Skip to content

ci: add permissions, concurrency controls, and timeouts across workflows - #15

Open
Ayushmore1214 wants to merge 5 commits into
masterfrom
fix/workflow-permissions-concurrency-timeouts
Open

ci: add permissions, concurrency controls, and timeouts across workflows#15
Ayushmore1214 wants to merge 5 commits into
masterfrom
fix/workflow-permissions-concurrency-timeouts

Conversation

@Ayushmore1214

Copy link
Copy Markdown
Owner

Permissions:

  • codeql-analysis: add security-events: write (required for SARIF upload) and contents: read, actions: read
  • stale: add issues: write, pull-requests: write
  • cherry_pick: add contents: write, pull-requests: write
  • release: add contents: write, pull-requests: write
  • prerelease: add contents: write
  • build, gen, test: lock down to contents: read

Concurrency:

  • build: add group cancel-on-PR pattern (matches lint/test)
  • gen: add group cancel-on-PR pattern

Timeouts:

  • build: 30m for go/plugin/web, 15m for chart
  • test integration: 60m
  • codeql analyze: 120m
  • gen: 15m
  • publish_image_chart artifacts: 60m
  • cherry_pick, release: 15m
  • stale, prerelease: 10m
  • first-time-contributor, thank-you: 5m

Runner consistency:

  • first-time-contributor, thank-you: ubuntu-latest -> ubuntu-24.04
  • thank-you: pin actions/checkout to SHA v4.2.2

What this PR does:

Why we need it:

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?:

  • How are users affected by this change:
  • Is this breaking change:
  • How to migrate (if breaking change):

Ayushmore1214 and others added 5 commits June 5, 2026 22:30
Updated the condition for the thank-you job to check for true explicitly and added a reference to the base SHA when checking out the repository.

Signed-off-by: Ayush More <ayushmore42595@gmail.com>
Signed-off-by: Ayush More <ayushmore42595@gmail.com>
Update README to reflect documentation change
Signed-off-by: Ayush More <ayushmore42595@gmail.com>
Permissions:
- codeql-analysis: add security-events: write (required for SARIF upload)
  and contents: read, actions: read
- stale: add issues: write, pull-requests: write
- cherry_pick: add contents: write, pull-requests: write
- release: add contents: write, pull-requests: write
- prerelease: add contents: write
- build, gen, test: lock down to contents: read

Concurrency:
- build: add group cancel-on-PR pattern (matches lint/test)
- gen: add group cancel-on-PR pattern

Timeouts:
- build: 30m for go/plugin/web, 15m for chart
- test integration: 60m
- codeql analyze: 120m
- gen: 15m
- publish_image_chart artifacts: 60m
- cherry_pick, release: 15m
- stale, prerelease: 10m
- first-time-contributor, thank-you: 5m

Runner consistency:
- first-time-contributor, thank-you: ubuntu-latest -> ubuntu-24.04
- thank-you: pin actions/checkout to SHA v4.2.2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant