mirror of
https://github.com/yeasy/docker_practice.git
synced 2026-08-10 16:37:34 +00:00
yeasy
52f6c73478
A wedged Chrome/mdPress step held a harness runner for 27 minutes yesterday
(normal run: ~4 min) and ignored `gh run cancel`; it only stopped because that
job happened to carry timeout-minutes: 30. An audit found 66 of the 101 jobs
across the cluster had no timeout at all — the same hang there would have held
a runner for GitHub's 6-hour default.
Values come from measured run history, not guesses. Across ~120 successful
runs the slowest workflow tops out at 10 min (Update Preview Publications),
CI at 6.5, Update Preview PDF at 4.8:
30 min — jobs that run Chrome/mdPress/pandoc (3x the observed max, and the
value harness already used)
15 min — release, publish, deploy, check-link, chaincode-tests
10 min — dependabot auto-merge
Every value has at least 6x headroom over its job's observed maximum, so this
should never turn a slow-but-working run into a failure.
Verified: all 72 workflow files still parse, and all 101 jobs now carry an
integer timeout in range.
52 lines
2.1 KiB
Go
52 lines
2.1 KiB
Go
name: Dependabot auto-merge
|
|
on: pull_request
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
dependabot:
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
checks: read
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
if: github.actor == 'dependabot[bot]'
|
|
steps:
|
|
- name: Dependabot metadata
|
|
id: metadata
|
|
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
|
|
with:
|
|
github-token: "${{ secrets.GITHUB_TOKEN }}"
|
|
|
|
- name: Confirm required checks are configured
|
|
if: >
|
|
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
|
|
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
|
|
run: |
|
|
REQUIRED=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${{ github.event.pull_request.base.ref }}/protection/required_status_checks" --jq '((.contexts // []) | length) + ((.checks // []) | length)' 2>/dev/null || echo 0)
|
|
if [ "$REQUIRED" -eq 0 ]; then
|
|
echo "No required status checks configured on the base branch; refusing Dependabot auto-merge."
|
|
exit 1
|
|
fi
|
|
env:
|
|
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
|
|
|
|
- name: Approve low-risk Dependabot PR
|
|
if: >
|
|
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
|
|
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
|
|
run: gh pr review --approve "$PR_URL"
|
|
env:
|
|
PR_URL: ${{github.event.pull_request.html_url}}
|
|
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
|
|
|
|
- name: Enable auto-merge for low-risk Dependabot PRs
|
|
if: >
|
|
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
|
|
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
|
|
run: gh pr merge --auto --merge "$PR_URL"
|
|
env:
|
|
PR_URL: ${{github.event.pull_request.html_url}}
|
|
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
|