From de771f5a1f56c43e6bbc4b943f86a8caaf8d4466 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 20:52:18 +0100 Subject: [PATCH] fix(ci): give changelog-reusable's `guard` job a timeout-minutes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `governance / Validate Hypatia Baseline` has been RED on `standards` main itself — measured at ed5e3f6 and d1bd7f4, run 35770216122. The gate's error is `Gate failed: 2 unfiltered finding(s) at or above 'info'`, and both unfiltered findings are the SAME defect reported by two rule modules: workflow_audit missing_timeout_minutes changelog-reusable.yml job `guard` workflow_hardening WH006 changelog-reusable.yml:70 job `guard` Every other finding in that run carries `baseline_status: acknowledged`; these two are the only `new` ones, so they are the whole of the red. The omission is unambiguous: the sibling job `generate` in the same file already declares `timeout-minutes: 10`. `guard` was simply missed. Without it the job inherits the 6-hour default, so a hung codeload fetch in its depth-1 checkout burns the budget. Fix is one line, keyed in the same position as the sibling's. Verified before commit: - actionlint -no-color: rc=0 (captured directly, not through a pipe) - yq: jobs.guard.timeout-minutes = 10, jobs.generate.timeout-minutes = 10 - git diff --stat: 1 file changed, 1 insertion(+) — nothing else touched ⚠ This does NOT claim to make the gate green by itself; it removes the only two unfiltered findings that run reported. The gate re-scans on the merge commit and may surface findings this scan did not see. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/changelog-reusable.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml index e1f99d06..dbadb517 100644 --- a/.github/workflows/changelog-reusable.yml +++ b/.github/workflows/changelog-reusable.yml @@ -68,6 +68,7 @@ permissions: jobs: guard: + timeout-minutes: 10 name: Check for self-trigger loop runs-on: ${{ inputs.runs-on }} outputs: