fix(ci): give changelog-reusable's guard job a timeout-minutes — the whole of the red on main - #995
Merged
Conversation
`governance / Validate Hypatia Baseline` has been RED on `standards` main itself — measured at ed5e3f6 and d1bd7f4, run 35770216122. The gate's error is `Gate failed: 2 unfiltered finding(s) at or above 'info'`, and both unfiltered findings are the SAME defect reported by two rule modules: workflow_audit missing_timeout_minutes changelog-reusable.yml job `guard` workflow_hardening WH006 changelog-reusable.yml:70 job `guard` Every other finding in that run carries `baseline_status: acknowledged`; these two are the only `new` ones, so they are the whole of the red. The omission is unambiguous: the sibling job `generate` in the same file already declares `timeout-minutes: 10`. `guard` was simply missed. Without it the job inherits the 6-hour default, so a hung codeload fetch in its depth-1 checkout burns the budget. Fix is one line, keyed in the same position as the sibling's. Verified before commit: - actionlint -no-color: rc=0 (captured directly, not through a pipe) - yq: jobs.guard.timeout-minutes = 10, jobs.generate.timeout-minutes = 10 - git diff --stat: 1 file changed, 1 insertion(+) — nothing else touched ⚠ This does NOT claim to make the gate green by itself; it removes the only two unfiltered findings that run reported. The gate re-scans on the merge commit and may surface findings this scan did not see. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
Contributor
|
Warning Review limit reachedNext included review available in 35 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
One line: give
changelog-reusable.yml'sguardjob atimeout-minutes: 10.Why — this is the whole of the red on
maingovernance / Validate Hypatia Baselineis failing onmainitself, notonly on PR branches. Measured at
ed5e3f6andd1bd7f4(run35770216122).I originally misread that run's log: the line
ERROR: could not resolve hypatia HEAD via git ls-remoteis the step echoing its own source, not a failure.The real error is:
Both unfiltered findings are the same defect, reported by two rule modules:
workflow_auditmissing_timeout_minuteschangelog-reusable.ymlguardworkflow_hardeningWH006.github/workflows/changelog-reusable.yml:70guardEvery other finding in that run carries
baseline_status: acknowledged.These two are the only
"baseline_status": "new"entries, so they are theentire gate failure.
Why it is unambiguous
The sibling job
generatein the same file already declarestimeout-minutes: 10.guardwas simply missed. Without it the job inheritsthe 6-hour default, so a hung codeload fetch in its
fetch-depth: 1checkoutburns the budget. The fix is keyed in the same position as the sibling's.
Verification
actionlint -no-color→ rc=0 (captured directly; a| tailpipe reportstail's status, which is how I have miscounted this before)
yq→jobs.guard.timeout-minutes = 10,jobs.generate.timeout-minutes = 10git diff --stat→1 file changed, 1 insertion(+)— nothing else touchedde771f5signed,sig=G⚠ What this does NOT claim
It does not claim to turn the gate green by itself. It removes the only two
unfiltered findings that run reported. The gate re-scans against the merge
commit and may surface findings this scan did not see.
Relationship to #990
#990's only red is this same pre-existingmainfailure — it is notintroduced by that PR. This PR is the cure for the red;
#990still carries3 unresolved CodeRabbit findings and is a separate call.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR