Skip to content

ci: fix incident regex, add job timeouts, drop stale root jest config - #2178

Merged
LucasSantana-Dev merged 17 commits into
mainfrom
ci/incident-regex-timeouts-root-jest
Sep 4, 2026
Merged

LucasSantana-Dev merged 17 commits into
mainfrom
ci/incident-regex-timeouts-root-jest

Conversation

@LucasSantana-Dev

@LucasSantana-Dev LucasSantana-Dev commented Sep 4, 2026 •

Copy link
Copy Markdown
Owner

Summary

Three unrelated CI hygiene fixes bundled into one PR since they all touch .github/root CI plumbing and were filed together by the same backlog run.

  • Fixes the test:music:incident regex so it no longer silently skips the queue-manipulation and player-factory regression suites.
  • Adds timeout-minutes to every job across all 19 workflow files so a hang can't burn the 360-minute GitHub default.
  • Deletes the unreferenced, drifted root jest.config.cjs.

Closes #2154
Closes #2162
Closes #2163

#2154 - test:music:incident regex

queueManipulation.spec was split by #1730 into queueManipulation.{autoplay,dedup,operations,priority,replenish,scoring}.spec.ts, and playerFactory.test never matched because the real file is playerFactory.spec.ts. Both branches matched zero files, so those two regression guards ran 0 tests with a green check.

Fix: queueManipulation.spec -> queueManipulation\..*spec, playerFactory.test -> playerFactory\.spec.

Verification, every branch matches at least one file:

$ find packages/bot/src -name '*.ts' | grep -Ec 'engineManager.spec'
1
$ find packages/bot/src -name '*.ts' | grep -Ec 'autoplay.spec'
2
$ find packages/bot/src -name '*.ts' | grep -Ec 'queueManipulation\..*spec'
6
$ find packages/bot/src -name '*.ts' | grep -Ec 'playerFactory\.spec'
1
$ find packages/bot/src -name '*.ts' | grep -Ec 'play/index.spec'
1

Full npm run test:music:incident run (after npm run db:generate, which CI's test-bot job already runs via the build-shared dependency chain):

Test Suites: 10 passed, 10 total
Tests:       135 passed, 135 total
Snapshots:   0 total
Time:        2.971 s

10 suites now run (up from 8 matching before the fix, 2 of which - queueManipulation.spec and playerFactory.test - matched 0 files).

#2162 - timeout-minutes on every job

No job in any of the (now 19, was 18 when the issue was filed) workflow files under .github/workflows/ set timeout-minutes; every job fell back to GitHub's 360-minute cap.

Sized from gh run list --workflow <file> --limit 20 history (run-level durations via startedAt/updatedAt, and per-job durations for ci.yml via gh run view --json jobs), using roughly 2x observed p95 rounded up, with floors of 15 for test/lint jobs, 30 for docker builds, 30 for deploy/webhook-wait jobs, and 10 for trivial label/notify jobs:

workflow job timeout-minutes basis
ci.yml build-shared 15 p95 5.4min, test/lint floor
ci.yml checks 15 p95 7.4min
ci.yml test-shared 15 p95 5.0min
ci.yml test-backend 15 p95 6.7min
ci.yml test-bot 15 p95 7.0min
ci.yml test-youtube-smoke 15 conditional, same class as other test jobs
ci.yml test-frontend 15 p95 6.8min
ci.yml madge 20 p95 9.1min, 2x rounded up
ci.yml detect-docker-changes 10 p95 0.3min, trivial
ci.yml docker-build 60 matrix job runs up to 5 sequential build attempts on retry (issue #2015's BuildKit race); observed real max 43.2min (bot leg), 33.9min (backend leg)
ci.yml docker-build-check 10 p95 0.1min, trivial assert
ci.yml quality-gate 10 p95 0.1min, trivial assert
ci.yml sonar 15 p95 2.4min, has a retry-once path
ci.yml security 25 p95 11.5min, 2x rounded up
auto-update-pr-branches.yml update 10 p95 0.9min, trivial
bundle-size.yml size-limit 15 p95 5.7min
deploy-frontend-cf.yml deploy 30 deploy floor
deploy-staging.yml deploy-staging 30 deploy floor
deploy.yml deploy 45 p95 21.3min; job has webhook-wait polling loops the issue calls out by name
destructive-interaction-gate.yml destructive-interaction-gate 15 p95 3.4min
docker-publish.yml build-and-push 30 docker build floor (p95 11.7min)
external-pr-notify.yml notify 10 p95 1.9min, trivial notify
external-pr-notify.yml digest 10 p95 1.9min, trivial notify
fork-ci-autoapprove.yml auto-approve 10 p95 2.9min, trivial
migration-gate.yml migrate-gate 15 p95 3.4min
mutation.yml mutation 30 p95 13.3min, 2x rounded up
pr-agent.yml pr-agent 10 p95 1.2min, trivial
pr-labels.yml label 10 p95 4.1min, trivial label job
release-please.yml release-please 10 p95 0.5min, trivial
release-tag-guard.yml ensure-release-tag 10 p95 0.5min (max outlier 3.75min), trivial
stale.yml stale 10 p95 0.3min, trivial

