From 570b1730329589cbe9a736c927d3a86b8ebbffb4 Mon Sep 17 00:00:00 2001 From: bmethod Date: Sun, 11 Oct 2026 15:22:36 -0700 Subject: [PATCH 1/2] ci(VSY-235): align CI with the template and add Dependabot The kendex install and mirror steps get the template's time limits and shell, and the credential scan step takes the template's name. The commits that introduced those differences (60b24202, 6b638553) state no reason for them. Each setup-bun pin names its version, v2.2.0, whose tag points at the pinned commit; the pin does not move. Dependabot now opens update pull requests for action pins. [no-changelog] --- .github/dependabot.yml | 6 ++++++ .github/workflows/ci.yml | 7 +++++-- .github/workflows/release.yml | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..ca79ca5b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5ee34a11..050b3923 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -74,6 +74,8 @@ jobs: - id: kendex if: steps.render-reach.outputs.render_candidate == 'true' continue-on-error: true + timeout-minutes: 3 + shell: bash env: GH_TOKEN: "" GITHUB_TOKEN: ${{ github.token }} @@ -81,6 +83,7 @@ jobs: - id: mirror if: steps.render-reach.outputs.render_candidate == 'true' continue-on-error: true + timeout-minutes: 5 run: kendex source refresh working-directory: subject - name: Report unavailable render prerequisites @@ -132,7 +135,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - name: Check the application @@ -301,7 +304,7 @@ jobs: --results "$NEEDS" --classifier changes \ --waiver "$WAIVER" --skippable application \ --lane application=application "${package[@]}" - - name: Scan the pull request's commits for credentials + - name: secrets (credential scan of the pull request diff) if: always() && github.event_name == 'pull_request' working-directory: subject run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 36b652dd..e1c1d1d6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -95,7 +95,7 @@ jobs: with: ref: ${{ env.TAG }} persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version # Setting the version is a manual step of the release procedure in From 5a122f2ebfb52b028472e93ec6135a122c4314fa Mon Sep 17 00:00:00 2001 From: bmethod Date: Sun, 11 Oct 2026 15:36:27 -0700 Subject: [PATCH 2/2] test(VSY-235): pin kendex and mirror step bounds [no-changelog] Address PR comments --- scripts/ci_workflow_test.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/scripts/ci_workflow_test.py b/scripts/ci_workflow_test.py index 5bcaa8f9..980043fc 100644 --- a/scripts/ci_workflow_test.py +++ b/scripts/ci_workflow_test.py @@ -261,6 +261,12 @@ def check_wiring(self, workflow): self.assertEqual(shlex.split(command(self.step(changes, header)))[0], executable) for header in ("id: kendex", "id: mirror"): self.assertEqual(scalar(self.step(changes, header), "if"), "steps.render-reach.outputs.render_candidate == 'true'") + # Unbounded, a hung install or refresh runs to the job's timeout and + # fails the whole changes job, where continue-on-error would have let + # the classifier run on. + kendex = self.step(changes, "id: kendex") + self.assertEqual((scalar(kendex, "timeout-minutes"), scalar(kendex, "shell")), ("3", "bash")) + self.assertEqual(scalar(self.step(changes, "id: mirror"), "timeout-minutes"), "5") classify = self.step(changes, "id: classify") self.assertEqual(scalar(classify, "uses"), ACTION) # The lane declaration comes from the default branch's checkout, and @@ -274,6 +280,9 @@ def test_classifier_and_render_prerequisites_use_the_trusted_checkout(self): ("covers-all-lanes", " lanes-from: classifier\n", " lanes-from: classifier\n covers-all-lanes: true\n"), ("lanes-from-subject", "lanes-from: classifier", "lanes-from: subject"), ("render-reach-subject", "classifier/.agents/skills/harness-ci/scripts/harness-only", "subject/.agents/skills/harness-ci/scripts/harness-only"), + ("kendex-timeout", " timeout-minutes: 3\n", " timeout-minutes: 30\n"), + ("kendex-shell", " shell: bash\n", " shell: sh\n"), + ("mirror-timeout", " timeout-minutes: 5\n run: kendex source refresh\n", " timeout-minutes: 50\n run: kendex source refresh\n"), ) for control, old, new in controls: with self.subTest(control=control):