Current score → target
CI health: coverage 3/5 → 5/5 (hygiene layer).
Defect class prevented
(a) Hung jobs burning runners and blocking merges for up to 6 hours (GitHub's default timeout-minutes is 360); (b) required-check misconfiguration — you cannot unambiguously require a check whose name is shared by two workflows.
Evidence
- 8 jobs have no
timeout-minutes: tests.yml, E2Etests.yml, psalm.yml, infection.yml, phpinsights.yml, deptrac.yml, symfony.yml, openapi-diff.yml (bats/schemathesis/load/memory have them).
psalm.yml and phpinsights.yml both declare name: code quality — two workflows, one display name.graphql-diff.yml:18: the job's display name is "Openapi-diff" (wrong workflow).- Filename typo:
tempate-sync-pat.yml → template-sync-pat.yml.
Proposed fix
- Add
timeout-minutes sized ~2× observed p95 runtime to the 8 jobs (e.g. tests 20, E2E 30, infection 45, psalm 15, phpinsights 15, deptrac 10, symfony 15, openapi-diff 15).
- Rename:
psalm.yml → name: psalm, phpinsights.yml → name: phpinsights; fix the graphql-diff job label; fix the filename typo.
Effort
S
Sequencing
Land before the branch-ruleset issue — the required-check list needs unambiguous names.
Acceptance criteria
Filed by an automated CI/CD verification-coverage audit (OpenSSF Scorecard baseline: aggregate 6.0/10, local mode — SAST 0, Fuzzing 0, Token-Permissions 0, Pinned-Dependencies 5, Vulnerabilities 4). Audit method: inventory → gap analysis → git-history evidence mining → 3-iteration adversarial critique loop.
Generated by Claude Code
Current score → target
CI health: coverage 3/5 → 5/5 (hygiene layer).
Defect class prevented
(a) Hung jobs burning runners and blocking merges for up to 6 hours (GitHub's default
timeout-minutesis 360); (b) required-check misconfiguration — you cannot unambiguously require a check whose name is shared by two workflows.Evidence
timeout-minutes: tests.yml, E2Etests.yml, psalm.yml, infection.yml, phpinsights.yml, deptrac.yml, symfony.yml, openapi-diff.yml (bats/schemathesis/load/memory have them).psalm.ymlandphpinsights.ymlboth declarename: code quality— two workflows, one display name.graphql-diff.yml:18: the job's display name is "Openapi-diff" (wrong workflow).tempate-sync-pat.yml→template-sync-pat.yml.Proposed fix
timeout-minutessized ~2× observed p95 runtime to the 8 jobs (e.g. tests 20, E2E 30, infection 45, psalm 15, phpinsights 15, deptrac 10, symfony 15, openapi-diff 15).psalm.yml→name: psalm,phpinsights.yml→name: phpinsights; fix the graphql-diff job label; fix the filename typo.Effort
S
Sequencing
Land before the branch-ruleset issue — the required-check list needs unambiguous names.
Acceptance criteria
sleep infinitystep is killed at the configured timeout instead of 360 minFiled by an automated CI/CD verification-coverage audit (OpenSSF Scorecard baseline: aggregate 6.0/10, local mode — SAST 0, Fuzzing 0, Token-Permissions 0, Pinned-Dependencies 5, Vulnerabilities 4). Audit method: inventory → gap analysis → git-history evidence mining → 3-iteration adversarial critique loop.
Generated by Claude Code