improvement(ci): timeouts, docs-only PR skip, fork-isolated caches, Node pin; remove i18n workflow by waleedlatif1 · Pull Request #5714 · simstudioai/sim

waleedlatif1 · 2026-07-16T20:23:42Z

Follow-up hardening from a full CI audit (all 9 workflows reviewed + run-history analysis).

Changes

1. timeout-minutes on every runnable job (was: none anywhere). Hung jobs previously ran to GitHub's 6-hour default — not theoretical: the i18n workflow burned three consecutive full 6-hour runs in February before its schedule was pulled (~18h of runner time). Bounds chosen from observed worst cases plus margin: 5m trivial jobs, 10m promote/manifests/release, 15m lint/test/build/migrate/publish, 30m docker matrices (ARM app build runs ~13m).

2. Docs-only PRs skip CI.paths-ignore on the pull_request trigger for apps/docs/content/** and **/*.md. Push runs stay unfiltered — they feed the deploy pipeline. Safe: no ruleset pins required checks.

3. Fork-PR cache isolation. Sticky-disk keys are now scoped by github.event_name, so pull_request runs (which include fork PRs on this public repo) never write to the disks that push runs — and therefore production image builds — read from. This closes a cache-poisoning path that standard branch protections don't cover, since Blacksmith disks are shared per key across the org. Cost: PR and push caches warm independently (one cold run each after merge).

4. node-version: 22 in test-build and docs-embeddings (was latest — a new Node major could silently change build behavior; publish workflows were already pinned).

5. Delete i18n.yml. Schedule was already removed after the repeated 6-hour hangs; it's been workflow_dispatch-only with stale "weekly run" comments since. Restorable from history if auto-translation returns.

Audit notes (no action needed)

The audit found the security fundamentals already strong: all actions SHA-pinned, no pull_request_target, untrusted input handled via env:/JS (never shell-interpolated), AWS via OIDC, least-privilege top-level permissions. Deliberately skipped: Vitest sharding (suite too fast to pay for it), merge queue (squash-to-staging flow doesn't need it), Turbo remote cache (sticky disks already provide shared caching).

…oped sticky disks, Node pin; drop dead i18n workflow - timeout-minutes on every runnable job (defaults ran hung jobs to the 6-hour cap — the i18n workflow burned three full 6-hour runs in Feb before its schedule was pulled) - paths-ignore on the pull_request trigger: docs content and markdown don't affect the app build or images; push runs stay unfiltered - sticky-disk keys scoped by event name so fork PR runs never share a disk with the push runs that feed production image builds - node-version pinned to 22 (was 'latest', non-deterministic) - delete i18n.yml: schedule already removed after repeated 6-hour hangs, workflow_dispatch-only since, comments stale

vercel · 2026-07-16T20:23:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 16, 2026 8:36pm

cursor · 2026-07-16T20:23:54Z

PR Summary

Medium Risk
Fork cache isolation and deploy-adjacent CI behavior affect supply-chain trust for image builds; changes are workflow-only with no app runtime impact, but a mis-scoped sticky key could cause extra cold runs or missed isolation.

Overview
Follow-up CI hardening across the workflow set: every runnable job now has timeout-minutes so hung work cannot burn the default 6-hour limit.

Pull requests that only touch apps/docs/content/** or **/*.md no longer trigger CI; push runs stay unfiltered so deploy pipelines still run on docs commits.

In test-build, Blacksmith sticky-disk keys are scoped by github.event_name and a -fork suffix for fork PRs so untrusted PR runs cannot poison caches used by push/production image builds. Node is pinned to 22 in test-build and docs-embeddings (replacing latest).

The i18n.yml workflow is deleted (it was already manual-only after schedule removal).

Companion, migrations, publish, and other workflows receive matching timeout additions only.

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

greptile-apps · 2026-07-16T20:26:55Z

Greptile Summary

This PR hardens the repository's CI workflows. The main changes are:

Adds explicit timeouts to runnable jobs.
Skips application CI for documentation-only pull requests.
Separates sticky-disk caches for push, internal PR, and fork PR runs.
Pins Node.js 22 in build and embeddings workflows.
Removes the dormant i18n workflow.

Confidence Score: 5/5

This looks safe to merge.

The migration job now allows its 30-minute lock wait plus setup and execution time.
Fork PR caches are separate from internal PR and push caches.
No blocking issues remain in the reviewed changes.

Important Files Changed

Filename	Overview
.github/workflows/migrations.yml	Raises the migration timeout to 45 minutes so the configured advisory-lock wait can complete.
.github/workflows/test-build.yml	Pins Node.js 22, adds job timeouts, and isolates sticky-disk caches by event and fork status.
.github/workflows/ci.yml	Adds docs-only PR filtering and explicit timeouts across build, promotion, manifest, and release jobs.
.github/workflows/docs-embeddings.yml	Pins Node.js 22 and adds a 30-minute job timeout.
.github/workflows/i18n.yml	Removes the inactive manual translation workflow.

_{Reviews (4): Last reviewed commit: "improvement(ci): 45m migrate timeout (co..." | Re-trigger Greptile}

…espaced PR sticky disks - migrate.ts waits up to 30 minutes for the migration advisory lock (LOCK_ACQUIRE_DEADLINE_MS); the 15m job timeout would preempt that designed wait, so the bound is 45m - fork PRs now get their own sticky-disk namespace so an untrusted fork run can't poison the disks that trusted internal-PR runs restore

waleedlatif1 · 2026-07-16T20:30:39Z

@greptile

waleedlatif1 · 2026-07-16T20:30:40Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

waleedlatif1 · 2026-07-16T20:37:12Z

@greptile

waleedlatif1 · 2026-07-16T20:37:13Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

waleedlatif1 · 2026-07-16T20:47:21Z

@greptile

waleedlatif1 · 2026-07-16T20:47:22Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

greptile-appsBot reviewed Jul 16, 2026
View reviewed changes

Comment thread.github/workflows/docs-embeddings.yml
Comment thread.github/workflows/ci.yml
Comment thread.github/workflows/ci.yml
Comment thread.github/workflows/migrations.yml Outdated
Comment thread.github/workflows/test-build.yml Outdated

vercelBotdeployed to Preview July 16, 2026 20:28 View deployment

cursorBot reviewed Jul 16, 2026
View reviewed changes

waleedlatif1 merged commit 2f9144e into stagingJul 16, 2026
19 of 20 checks passed

waleedlatif1 deleted the improvement/ci-hardening-timeouts branch July 16, 2026 20:35

waleedlatif1 mentioned this pull request Jul 16, 2026
v0.7.38: mothership improvements, clickup, rocketlane integrations, gitlab tools, deployment state machine #5712
Merged

vercelBotdeployed to Preview July 16, 2026 20:36 View deployment

cursorBot reviewed Jul 16, 2026
View reviewed changes

Uh oh!

Conversation

waleedlatif1 commented Jul 16, 2026

Changes

Audit notes (no action needed)

Uh oh!

vercelBot commented Jul 16, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursorBot commented Jul 16, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-appsBot commented Jul 16, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

waleedlatif1 commented Jul 16, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercelBot commented Jul 16, 2026•
edited
Loading

cursorBot commented Jul 16, 2026•
edited
Loading

greptile-appsBot commented Jul 16, 2026•
edited
Loading