores
added a commit
that referenced
this pull request
Sep 8, 2026
Resolves the four smoke-workflow conflicts with #637, which inserted timeout-minutes at the same point in each status job where this branch inserts permissions. Both sides are kept, timeout-minutes first to match the placement #637 used everywhere else (immediately after runs-on). Verified after the merge: no job with runs-on is missing timeout-minutes and none combines uses with timeout-minutes; all four status jobs carry timeout-minutes 5, issues: write, and the notify step gated on schedule; all 22 workflow and action files parse; zizmor unpinned-uses and artipacked both 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #633
Only
weekly-summary.ymlset a timeout, so every other job across the 22 workflows inherited GitHub's six-hour default. The browser-driven smoke jobs are the real exposure: a wedged Playwright session, or a Workbench container that never becomes healthy, had no ceiling short of six hours. There is nopytest-timeoutin the dependency set either, so the only backstop today is Playwright's per-locator timeout.Values are sized from observed durations on
mainwith headroom rather than picked arbitrarily. Workbench smoke gets 30 minutes against a 14.9 minute worst case, mock-IdP 15 against 6.8, Connect smoke 10 against 4.3, and the small coordination and status jobs get 5. The goal is a backstop, not a tight budget, so nothing is set near its observed maximum.Testing
Every workflow still parses. A check across all 22 files confirms no job with
runs-onlacks atimeout-minutes, and no job combinesuses:withtimeout-minutes— GitHub rejects that combination, so jobs that call a reusable workflow were deliberately left alone and the timeout placed on the jobs inside the called workflow instead.Note for review order
This touches the same four smoke workflows as #632. The edits are in different places —
timeout-minuteson job headers here, versus a step inside the status job there — so whichever merges second should rebase cleanly, but it is not conflict-free by construction.