fix(ci): stop the Node 24.21 healthcheck hang and cap job runtimes

.github/workflows/auto-assign.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       issues: write
       pull-requests: write

.github/workflows/auto-label.yml

@@ -16,6 +16,7 @@ jobs:
     name: Label Pull Request
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -85,6 +86,7 @@ jobs:
     name: Label Issue
     if: github.event_name == 'issues'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Apply triage and detect type
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/bsr-publish.yml

@@ -26,6 +26,7 @@ jobs:
   publish:
     name: Publish to Buf Schema Registry
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/buf.yml

@@ -18,6 +18,7 @@ jobs:
   lint:
     name: Lint & Breaking
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       matrix:
         package: [auth, events]

.github/workflows/ci.yml

@@ -13,11 +13,15 @@ concurrency:
 permissions:
   contents: read
 
+# Every job caps its runtime with timeout-minutes. Jobs finish in about two
+# minutes; without a cap a hung test (e.g. an HTTP/2 connection that never
+# closes) holds the runner for GitHub's 6-hour default before failing.
 jobs:
   # ── Lint, Typecheck, Audit (run once on dev Node) ──────────────────────
   quality:
     name: Typecheck, Lint & Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -50,6 +54,7 @@ jobs:
   test-node:
     name: "Node ${{ matrix.node-version }}"
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -83,6 +88,7 @@ jobs:
   test-amqp-broker:
     name: AMQP broker integration
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     services:
       rabbitmq:
         image: rabbitmq:4-alpine
@@ -117,6 +123,7 @@ jobs:
   test-redis-broker:
     name: "Redis protocol (${{ matrix.broker.name }})"
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -157,6 +164,7 @@ jobs:
   test-amqp-recovery:
     name: AMQP recovery (testcontainers)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     continue-on-error: true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -191,6 +199,7 @@ jobs:
   test-bun:
     name: Bun (${{ matrix.bun }})
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -228,6 +237,7 @@ jobs:
   test-esbuild:
     name: esbuild transpilation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/cli-scaffold-matrix.yml

@@ -37,6 +37,7 @@ jobs:
   discover:
     name: discover combinations
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     outputs:
       combos: ${{ steps.list.outputs.combos }}
     steps:
@@ -54,6 +55,7 @@ jobs:
     name: "init ${{ matrix.combo.name }}"
     needs: discover
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

.github/workflows/create-release.yml

@@ -15,6 +15,7 @@ jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/parity-gate.yml

@@ -27,6 +27,7 @@ jobs:
   parity:
     name: HTTP ↔ in-process parity
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/release.yml

@@ -17,6 +17,8 @@ jobs:
   release:
     name: Release & Publish
     runs-on: ubuntu-latest
+    # Longer than the CI jobs: a release run publishes 15 packages to npm.
+    timeout-minutes: 30
     steps:
       - name: Generate App token
         id: app-token

.github/workflows/snapshot.yml

@@ -16,6 +16,7 @@ jobs:
   snapshot:
     name: Publish PR Snapshot
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -37,6 +38,7 @@ jobs:
     name: "Release Gate (Node ${{ matrix.node-version }})"
     needs: snapshot
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

packages/healthcheck/tests/integration/worker-components.test.ts

@@ -27,17 +27,27 @@ import { Healthcheck } from "../../src/Healthcheck.ts";
 import { createHealthcheckManager } from "../../src/HealthcheckManager.ts";
 import { ServingStatus } from "../../src/types.ts";
 
-/** Fetch an HTTP health endpoint over h2c and return the status code. */
+/**
+ * Fetch an HTTP health endpoint over h2c and return the status code.
+ *
+ * The body is drained before the session is closed. Closing the stream from
+ * the 'response' handler instead leaves it half-read, and on Node 24.21 (whose
+ * http2 client defers RST_STREAM while receiving) such a stream is never
+ * destroyed: the client keeps its TCP connection open and the server's
+ * graceful stop() never completes.
+ */
 function httpStatus(baseUrl: string, path: string): Promise<number> {
     return new Promise((resolve, reject) => {
         const session = http2.connect(baseUrl);
         session.on("error", reject);
         const req = session.request({ ":path": path });
         req.on("response", (headers) => {
             const status = Number(headers[":status"] ?? 0);
-            req.close();
-            session.close();
-            resolve(status);
+            req.on("end", () => {
+                session.close();
+                resolve(status);
+            });
+            req.resume();
         });
         req.on("error", reject);
         req.end();