Add timout-minutes to Github Actions workflows (mlflow#14101) (mlflow…

…#14121)

Signed-off-by: Leah Korol <[email protected]>
Signed-off-by: harupy <[email protected]>
Co-authored-by: harupy <[email protected]>

.github/policy.rego

@@ -35,10 +35,24 @@ deny_unnecessary_github_token[msg] {
     msg := "Unnecessary use of github-token for actions/github-script."
 }
 
+deny_jobs_without_timeout[msg] {
+    jobs_without_timeout := get_jobs_without_timeout(input.jobs)
+    count(jobs_without_timeout) > 0
+    msg := sprintf("The following jobs are missing timeout-minutes: %s",
+        [concat(", ", jobs_without_timeout)])
+}
+
 ###########################   RULE HELPERS   ##################################
 get_jobs_without_permissions(jobs) = jobs_without_permissions {
     jobs_without_permissions := { job_id |
         job := jobs[job_id]
         not job["permissions"]
     }
 }
+
+get_jobs_without_timeout(jobs) = jobs_without_timeout {
+    jobs_without_timeout := { job_id |
+        job := jobs[job_id]
+        not job["timeout-minutes"]
+    }
+}

.github/workflows/devcontainer.yml

@@ -100,6 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: devcontainer
     if: github.event_name == 'push'
+    timeout-minutes: 60
     permissions:
       packages: write # to push to ghcr.io
     steps:

.github/workflows/js.yml

@@ -26,6 +26,7 @@ jobs:
   js:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     permissions: {}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.github/workflows/maintainer-approval.yml

@@ -6,6 +6,7 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       pull-requests: read
     steps:

.github/workflows/recipe-template.yml

@@ -87,6 +87,7 @@ jobs:
           cd ${{ github.event.inputs.repository }} && pytest tests --rootdir .
   recipe-windows:
     runs-on: windows-latest
+    timeout-minutes: 120
     permissions: {}
     steps:
       - uses: actions/checkout@v4

.github/workflows/recipe.yml

@@ -54,6 +54,7 @@ jobs:
   recipes-windows:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: windows-latest
+    timeout-minutes: 120
     permissions: {}
     strategy:
       fail-fast: false

.github/workflows/team-review.yml

@@ -8,6 +8,7 @@ jobs:
   review:
     runs-on: ubuntu-latest
     if: ${{ github.event.requested_reviewer.login == 'mlflow-automation'}}
+    timeout-minutes: 5
     permissions:
       pull-requests: write
     steps: