From 66748513ea625763490903e50c49aeb0b0e80f94 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 3 Aug 2026 15:17:58 +0200 Subject: [PATCH] ci: bound all 16 unbounded workflow jobs on main with timeout-minutes The main branch carries a different, older set of workflow files than development (which now calls the shared reusable workflows in ConductionNL/.github, bounded at source). None of main's 16 jobs declared timeout-minutes, so a hung job burned a runner for GitHub's 6-hour default. These are not dead files: release-workflow.yaml has recent runs on main, and the PR-triggered jobs (php-checks matrix, frontend-quality, lint-check, both check-branch duplicates) fire on every PR into main, i.e. on every release. Bounds are derived from measured fleet-wide durations (successful and failed executions, skipped excluded) and are deliberately loose -- a timeout that fires under normal contention turns a slow run into a phantom defect. php-checks is set to 30 rather than 20: one job-level bound covers all six matrix legs, and while lint/PHPCS/PHPMD/Psalm/PHPStan run ~4 min, the PHPUnit leg has been observed at 18.9 min while succeeding. No job here calls a reusable workflow, so timeout-minutes is valid on all 16. Additions only; no step, trigger, or job was modified. --- .github/workflows/beta-release.yaml | 3 +++ .github/workflows/code-quality.yml | 7 +++++++ .github/workflows/documentation.yml | 2 ++ .github/workflows/pr-check.yaml | 2 ++ .github/workflows/pull-request-from-branch-check.yaml | 2 ++ .github/workflows/pull-request-lint-check.yaml | 2 ++ .github/workflows/push-development-to-beta.yaml | 2 ++ .github/workflows/release-beta.yaml | 3 +++ .github/workflows/release-stable.yaml | 5 +++++ .github/workflows/release-unstable.yaml | 3 +++ .github/workflows/release-workflow.yaml | 3 +++ .github/workflows/sync-beta.yaml | 2 ++ .github/workflows/sync-dev.yaml | 2 ++ .github/workflows/unstable-release.yaml | 3 +++ 14 files changed, 41 insertions(+) diff --git a/.github/workflows/beta-release.yaml b/.github/workflows/beta-release.yaml index 58da22a9..79ccd04e 100644 --- a/.github/workflows/beta-release.yaml +++ b/.github/workflows/beta-release.yaml @@ -8,6 +8,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index 2c4a305e..b6b3470c 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -12,6 +12,11 @@ jobs: php-checks: name: ${{ matrix.check.name }} runs-on: ubuntu-latest + # One job-level bound covers every matrix leg, so it must clear the + # SLOWEST leg. Lint/PHPCS/PHPMD/Psalm/PHPStan run ~4 min, but the PHPUnit + # leg has been observed at 18.9 min while SUCCEEDING — a 20 bound would + # leave ~6% headroom and turn a slow-but-healthy run into a red check. + timeout-minutes: 30 strategy: fail-fast: false matrix: @@ -49,6 +54,8 @@ jobs: frontend-quality: name: Frontend Quality runs-on: ubuntu-latest + # Observed max 5.3 min across 49 fleet runs; 20 leaves ample headroom. + timeout-minutes: 20 steps: - name: Checkout diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 69aa6b2e..a5cf3544 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -12,6 +12,8 @@ jobs: deploy: name: Deploy Documentation runs-on: ubuntu-latest + # Observed max 2.5 min across 23 fleet runs; 20 leaves ample headroom. + timeout-minutes: 20 if: github.event_name == 'push' permissions: contents: write diff --git a/.github/workflows/pr-check.yaml b/.github/workflows/pr-check.yaml index 1c264ed9..542541e3 100644 --- a/.github/workflows/pr-check.yaml +++ b/.github/workflows/pr-check.yaml @@ -9,6 +9,8 @@ on: jobs: check-branch: runs-on: ubuntu-latest + # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom. + timeout-minutes: 10 steps: - name: Check branch run: | diff --git a/.github/workflows/pull-request-from-branch-check.yaml