ci: bound the publish job so a hang cannot spend the month - #4
Merged
Conversation
The publish job inherits the 360-minute default timeout and is the only job in this organization that spends GitHub Actions minutes: it must stay on ubuntu-latest because npm provenance only accepts OIDC tokens from a cloud-hosted runner, so Blacksmith is not an option here. One hung run would therefore take 18% of the 2,000-minute monthly allowance, and concurrency sets cancel-in-progress: false, so a later tag does not stop it. Every npm step is a network call that can hang. Seven runs to date took 30 seconds to 1m22s, so 15 minutes is ten times the worst observed. The preflight job gets 5 minutes on the same reasoning: it bills no GitHub minutes on Blacksmith, but a runaway is still wasteful and slow to notice. The organization hit 100% of its August 2026 allowance, which is what prompted the audit this came out of. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AeC9A41jR2f57fJ3yUnWoD
masterleopold
force-pushed
the
ci/publish-timeout
branch
from
August 28, 2026 22:38
836068f to
3a899ad
Compare
masterleopold
added a commit
that referenced
this pull request
Aug 28, 2026
The organization used 100% of its 2,000 Actions minutes in August 2026 and every other macOS/Windows/Linux job moved to Blacksmith. This one cannot: npm provenance only accepts an OIDC token from a cloud-hosted runner, which makes it the last job in the org spending GitHub minutes. Written down so the next sweep does not try the move and break publishing to save a Linux minute. The 15-minute timeout added in #4 is recorded with it, and so is the consequence for a $0 Actions budget: it would block releases. Claude-Session: https://claude.ai/code/session_01AeC9A41jR2f57fJ3yUnWoD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sdk-publish.ymlhad notimeout-minuteson either job, so both inherit the 360-minute default.That matters for
publishspecifically, because it is now the only job in the organization that spends GitHub Actions minutes. It has to stay onubuntu-latest: npm provenance only accepts OIDC tokens issued by a cloud-hosted runner (npm docs), so the Blacksmith move that every other macOS/Windows/Linux job in the org has taken is not available here. The file's existing comment already said so; this change takes it at its word rather than trying to move the job.The exposure: one hung run burns 360 billed minutes, 18% of the 2,000-minute monthly allowance, and
concurrencysetscancel-in-progress: false, so a later tag will not stop it. Every step in the job is annpm view/npm publishnetwork call that can hang.Measured from the seven runs to date, the job takes 30 seconds to 1m22s. 15 minutes is ten times the worst observed.
preflightgets 5 minutes on the same reasoning. It runs on Blacksmith and bills no GitHub minutes, but a runaway there is still wasteful and slow to notice, and the job is one environment comparison measured at 3 to 5 seconds.Context: the organization used 100% of its August 2026 allowance. macOS was 84% of it (171 wall-clock minutes billed as 1,710), and the last hosted macOS job was moved to Blacksmith in anagrammer#3. This is the remaining hole, not from what a job spends but from what a stuck one could.
actionlintreports the same five findings before and after this change (the Blacksmith custom label, and four pre-existing SC2015 notes on the publish steps).🤖 Generated with Claude Code
https://claude.ai/code/session_01AeC9A41jR2f57fJ3yUnWoD