Cap semgrep scan and triage job runtimes - #20
Open
Sayan- wants to merge 1 commit into
Open
Conversation
Without timeout-minutes these jobs get GitHub's 6-hour default, so a degraded run holds a runner and blocks the calling PR's checks for hours. Scan medians ~2 minutes with a worst observed successful run of 18; triage typically finishes in ~2. A killed run reruns cheaply. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sayan-
marked this pull request as ready for review
September 14, 2026 00:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scan and triage jobs have no timeout-minutes, so they inherit GitHub's 6-hour default. On Sep 11 a scan on kernel/kernel ran 18 minutes against a ~2 minute median (the same file set scanned in 40s, 167s and 533s on other runs that day, so the slowness is runner-side variance, not content). A wedged run today would hold a hosted runner and block the calling PR's checks for up to 6 hours.
This caps scan at 20 minutes (just above the worst observed successful run) and triage at 15 (typical runs finish in ~2). A run killed by the cap reruns cheaply and usually lands on a healthier runner.
Note
Low Risk
CI-only workflow metadata with no application, auth, or data-path changes; worst case is a timed-out check that reruns.
Overview
Adds job-level timeouts to the reusable Semgrep workflow so stuck runs cannot hold hosted runners and PR checks for GitHub’s default 6-hour limit.
The
scanjob is capped at 20 minutes andtriageat 15 minutes, chosen above observed successful runtimes while still failing fast on wedged or severely degraded runners. Any repo that calls thisworkflow_callworkflow inherits the new limits; behavior on normal runs is unchanged until a job exceeds the cap, when GitHub cancels it and a rerun typically completes on a fresh runner.Reviewed by Cursor Bugbot for commit 23924f2. Bugbot is set up for automated code reviews on this repo. Configure here.