Not changed - quality.yml's quality job and review-tools.yml's danger job both call a reusable workflow via uses:. GitHub Actions does not support timeout-minutes on a job that calls a reusable workflow (only name, uses, with, secrets, needs, if, permissions, strategy are valid there), so these two are left as-is.

Verification - every workflow file still parses and actionlint reports zero issues:

$ python3 -c "import yaml,glob;[yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]"
(no output - all 19 files parsed)
$ actionlint
(no output - zero findings)

git diff --stat on the workflow files confirms only the timeout-minutes lines were added, no reformatting:

17 files changed, 31 insertions(+)

#2163 - stale root jest.config.cjs

Confirmed nothing references the root jest.config.cjs (no root jest script exists either, only the jest devDependency entry):

$ grep -rn "jest.config.cjs" --include=package.json --include=*.yml --include=*.sh --include=*.md . | grep -v node_modules | grep -v packages/
(no matches)

All other jest.config.cjs mentions found in the repo (CHANGELOG.md, docs/TESTING.md, decisions/*.md) refer to the package-scoped configs (packages/backend/jest.config.cjs, packages/bot/jest.config.cjs, packages/shared/jest.config.cjs), not the root one. No doc instructs running bare jest from the repo root, so nothing needed updating there. Deleted the file.

Verification

  • npm run test:music:incident - 10/10 suites, 135/135 tests passing.
  • npm run type:check - clean across shared/bot/backend/frontend.
  • python3 -c "import yaml,glob;..." and actionlint - all 19 workflow files parse, zero lint findings.
  • git diff --stat on touched workflow files - additions only, no reformatting.

Summary by cubic

Fixes #2154, #2162, and #2163: the music incident check now matches all relevant suites, eligible GitHub Actions jobs have bounded runtimes, and the unused root Jest config is removed. This prevents false-green checks, limits hung jobs, and removes stale configuration.

Details

  • Matches both playerFactory.spec and playerFactory.test, plus split queueManipulation suites.
  • Adds 10–75 minute timeouts to eligible jobs across all 19 workflow files; reusable workflow callers remain unchanged because GitHub does not support job timeouts there.
  • Uses 75 minutes for deployment polling and 20 minutes for the sequential PR review workflow.
  • Verified the incident tests pass, all workflow files parse, and actionlint reports no issues.

Written for commit ea04bd8. Summary will update on new commits.

Review in cubic

Fixes three CI hygiene issues: the test:music:incident regex no longer
misses queueManipulation and playerFactory suites (#2154), every job
across all 19 workflow files now sets timeout-minutes so a hang can't
burn the 360-minute default (#2162), and the unreferenced root
jest.config.cjs that had drifted from packages/backend's config is
removed (#2163).
@github-actions github-actions Bot added dependencies Pull requests that update a dependency file ci size/m labels Sep 4, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

Failed to generate code suggestions for PR

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, release, and PR-automation workflows so a hung step is killed rather than running to the runner's 6-hour default (docker builds get 60, deploy 45, most gates 10–15). The remaining changes are package-manifest churn — dependency, devDependency, override, and script updates in package.json.

