From 05a45ddb896eb16e67d77a0e9f2d7c01a918305e Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Sat, 29 Aug 2026 04:42:52 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20small-lane=20batch=20=E2=80=94=20tim?=
 =?UTF-8?q?eouts,=20right-sizing,=20windows=20cache=20warm-start?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- timeout-minutes on the 6 remaining unbounded jobs (actionlint 5,
  skill-docs 10, version-gate 10, make-pdf-gate 15, pr-title-sync 5,
  evals build-image 15) — a hung step sat on GitHub's 360-min default
- right-size measured-over-long timeouts: dependency-review 10→5,
  windows-setup-e2e 15→10
- dependency-review: 2-core runner (28s API call on an 8-core box) and
  drop .github/workflows/** from its trigger paths (workflow edits have
  no dependencies to review)
- windows caches gain restore-keys: a lockfile bump paid the 26s/43s
  restore for a guaranteed cold miss

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/actionlint.yml         | 1 +
 .github/workflows/dependency-review.yml  | 5 ++---
 .github/workflows/evals.yml              | 1 +
 .github/workflows/make-pdf-gate.yml      | 1 +
 .github/workflows/pr-title-sync.yml      | 1 +
 .github/workflows/skill-docs.yml         | 1 +
 .github/workflows/version-gate.yml       | 1 +
 .github/workflows/windows-free-tests.yml | 4 ++++
 .github/workflows/windows-setup-e2e.yml  | 6 +++++-
 9 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index c3fd5ae47..d942f9b21 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -21,6 +21,7 @@ permissions:
 jobs:
   actionlint:
     runs-on: ubicloud-standard-2
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
         with:
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index b600ada81..ecfee9af5 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -7,7 +7,6 @@ on:
       - 'bun.lock'
       - '**/package.json'
       - '**/bun.lock'
-      - '.github/workflows/**'
 
 concurrency:
   group: dependency-review-${{ github.event.pull_request.number }}
@@ -18,8 +17,8 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubicloud-standard-8
-    timeout-minutes: 10
+    runs-on: ubicloud-standard-2
+    timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 40ad34811..c2639031d 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -22,6 +22,7 @@ jobs:
     # diff — a maintainer's next push rebuilds the image with real perms.
     if: github.actor != 'dependabot[bot]'
     runs-on: ubicloud-standard-8
+    timeout-minutes: 15
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/make-pdf-gate.yml b/.github/workflows/make-pdf-gate.yml
index eca26beab..e35f6d590 100644
--- a/.github/workflows/make-pdf-gate.yml
+++ b/.github/workflows/make-pdf-gate.yml
@@ -47,6 +47,7 @@ jobs:
         #     tolerant: true
 
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
 
diff --git a/.github/workflows/pr-title-sync.yml b/.github/workflows/pr-title-sync.yml
index 5a01ae275..62062a590 100644
--- a/.github/workflows/pr-title-sync.yml
+++ b/.github/workflows/pr-title-sync.yml
@@ -32,6 +32,7 @@ jobs:
   sync:
     name: Sync PR title to VERSION
     runs-on: ubicloud-standard-2
+    timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/skill-docs.yml b/.github/workflows/skill-docs.yml
index 721a5afdb..bdd3ec3b7 100644
--- a/.github/workflows/skill-docs.yml
+++ b/.github/workflows/skill-docs.yml
@@ -23,6 +23,7 @@ permissions:
 jobs:
   check-freshness:
     runs-on: ubicloud-standard-2
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/version-gate.yml b/.github/workflows/version-gate.yml
index 96f9185bd..3c8dcb1f6 100644
--- a/.github/workflows/version-gate.yml
+++ b/.github/workflows/version-gate.yml
@@ -15,6 +15,7 @@ jobs:
   check:
     name: Check VERSION is not stale vs queue
     runs-on: ubicloud-standard-2
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/windows-free-tests.yml b/.github/workflows/windows-free-tests.yml
index ab4cb9381..25170f364 100644
--- a/.github/workflows/windows-free-tests.yml
+++ b/.github/workflows/windows-free-tests.yml
@@ -56,6 +56,10 @@ jobs:
         with:
           path: ~/.bun/install/cache
           key: windows-bun-${{ hashFiles('bun.lock') }}
+          # A lockfile bump starts from the previous cache instead of cold
+          # (restore alone costs ~26s; without this a bump pays it for nothing).
+          restore-keys: |
+            windows-bun-
 
       - name: Configure git identity (required by tests that init temp repos)
         run: |
diff --git a/.github/workflows/windows-setup-e2e.yml b/.github/workflows/windows-setup-e2e.yml
index a9590b796..6eeac3b2e 100644
--- a/.github/workflows/windows-setup-e2e.yml
+++ b/.github/workflows/windows-setup-e2e.yml
@@ -38,7 +38,7 @@ permissions:
 jobs:
   windows-setup:
     runs-on: windows-latest
-    timeout-minutes: 15
+    timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@v7
@@ -53,6 +53,10 @@ jobs:
         with:
           path: ~/.bun/install/cache
           key: windows-bun-${{ hashFiles('bun.lock') }}
+          # A lockfile bump starts from the previous cache instead of cold
+          # (restore alone costs ~43s; without this a bump pays it for nothing).
+          restore-keys: |
+            windows-bun-
 
       - name: Configure git identity
         run: |