CI Timeouts

.devcontainer/devcontainer.json

@@ -21,11 +21,11 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.15.2",
+        "coderabbit.coderabbit-vscode@0.16.0",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
-        "github.copilot-chat@0.33.2025102701",
+        "github.copilot-chat@0.34.2025112401",
         // Python
         "ms-python.python@2025.13.2025090201",
         "ms-python.vscode-pylance@2025.7.102",
@@ -61,5 +61,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 43411b4a # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 876c1d76 # spellchecker:disable-line
 }

.devcontainer/install-ci-tooling.py

@@ -5,10 +5,10 @@
 import subprocess
 import sys
 
-UV_VERSION = "0.9.7"
-COPIER_VERSION = "9.10.3"
+UV_VERSION = "0.9.11"
+COPIER_VERSION = "9.11.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "0.3.3"
-PRE_COMMIT_VERSION = "4.3.0"
+PRE_COMMIT_VERSION = "4.5.0"
 GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"
 parser = argparse.ArgumentParser(description="Install CI tooling for the repo")
 _ = parser.add_argument(

.github/workflows/ci.yaml

@@ -22,6 +22,7 @@ jobs:
         python-version:
             - 3.12.7
     name: Pre-commit for Py${{ matrix.python-version }} on ${{ matrix.os }}
+    timeout-minutes: 8
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v5.0.0
@@ -75,6 +76,7 @@ jobs:
           '--data-file tests/copier_data/data2.yaml',
           ]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 8
     env:
       UV_PYTHON: ${{ matrix.python-version }}
     permissions:
@@ -155,6 +157,7 @@ jobs:
 
   required-check:
     runs-on: ubuntu-24.04
+    timeout-minutes: 2
     needs: [ lint-matrix ]
     if: always()
     permissions: {}

.github/workflows/tag-on-merge.yaml

@@ -10,6 +10,7 @@ jobs:
   create-tag:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-24.04
+    timeout-minutes: 2
     permissions:
       contents: write
     steps:

extensions/context.py

@@ -11,29 +11,29 @@ class ContextUpdater(ContextHook):
     @override
     def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         # These are duplicated in the install-ci-tooling.py script in this repository
-        context["uv_version"] = "0.9.7"
-        context["pre_commit_version"] = "4.3.0"
+        context["uv_version"] = "0.9.11"
+        context["pre_commit_version"] = "4.5.0"
         # These also in pyproject.toml
-        context["copier_version"] = "9.10.3"
+        context["copier_version"] = "9.11.0"
         context["copier_template_extensions_version"] = "0.3.3"
         #######
-        context["pnpm_version"] = "10.21.0"
+        context["pnpm_version"] = "10.23.0"
         # These are duplicated in the pyproject.toml of this repository
         context["pyright_version"] = "1.1.407"
-        context["pytest_version"] = "9.0.0"
+        context["pytest_version"] = "9.0.1"
         context["pytest_randomly_version"] = "4.0.1"
         context["pytest_cov_version"] = "7.0.0"
         #######
         context["sphinx_version"] = "8.1.3"
-        context["pulumi_version"] = "3.206.0"
-        context["pulumi_aws_version"] = "7.11.0"
+        context["pulumi_version"] = "3.208.0"
+        context["pulumi_aws_version"] = "7.12.0"
         context["pulumi_aws_native_version"] = "1.38.0"
         context["pulumi_command_version"] = "1.1.3"
         context["pulumi_github_version"] = "6.8.0"
         context["pulumi_okta_version"] = "6.1.0"
-        context["boto3_version"] = "1.40.57"
+        context["boto3_version"] = "1.41.2"
         context["ephemeral_pulumi_deploy_version"] = "0.0.5"
-        context["pydantic_version"] = "2.12.3"
+        context["pydantic_version"] = "2.12.4"
         context["pyinstaller_version"] = "6.16.0"
         context["setuptools_version"] = "80.7.1"
         context["strawberry_graphql_version"] = "0.284.1"
@@ -102,6 +102,10 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["gha_pypi_publish"] = "v1.13.0"
         context["gha_sleep"] = "v2.0.3"
         context["gha_windows_runner"] = "windows-2025"
+        context["gha_short_timeout_minutes"] = "2"
+        context["gha_medium_timeout_minutes"] = "8"
+        context["gha_long_timeout_minutes"] = "15"
+        context["gha_xlong_timeout_minutes"] = "45"
         #######
         context["debian_release_name"] = "bookworm"
         context["alpine_image_version"] = "3.22"