Worth a look

  • Incident test script no longer matches playerFactory.test files — package.json:31 · Escalate · medium
    • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 19 files

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread .github/workflows/pr-agent.yml Outdated
Comment thread .github/workflows/deploy.yml Outdated
Comment thread package.json Outdated
LucasSantana-Dev and others added 2 commits September 4, 2026 11:19
playerFactory.test also matches under jest roots (tests/handlers/player),
so the incident regex now covers both playerFactory.spec and
playerFactory.test instead of dropping the .test file.

deploy.yml's internal polling budget (docker wait 1860s, webhook retry
210s, version validate 600s, auth-config smoke 540s, oauth redirect
smoke 560s, homelab completion wait 180s) sums to about 3950s (65.8
min); 75 min gives margin over that sum plus checkout/setup overhead.

pr-agent.yml raised to 20 min: max of the 10 min floor doubled and 2x
the measured p95 (1.2 min), so 20 min covers three sequential LLM
review passes over a large diff.

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, release, and PR-automation workflows, capping runtimes from 10 minutes for lightweight scripting jobs up to 60/75 minutes for Docker builds and production deploys so a hung step can't consume a full runner allotment.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 13543e3 (diverged from this PR's base — delta is approximate).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0 issues found across 3 files (changes from recent commits).

Requires human review: Adds timeout-minutes to all CI jobs, fixes a test regex, and deletes a root jest config. Timeout adjustments are operational tradeoffs needing human review.

Re-trigger cubic

@LucasSantana-Dev
LucasSantana-Dev enabled auto-merge (squash) September 4, 2026 14:23

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the GitHub Actions workflows so runs are bounded rather than relying on the 6-hour default, with per-job limits scaled to the work (10 for lightweight label/notify/release jobs, 15–30 for CI/test/deploy jobs, 60 for Docker builds, 75 for production deploy).

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the GitHub Actions workflows (CI, deploy, mutation, PR agent, release, stale, etc.), so hung jobs are killed at a per-job budget instead of running to the account default. Limits scale with the work — 60m for docker-build, 75m for deploy, 10–15m for lint/notify/label jobs.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit ecc1e5d, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, release, and automation workflows, capping runtimes from 10 minutes for lightweight scripting jobs up to 60–75 minutes for Docker builds and production deploys so a hung step fails instead of running to the org default.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 2fcef3c, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.


Graphify review — findings

Adds explicit timeout-minutes to every job across the GitHub Actions workflows, so hung jobs are killed rather than running to the runner's 6-hour default (limits range from 10 minutes for light script jobs up to 60–75 for Docker builds and deploys).

Worth a look

  • Root Jest config removed, breaking jest consumers that rely on default repository config — jest.config.cjs:1 · Escalate · medium
    • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 5d4c447, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every CI/CD workflow job so a hung step gets killed instead of running to the runner's 6-hour default — build/test/lint jobs cap at 15–20 min, docker-build at 60, and deploy at 75.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 4b9b152, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every CI/CD workflow job so runs can no longer hang until the 6-hour org default — capping the Docker matrix build at 60 and the production deploy at 75, with most utility jobs at 10–15.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 6d557ec, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.


Graphify review — findings

Adds explicit timeout-minutes to every CI/CD workflow job so hung runs are killed rather than burning the full runner budget, with per-job limits scaled to the work (10 for label/notify/approve, 15–30 for build/test/deploy, 60 for Docker builds, 75 for production deploy). The truncated package.json changes (dependency, script, override, and prettier/type field updates) appear alongside but aren't shown in detail here.

Worth a look

  • test:shared script referenced in test:all but not defined — package.json · Escalate · medium
    • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 3e504e3, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every CI, deploy, release, and automation job so no run can hang past its budget (10–75 minutes depending on the job's weight, e.g. 60 for docker-build, 75 for production deploy, 30 for mutation and staging). The remaining changes are package metadata and dependency-pin churn in package.json (scripts, overrides, devDependencies) plus tooling config for eslint, stryker, and secretlint.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the GitHub Actions workflows so no run can hang indefinitely, with per-job limits scaled to expected duration (10 for lightweight notify/label/guard jobs, 60 for docker-build, 75 for the production deploy).

