From a7ad685de5522975b85d4c75653462755f1f25c4 Mon Sep 17 00:00:00 2001 From: Dylan Verheul Date: Mon, 21 Sep 2026 12:51:23 +0200 Subject: [PATCH] ci: bound the release and Dependabot jobs too "A 15-minute timeout-minutes to every CI job" in 26.2 was applied to ci.yml only. release.yml and the Dependabot workflow were left on GitHub's 6 hour default, in all five Zostera repos. A job that hangs rather than fails burns the whole allowance before anyone notices. release.yml gets 20 rather than 15. It does everything the ci.yml build job does, then uploads to PyPI, and a bound that fires during a publish is worse than one that never fires at all. Dependabot gets 15, against a runtime in seconds. PACKAGING.md now says every job in every workflow carries a bound, so the rule does not get read as "every job in ci.yml" a second time. Found while bounding the jobs in observation/wrnpro and observation/meetnetten, where the same gap was wider. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dependabot-auto-approve-and-merge.yml | 1 + .github/workflows/release.yml | 1 + CHANGELOG.md | 1 + PACKAGING.md | 6 ++++++ 4 files changed, 9 insertions(+) diff --git a/.github/workflows/dependabot-auto-approve-and-merge.yml b/.github/workflows/dependabot-auto-approve-and-merge.yml index 667b2d1..391aaab 100644 --- a/.github/workflows/dependabot-auto-approve-and-merge.yml +++ b/.github/workflows/dependabot-auto-approve-and-merge.yml @@ -11,6 +11,7 @@ permissions: jobs: dependabot: runs-on: ubuntu-latest + timeout-minutes: 15 # Check the actor, only run for Dependabot PRs, prevent failing on non-Dependabot PRs. if: ${{ github.actor == 'dependabot[bot]' }} steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9501bf9..05d9070 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,7 @@ on: jobs: run: runs-on: ubuntu-latest + timeout-minutes: 20 environment: name: pypi permissions: diff --git a/CHANGELOG.md b/CHANGELOG.md index f09573d..04ccbb3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- Add `timeout-minutes` to the `release.yml` and Dependabot workflow jobs, which were left unbounded when the CI jobs got theirs. - Test on Python 3.15 (release candidate) against Django 6.1 and `main`. The job is non-blocking and 3.15 is not yet advertised as supported. - Remove the `<7.0` upper bound on the `Django` dependency. diff --git a/PACKAGING.md b/PACKAGING.md index c5b4736..9e83b18 100644 --- a/PACKAGING.md +++ b/PACKAGING.md @@ -25,6 +25,12 @@ as a PR in that sibling's own repo — never push straight to `main`. `apt-get update` is a known hang risk — it once stalled on an unreachable Ubuntu mirror and burned six hours before GitHub's cap; `timeout-minutes` on every job bounds it. +Every job in every workflow carries `timeout-minutes`. Without it a job falls back to +GitHub's 6 hour default, and a job that hangs rather than fails burns the whole allowance +before anyone notices. 15 minutes is the default here, 20 where a job builds and publishes +(`release.yml`). This was once read as "every job in `ci.yml`", which left `release.yml` and +the Dependabot workflow unbounded in all five repos until 2026-09. + ## Synced with per-package substitution `pyproject.toml` sections `[build-system]`, `[tool.uv.build-backend]`, `[tool.check-manifest]`,