fix(ci): raise security/quality job timeouts for observed setup variance - #601
Conversation
Four independent timeout-cancellations occurred within ~2 hours of CI activity across two different jobs, all traced to the same root cause: the shared ./.github/actions/setup composite (pnpm install --frozen-lockfile, with pnpm-store caching already configured) took 7+ minutes on affected runs instead of its typical ~1-2 minutes -- consistent with this repo's already-documented npm-registry/CDN edge-node variance (the same class of issue noted for `pnpm audit`'s decode failures), not a caching misconfiguration or a code regression. Direct evidence (job step timestamps, both confirmed independently): - Security Audit (2026-09-04, commit c0f372b first attempt): setup 00:24:06-00:31:28 (7m22s), leaving pnpm audit only until the 10-minute job timeout before OSV scan / gitleaks / dependency-review never got to run at all. - Quality Gate Node 22 (PR #596, second consecutive attempt): setup 00:47:10-00:54:37 (7m27s), leaving Vitest cut off by the 15-minute job timeout mid-run even though lint/typecheck/other gates all passed in the remaining ~11 seconds. - Separately, Quality Gate Node 24 succeeded at both 9m17s and 14m7s on different runs of otherwise-identical content -- a 50%+ swing from runner/network variance alone. security: 10 -> 15 minutes. quality: 15 -> 22 minutes. Both sized to comfortably absorb a slow (~7-8 min) setup stacked with a normal-length run of the job's own real work, without weakening or skipping any test, lint, or security gate.
🤖 CodeAnt AI — Review Status
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThe workflow extends the security and quality job timeouts to absorb occasional 7–8 minute dependency setup delays, preventing otherwise valid CI runs from being cancelled while preserving the existing checks and job dependencies. Flow diagram for extended CI job timeoutsflowchart TD
P[workflow-policy] --> S[Security Audit<br/>timeout 15 minutes]
S --> Q[Quality Gate<br/>timeout 22 minutes]
Setup[Shared dependency setup<br/>7-8 minute variance] -. absorbs .-> S
Setup -. absorbs .-> Q
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary
|
codeant-ai
Bot
added
the
size:XS
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Docker |  |
Sep 4, 2026 1:08a.m. | Review ↗ |
| Python | |
Sep 4, 2026 1:08a.m. | Review ↗ |
| Rust | |
Sep 4, 2026 1:08a.m. | Review ↗ |
| Shell | |
Sep 4, 2026 1:08a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This PR appropriately addresses documented CI timeout failures by raising budget limits for the security and quality jobs. The changes are backed by clear evidence of setup-time variance from npm registry CDN edge-node issues.
Changes reviewed:
securityjob: timeout increased from 10 to 15 minutes (line 65)qualityjob: timeout increased from 15 to 22 minutes (line 262)
The timeout values are sized to accommodate documented slow (~7-8 min) setup times while maintaining all existing gates. No functional issues, security concerns, or logic errors identified.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe CI workflow increases the ChangesCI timeout updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to Security and quality CI jobs receive additional time to complete existing checks during setup variability, without changing the checks themselves. The change is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
User description
Summary
Four independent timeout-cancellations occurred within ~2 hours of CI activity across two different jobs, all traced to the same root cause: the shared
./.github/actions/setupcomposite (pnpm install --frozen-lockfile, with pnpm-store caching already configured viacache: pnpmonactions/setup-node) took 7+ minutes on affected runs instead of its typical ~1-2 minutes -- consistent with this repo's already-documented npm-registry/CDN edge-node variance (the same class of issue noted in this repo forpnpm audit's decode failures), not a caching misconfiguration or a code regression.Direct evidence (job step timestamps, independently confirmed on two different jobs):
c0f372b3, first attempt): setup ran00:24:06-00:31:28(7m22s), leavingpnpm auditrunning until the 10-minute job timeout cancelled it -- OSV scan / gitleaks / dependency-review never got to run at all.00:47:10-00:54:37(7m27s), leaving Vitest cut off by the 15-minute job timeout mid-run, even though lint/typecheck/every other gate had already passed in the remaining ~11 seconds.Fix
securityjob:timeout-minutes: 10->15qualityjob:timeout-minutes: 15->22Both sized to comfortably absorb a slow (~7-8 min) setup stacked with a normal-length run of the job's own real work, without weakening or skipping any test, lint, or security gate -- this only changes how long CI is willing to wait, not what it checks.
Test plan
pnpm run workflow-policy:check-- clean (permissions, needs graph, action pins all structurally sound)pnpm run lint-- cleanpnpm run ci:prepush-- all local checks PASSSummary by Sourcery
Increase security and quality CI job timeouts to accommodate transient dependency setup delays.
Bug Fixes:
CI:
CodeAnt-AI Description
Prevent CI security and quality checks from being cancelled during slow setup
What Changed
Impact
✅ Fewer security scan cancellations✅ Fewer interrupted test runs✅ CI tolerates slower dependency installation💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by cubic
Raises the
securityandqualityjob timeouts so CI stops cancelling runs when the shared setup step is slow. Setup occasionally takes 7+ minutes instead of the usual 1–2 minutes due to registry/CDN variance, which caused four timeout-cancellations in two hours.securitygoes from 10 to 15 minutes andqualityfrom 15 to 22 minutes; both still run the same checks.Written for commit 7b0d14c. Summary will update on new commits.
Summary by CodeRabbit