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit e0928e7, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, security, and automation workflows so no job can hang indefinitely and burn runner minutes — values are scaled per job (10 for lightweight scripting/label/notify jobs, 15–30 for build/test/mutation/security, 60 for Docker builds, and 75 for production deploy).

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit dfe8420, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, mutation, release, and utility workflows so a hung job is killed rather than running to the runner's default 6-hour cap — deploy jobs get the longest budgets (75 for deploy, 60 for docker-build) and lightweight notify/label jobs get 10. The truncated tail also touches package.json scripts, dependencies, and overrides, but the shown diff only covers the workflow timeout additions.

No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every CI/CD workflow job so runs can no longer hang until the default 6-hour ceiling — budgets range from 10 minutes for lightweight bot/label jobs up to 60 for Docker builds and 75 for production deploy. The package.json and dependency/override changes round out the diff (bumped tooling, script tweaks).

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit d2eacef, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, mutation, release, and PR-automation workflows, capping each at a per-job budget (10 for lightweight automation, 15–30 for build/test/scan jobs, 60 for Docker builds, 75 for production deploy) so a hung job fails instead of running until the runner's default limit.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the GitHub Actions workflows (10–75 minutes depending on the job's expected duration), so runs that hang no longer occupy runners until the default 6-hour cap.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 0999ba3, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml

@graphify-labs graphify-labs Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).


Graphify review — findings

Adds explicit timeout-minutes to every job across the CI, deploy, security, mutation, release, and PR-automation workflows, so a hung step now fails the job at its budget (ranging from 10 minutes for lightweight automation to 60–75 for Docker builds and production deploy) instead of running to the runner's default six-hour cap.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 223 functions depend on the 223 functions this change touches.

Health — this change adds coupling hotspots:

  • new: build-and-push — 0 callers, 7 callees

Verification — 223 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

  • verification_scope: 223 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below.

Comment thread .github/workflows/docker-publish.yml
@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

@LucasSantana-Dev

Copy link
Copy Markdown
Owner Author

Resolved the 16 identical graphify-labs threads: timeout-minutes adds no call edges to build-and-push; the bot re-posted the same finding on every update-branch push (see the issue filed for that).

@LucasSantana-Dev
LucasSantana-Dev merged commit dacd6c3 into main Sep 4, 2026
48 of 49 checks passed
@LucasSantana-Dev
LucasSantana-Dev deleted the ci/incident-regex-timeouts-root-jest branch September 4, 2026 19:48
LucasSantana-Dev added a commit that referenced this pull request Sep 4, 2026
## Root cause

The lockfile guard in `dangerfile.ts` was already keyed on dependency
fields via `danger.git.JSONDiffForFile`. The false positive on #2178
came from its catch-all: in `danger ci` that call diffs with local git,
and the reusable workflow checks out with `fetch-depth: 50`, so on a
heavily rebased PR the base commit is missing, the call throws, and the
catch set `depFieldChanged = true`. Reproduced the other way round:
`danger pr` (API-backed diff) on #2178 passes with the unchanged file.

The issue text said the Dangerfile lives in the org repo; it lives here.
Org PR LucasSantana-Dev/.github#16 only added a comment to the workflow
and needs no follow-up.

## Change

- On a local diff failure, read base and head `package.json` through
`danger.github.utils.fileContents` and compare the same `DEP_FIELDS`.
- Only if that also fails, `warn` and skip that file instead of failing.

## Verification (local `danger pr`, API path forced by making the local
diff throw)

| PR | change | result |
|---|---|---|
| #2178 | `scripts` only | passes |
| #2196 | `overrides` changed, lockfile untouched | fails with the
lockfile message |

Closes #2182

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes #2182: the lockfile guard in `dangerfile.ts` no longer fails on
scripts-only edits when the local diff is unavailable. Previously, any
local diff failure was treated as a dependency change; now the guard
re-reads base and head `package.json` via the API and compares the same
dependency fields. Only if that API check also fails does it warn and
skip the file instead of failing.

<sup>Written for commit 7db8844.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/LucasSantana-Dev/Lucky/pull/2202?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci dependencies Pull requests that update a dependency file size/m

Projects

None yet

1 participant