b/.github/workflows/pull-request-from-branch-check.yaml index 1c264ed9..542541e3 100644 --- a/.github/workflows/pull-request-from-branch-check.yaml +++ b/.github/workflows/pull-request-from-branch-check.yaml @@ -9,6 +9,8 @@ on: jobs: check-branch: runs-on: ubuntu-latest + # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom. + timeout-minutes: 10 steps: - name: Check branch run: | diff --git a/.github/workflows/pull-request-lint-check.yaml b/.github/workflows/pull-request-lint-check.yaml index 4a8c874f..e89e9d52 100644 --- a/.github/workflows/pull-request-lint-check.yaml +++ b/.github/workflows/pull-request-lint-check.yaml @@ -9,6 +9,8 @@ on: jobs: lint-check: runs-on: ubuntu-latest + # Observed max 1.4 min across 176 fleet runs; 15 leaves ample headroom. + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/.github/workflows/push-development-to-beta.yaml b/.github/workflows/push-development-to-beta.yaml index a23f924e..17a731b5 100644 --- a/.github/workflows/push-development-to-beta.yaml +++ b/.github/workflows/push-development-to-beta.yaml @@ -12,6 +12,8 @@ on: jobs: create-pr: runs-on: ubuntu-latest + # Observed max 5.6 min across 152 fleet runs; 20 leaves ample headroom. + timeout-minutes: 20 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/release-beta.yaml b/.github/workflows/release-beta.yaml index 1ee77dc8..0c805346 100644 --- a/.github/workflows/release-beta.yaml +++ b/.github/workflows/release-beta.yaml @@ -8,6 +8,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/release-stable.yaml b/.github/workflows/release-stable.yaml index acf5bbb5..13431854 100644 --- a/.github/workflows/release-stable.yaml +++ b/.github/workflows/release-stable.yaml @@ -14,6 +14,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code uses: actions/checkout@v3 @@ -149,6 +152,8 @@ jobs: update-changelog: runs-on: ubuntu-latest + # Observed ~0.2 min; 15 leaves ample headroom. + timeout-minutes: 15 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/release-unstable.yaml b/.github/workflows/release-unstable.yaml index 54b7a36c..0406b6b1 100644 --- a/.github/workflows/release-unstable.yaml +++ b/.github/workflows/release-unstable.yaml @@ -8,6 +8,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/release-workflow.yaml b/.github/workflows/release-workflow.yaml index b2fccbb5..9cf8ed54 100644 --- a/.github/workflows/release-workflow.yaml +++ b/.github/workflows/release-workflow.yaml @@ -15,6 +15,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code diff --git a/.github/workflows/sync-beta.yaml b/.github/workflows/sync-beta.yaml index fdac64ce..b1dd1b99 100644 --- a/.github/workflows/sync-beta.yaml +++ b/.github/workflows/sync-beta.yaml @@ -12,6 +12,8 @@ on: jobs: sync-to-beta-release: runs-on: ubuntu-latest + # Branch-sync job; fleet sync jobs run well under a minute. 20 is generous. + timeout-minutes: 20 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/sync-dev.yaml b/.github/workflows/sync-dev.yaml index e24e2379..bde123d1 100644 --- a/.github/workflows/sync-dev.yaml +++ b/.github/workflows/sync-dev.yaml @@ -11,6 +11,8 @@ on: jobs: sync-to-development-release: runs-on: ubuntu-latest + # Branch-sync job; fleet sync jobs run well under a minute. 20 is generous. + timeout-minutes: 20 steps: - name: Checkout Code uses: actions/checkout@v3 diff --git a/.github/workflows/unstable-release.yaml b/.github/workflows/unstable-release.yaml index 5fcfff9e..55ca5643 100644 --- a/.github/workflows/unstable-release.yaml +++ b/.github/workflows/unstable-release.yaml @@ -8,6 +8,9 @@ on: jobs: release-management: runs-on: ubuntu-latest + # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release + # jobs — a spurious release failure is expensive, so keep this loose. + timeout-minutes: 45 steps: - name: Checkout Code