pyproject.toml

@@ -5,10 +5,10 @@ description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12.7"
 dependencies = [
-    "pytest>=9.0.0",
+    "pytest>=9.0.1",
     "pytest-cov>=7.0.0",
     "pytest-randomly>=4.0.1",
     "pyright[nodejs]>=1.1.407",
-    "copier>=9.10.2",
+    "copier>=9.11.0",
     "copier-template-extensions>=0.3.3"
 ]

template/.devcontainer/devcontainer.json.jinja-base

@@ -27,11 +27,11 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.15.2",
+        "coderabbit.coderabbit-vscode@0.16.0",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
-        "github.copilot-chat@0.33.2025102701",{% endraw %}{% if install_claude_cli %}{% raw %}
+        "github.copilot-chat@0.34.2025112401",{% endraw %}{% if install_claude_cli %}{% raw %}
         "anthropic.claude-code@2.0.27",{% endraw %}{% endif %}{% raw %}
 
         // Python

template/.github/reusable_workflows/build-docker-image.yaml.jinja-base

@@ -43,6 +43,7 @@ permissions:
 jobs:
   build-image:
     name: Build Docker Image
+    timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %}
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
     outputs:
       artifact-name: ${{ steps.calculate-build-context-hash.outputs.image_name_no_slashes }}
@@ -94,7 +95,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-${{ inputs.repository }}-${{ inputs.image_name }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Test if docker image exists
         if: ${{ inputs.push-role-name != 'no-push' }}

template/.github/workflows/ci.yaml.jinja-base

@@ -43,6 +43,7 @@ jobs:
           '--data-file tests/copier_data/data2.yaml',
           ]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
     env:
       UV_PYTHON: ${{ matrix.python-version }}
     permissions:
@@ -105,7 +106,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-venv-${{ matrix.os }}-${{ matrix.python-version }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Cache Pre-commit hooks
         uses: actions/cache@{% endraw %}{{ gha_cache }}{% raw %}
@@ -131,6 +132,7 @@ jobs:
 
   required-check:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_short_timeout_minutes }}{% raw %}
     needs: [ lint-matrix, get-values ]
     permissions:
       statuses: write # needed for updating status on Dependabot PRs

template/.github/workflows/get-values.yaml.jinja-base

@@ -19,6 +19,7 @@ permissions:
 jobs:
   get-values:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_short_timeout_minutes }}{% raw %}
     outputs:
       new-dependabot-sha: ${{ steps.update-hash.outputs.new-sha }}
       dependabot-commit-created: ${{ steps.update-hash.outputs.commit-created }}

template/.github/workflows/pre-commit.yaml.jinja-base

@@ -28,6 +28,7 @@ permissions:
 jobs:
   pre-commit:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
     name: Pre-commit
     steps:
       - name: Checkout code during push
@@ -55,7 +56,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-venv-{% endraw %}{{ gha_linux_runner }}{% raw %}-py${{ inputs.python-version }}-nodejs-${{ inputs.node-version }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Cache Pre-commit hooks
         uses: actions/cache@{% endraw %}{{ gha_cache }}{% raw %}

template/extensions/context.py.jinja-base

@@ -95,6 +95,10 @@ class ContextUpdater(ContextHook):
         context["gha_sleep"] = "{{ gha_sleep }}"
         context["gha_linux_runner"] = "{{ gha_linux_runner }}"
         context["gha_windows_runner"] = "{{ gha_windows_runner }}"
+        context["gha_short_timeout_minutes"] = "{{ gha_short_timeout_minutes }}"
+        context["gha_medium_timeout_minutes"] = "{{ gha_medium_timeout_minutes }}"
+        context["gha_long_timeout_minutes"] = "{{ gha_long_timeout_minutes }}"
+        context["gha_xlong_timeout_minutes"] = "{{ gha_xlong_timeout_minutes }}"
 
         context["py312_version"] = "{{ py312_version }}"
         context["py313_version"] = "{{ py313_version }}"

template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base

@@ -93,6 +93,7 @@ permissions:
 jobs:
   pulumi:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_xlong_timeout_minutes }}{% raw %}
     env:
       IAC_GITHUB_API_TOKENS: ${{ secrets.iac-github-api-tokens }} # only used in non-enterprise situations when not using full fledged Secrets Manager
     steps:
@@ -110,7 +111,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-pulumi-${{ inputs.PULUMI_STACK_NAME }}-${{ inputs.ADDITIONAL_MUTEX_SUFFIX }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Pulumi Initial Destroy to cleanup any leftovers
         uses: ./.github/actions/pulumi_ephemeral_deploy