From 4c47e151f3426b8698090e3f3903331fa28490c6 Mon Sep 17 00:00:00 2001 From: Claude Code Date: Sun, 27 Sep 2026 03:46:12 +0200 Subject: [PATCH] chore(ci): add missing timeout-minutes guards to hot-path jobs Fleet-wide CI-speed pass: none of 0pt's push/pull_request-triggered workflow jobs capped their own runtime, so a hang (network stall, runaway process, stuck polling loop) burns a runner slot until Gitea's own default kicks in. Added job-level timeout-minutes sized to what each job actually does: cd.yml deploy 20 (bounded ~10min signed-artifact poll + setup) ci.yml quality 30 (typecheck/test/build) ci.yml integration 45 (multi-service: live OpenSearch + ClickHouse) ci.yml security 15 (single trivy fs scan) security.yml security 15 (single trivy fs scan) masterplan-lock.yml check 10 (single dependency-free shell check) release.yml release 45 (docker build/push + full G17 SBOM/scan/attest/verify chain) Deliberately NOT included in this PR: a concurrency: block for ci.yml/security.yml/masterplan-lock.yml's push+pull_request double- trigger. ci.yml's own `integration` job comment already documents, measured live (runs 28904/28906), that "Gitea currently ignores workflow concurrency" on this fleet, and the repo's real fix for the resulting double-run-on-shared-service-containers problem is the self-identifying-container pattern already in that job, not a concurrency group. Adding an inert concurrency: block here would give false confidence that the duplicate-run problem is handled when it measurably is not. Left for a follow-up decision once that fleet-wide finding is resolved. Part of a fleet-wide CI-speed pass (timeout-minutes audit). Co-Authored-By: Claude Sonnet 5 --- .gitea/workflows/cd.yml | 1 + .gitea/workflows/ci.yml | 3 +++ .gitea/workflows/masterplan-lock.yml | 1 + .gitea/workflows/release.yml | 1 + .gitea/workflows/security.yml | 1 + 5 files changed, 7 insertions(+) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index 51b9583..db27b2a 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -21,6 +21,7 @@ on: jobs: deploy: runs-on: ubuntu-latest + timeout-minutes: 20 env: COOLIFY_APP_ID: ${{ vars.COOLIFY_APP_ID || 'TODO-no-coolify-app-provisioned-yet' }} IMAGE_REPO: git.cloud.siax.io/sax3l/0pt diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 941df82..5a14b6b 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -24,6 +24,7 @@ on: jobs: quality: runs-on: ubuntu-latest + timeout-minutes: 30 steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 @@ -76,6 +77,7 @@ jobs: # ordinary branch pushes still run blocking quality/security. if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest + timeout-minutes: 45 services: opt-ci-opensearch: image: opensearchproject/opensearch:2.11.1 @@ -226,6 +228,7 @@ jobs: # measurable blind spot into declared policy. security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@v4 - name: Install Trivy diff --git a/.gitea/workflows/masterplan-lock.yml b/.gitea/workflows/masterplan-lock.yml index b3bc95a..2a8d813 100644 --- a/.gitea/workflows/masterplan-lock.yml +++ b/.gitea/workflows/masterplan-lock.yml @@ -15,6 +15,7 @@ on: jobs: check: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v4 - name: Masterplan lock check diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 4285668..b86713d 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -73,6 +73,7 @@ jobs: release: name: Build, push, G17 (SBOM/scan/attest/verify/evidence) runs-on: ubuntu-latest + timeout-minutes: 45 steps: - uses: https://git.siax.io/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, mirrored + SHA-pinned (SUP-06, same pin n0d/cl0ud/st0re/h0st already use) with: diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index bcd987c..94f3eaa 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -28,6 +28,7 @@ on: jobs: security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@v4 - name: Install Trivy -- 2.54.0