From 5af89111608bba77c0e4f4b3481ef4480c60307d Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Sun, 16 Aug 2026 09:23:04 +0000
Subject: [PATCH] ci: add timeout-minutes to release jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Adds `timeout-minutes` guards to all 6 jobs in `.github/workflows/release.yml`. None of these jobs previously had a timeout, so a hung build/publish step could consume the full 6-hour GitHub Actions job cap before being killed. Each value is set with headroom above observed run durations.

## Runs inspected

Inspected recent **Release** workflow runs (workflow_dispatch / release triggered) via `gh run list` / `gh run view`. Observed job durations: the longest job (`build-desktop`, macOS signing) ran ~19m20s; the remaining jobs ran well under 10 minutes. No job exceeded ~20 minutes, so the chosen values provide ample headroom.

## Problem

`release.yml` defines 6 jobs (`build-cli`, `build-desktop`, `deploy-update-metadata`, `build-flatpak`, `publish-homebrew`, `prerelease`) with no `timeout-minutes` set. A stuck step (e.g. a hung macOS notarization, a stalled `git push`, a wedged flatpak build) would run until GitHub's default 360-minute job limit, wasting release CI minutes and delaying the release pipeline.

## Change

Added `timeout-minutes` to each job (placed immediately after `runs-on:`, matching the convention already established in the repo's other workflows):

| Job | timeout-minutes | Rationale |
|-----|-----------------|-----------|
| `build-cli` | 45 | matrix over linux/macos/windows; go build + cross-compile |
| `build-desktop` | 45 | electron-builder + macOS signing/notarization (slowest observed) |
| `deploy-update-metadata` | 15 | metadata deploy + git push |
| `build-flatpak` | 30 | flatpak build in privileged container |
| `publish-homebrew` | 15 | formula/cask publish |
| `prerelease` | 5 | release notes publish only |

No behavioral change beyond the timeout guard; no new dependencies; no trigger/path changes.

## Validation

- Re-read `release.yml` end-to-end to confirm each `timeout-minutes` is placed directly after `runs-on:` and indentation matches surrounding keys.
- `python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))"` → **YAML OK**
- `act --list -W .github/workflows/release.yml` → enumerates all 6 jobs correctly (act/docker available).
- Formatting gate: `task cli:format` clean; `task cli:lint:ci` → 0 issues; `task cli:test` → pass (only the known pre-existing `pkg/git` `TestRepoClone*` failure on origin/main, unrelated to this YAML-only change — git-lfs absent in sandbox).

This PR was created by an AI agent as part of an automated daily CI optimization job.
---
 .github/workflows/release.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0117e8a40..63f887cbf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,7 @@ jobs:
           - runner: macos-latest
           - runner: windows-latest
     runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -80,6 +81,7 @@ jobs:
             go-arch: amd64
             builder-args: --win
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -278,6 +280,7 @@ jobs:
     name: Deploy Electron Update Metadata
     needs: [build-desktop]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:
@@ -337,6 +340,7 @@ jobs:
     name: Build Flatpak
     runs-on: ubuntu-latest
     needs: [build-desktop]
+    timeout-minutes: 30
     permissions:
       contents: write
     container:
@@ -383,6 +387,7 @@ jobs:
     needs: [build-desktop]
     if: ${{ !github.event.release.prerelease }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:
@@ -470,6 +475,7 @@ jobs:
       contents: write
     if: github.event.release.prerelease
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with: