[myclaudecodeagent]

What

• Add timeout-minutes to every job across .github/workflows/*.yml (5 min for
  lint/format/typecheck/test/docs/pr-title-lint/release jobs, 10 min for the devcontainer
  quality job).
• Add .github/workflows/devcontainer-prebuild.yml, which builds and pushes a devcontainer
  cache image to GHCR (ghcr.io/aseguragonzalez/python-seedwork-devcontainer) whenever
  .devcontainer/** changes on main.
• Reference that cache image via cacheFrom in devcontainer-quality.yml's build step
  (alongside push: never, so the quality-gate run never pushes an image itself).
• Pin runs-on: ubuntu-latest to runs-on: ubuntu-24.04 across all workflows.
• Add devcontainers/ci@* and docker/login-action@* to the repo's GitHub Actions
  allowed-actions list (selected_actions), since the policy only allows an explicit
  set of non-GitHub-owned actions.

Why

• No job had a timeout, so a hang (network stall, flaky test, infinite loop) could occupy
  a runner for hours with only the GitHub-wide 6h default as a backstop.
• The devcontainer used by devcontainer-quality.yml had no prebuilt cache image, so every
  run rebuilt it from scratch, and every run was in fact failing at startup because
  devcontainers/ci was never added to the repo's actions allowlist.
• ubuntu-latest is a moving target; pinning to ubuntu-24.04 keeps the runner image
  version stable and reproducible across runs. This is a manual, one-off pin for
  reproducibility — Dependabot does not track or update runner labels.
• Dependabot coverage (devcontainers, pip, github-actions) was already complete and
  needed no change.

How

• Added timeout-minutes: to each job definition; reusable-workflow-call jobs (uses:)
  were left untouched since they have no runs-on.
• New devcontainer-prebuild.yml workflow using docker/login-action (GHCR login) and
  devcontainers/ci (build + push) triggered on pushes to main touching
  .devcontainer/**.
• Updated the repo's actions/permissions/selected-actions allowlist via the GitHub API to
  include devcontainers/ci@* and docker/login-action@* in addition to the existing
  entries.
• Replaced every runs-on: ubuntu-latest with runs-on: ubuntu-24.04.

How to test

• gh pr checks <PR number> — all workflows (CI, PR title lint) pass.
• Merge to main (or manually trigger) to confirm devcontainer-prebuild.yml builds and
  pushes the cache image successfully; a subsequent devcontainer-quality.yml run should
  then be faster thanks to cacheFrom.

Closes #78

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!