Skip to content

ci: add timeout-minutes to the cloud jobs and explain the branch input #1298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
plum117 merged 1 commit into from
Oct 9, 2026
Merged

ci: add timeout-minutes to the cloud jobs and explain the branch input #1298

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ jobs:
ci-pr-desktop-web:
name: 🔄 💻 CI PR Run Desktop Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 2-3 minutes. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 20
# Needs the cloud credentials, which GitHub does not give to pull requests from forks or from Dependabot.
# The intent is to also run this job on the Dependabot updates that can change the desktop e2e results.
# This needs the Dependabot secrets LAMBDATEST_USERNAME and LAMBDATEST_ACCESS_KEY, which only a repository
Expand Down Expand Up @@ -82,6 +84,8 @@ jobs:
ci-pr-android-web:
name: 🔄 🤖 🌐 CI PR Run Android Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
# Needs the cloud credentials, which GitHub does not give to pull requests from forks or from Dependabot
if: |
github.actor != 'dependabot[bot]' &&
Expand Down Expand Up @@ -133,6 +137,8 @@ jobs:
ci-pr-ios-web:
name: 🔄 🍏 🌐 CI PR Run iOS Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
# Needs the cloud credentials, which GitHub does not give to pull requests from forks or from Dependabot
if: |
github.actor != 'dependabot[bot]' &&
Expand Down Expand Up @@ -184,6 +190,8 @@ jobs:
ci-pr-app:
name: 🔄 📱 CI PR Run Mobile App Tests on Sauce
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
# Needs the cloud credentials, which GitHub does not give to pull requests from forks or from Dependabot
if: |
github.actor != 'dependabot[bot]' &&
Expand Down Expand Up @@ -235,6 +243,8 @@ jobs:
ci-pr-ocr:
name: 🔄 📱 CI PR Run OCR Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 2-3 minutes. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 20
# Needs the cloud credentials, which GitHub does not give to pull requests from forks or from Dependabot
if: |
github.actor != 'dependabot[bot]' &&
Expand Down
14 changes: 13 additions & 1 deletion .github/workflows/scheduled-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
workflow_dispatch:
inputs:
branch:
description: "Branch to run tests against"
description: "Branch of this repository, or refs/pull/<number>/head for a PR from a fork (only after reviewing that commit: the run gets the cloud credentials)"

@greptile-apps greptile-apps Bot Oct 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Reviewed code can change

The new instructions recommend refs/pull/<number>/head, but that ref can change after review. If the contributor pushes again before a job checks out the code, the job can run an unreviewed commit with cloud credentials. Recommend entering the reviewed commit SHA instead of the moving PR ref.

How this was verified: Each scheduled job checks out inputs.branch and then runs that checkout’s test commands with LambdaTest or Sauce credentials.

Suggested change
description: "Branch of this repository, or refs/pull/<number>/head for a PR from a fork (only after reviewing that commit: the run gets the cloud credentials)"
description: "Branch of this repository, or the full reviewed commit SHA for a PR from a fork (not refs/pull/<number>/head, which can change: the run gets the cloud credentials)"

type: string
required: true
default: "main"
Expand All @@ -18,6 +18,8 @@ jobs:
schedule-gate:
name: 🗓️ Schedule Gate
runs-on: ubuntu-latest
# A few seconds. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 5
if: github.event_name == 'schedule'
outputs:
enabled: ${{ steps.check.outputs.enabled }}
Expand All @@ -44,6 +46,8 @@ jobs:
scheduled-desktop-web:
name: 🗓️ 💻 Scheduled Desktop Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 2-3 minutes. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 20
needs: [schedule-gate]
if: >-
always() && (
Expand Down Expand Up @@ -101,6 +105,8 @@ jobs:
scheduled-android-web:
name: 🗓️ 🤖 🌐 Scheduled Android Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
needs: [schedule-gate]
if: >-
always() && (
Expand Down Expand Up @@ -158,6 +164,8 @@ jobs:
scheduled-ios-web:
name: 🗓️ 🍏 🌐 Scheduled iOS Web Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
needs: [schedule-gate]
if: >-
always() && (
Expand Down Expand Up @@ -215,6 +223,8 @@ jobs:
scheduled-app:
name: 🗓️ 📱 Scheduled Mobile App Tests on Sauce
runs-on: ubuntu-latest
# Usually 5-17 minutes; failing checks with retries can take 30+. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 45
needs: [schedule-gate]
if: >-
always() && (
Expand Down Expand Up @@ -272,6 +282,8 @@ jobs:
scheduled-ocr:
name: 🗓️ 🔎 Scheduled OCR Tests on LambdaTest
runs-on: ubuntu-latest
# Usually 2-3 minutes. Without a limit, a hung job runs until the GitHub default of 6 hours
timeout-minutes: 20
needs: [schedule-gate]
if: >-
always() && (
Expand Down
Loading