[ashsolei]

Varför

Detta repo är en fork av NVIDIA/OpenShell. Schemalagda workflows (cron) från upstream körs därför i onödan i vår fork – de förbrukar Actions-minuter, köar mot runners som inte finns hos oss och skapar brus.

Ändring

• Varje jobb i workflows med schedule:-trigger får villkoret if: github.event_name != 'schedule' || github.repository_owner == 'NVIDIA'. Befintliga if: behålls och kombineras med && inom parentes.
• timeout-minutes läggs till på jobb som saknade det (befintliga rimliga värden behålls). Jobb som anropar reusable workflows (uses:) kan inte ha timeout-minutes på anroparnivå.
• Manuella körningar (workflow_dispatch), push/PR och workflow_call påverkas inte. Inget annat är ändrat.

Workflow	Jobb med guard	timeout-minutes	Upstream-ägare
Cargo Deny (scheduled) (cargo-deny.yml)	cargo-deny	30 (ny)	NVIDIA
CodeQL (codeql.yml)	analyze, result	90 (befintlig) / 10 (ny)	NVIDIA
Release Auto-Tag (release-auto-tag.yml)	create-tag	5 (befintlig)	NVIDIA
Mark stale issues and pull requests (stale.yml)	stale-issues, stale-pull-requests	15 / 15 (nya)	NVIDIA
Workflow Security Reports (workflow-security.yml)	actionlint, zizmor	15 / 15 (nya)	NVIDIA

Validering

• Alla ändrade filer parsas med python3 yaml.safe_load; ett skript verifierade att endast if/timeout-minutes ändrats per jobb.
• actionlint fanns inte installerat lokalt och kördes inte.

Obs: CI kan stå i kö eller fördröjas på grund av den pågående GitHub Actions-incidenten (githubstatus.com, sedan 2026-10-19 15:49 UTC). Inga körningar har avbrutits.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Scheduled maintenance, release tagging, security analysis, and quality-check workflows now run only in NVIDIA-owned repositories. These workflows remain eligible to run for non-scheduled events.
  • Execution time limits are now set for several automated checks and maintenance tasks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 33eed4f1-509f-4f09-9349-898c7fe7cb3a

📥 Commits

Reviewing files that changed from the base of the PR and between 7b36112 and 8e4d307.

📒 Files selected for processing: 5

• .github/workflows/cargo-deny.yml
• .github/workflows/codeql.yml
• .github/workflows/release-auto-tag.yml
• .github/workflows/stale.yml
• .github/workflows/workflow-security.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Five GitHub Actions workflows now restrict scheduled jobs to the NVIDIA-owned repository. The changes also add job timeouts and update the CodeQL result job condition.

Changes: Workflow eligibility and timeouts

Layer / File(s)	Summary
Scheduled job conditions and timeouts .github/workflows/cargo-deny.yml, .github/workflows/release-auto-tag.yml, .github/workflows/stale.yml, .github/workflows/workflow-security.yml, .github/workflows/codeql.yml	Jobs in these workflows now run on scheduled events only when the repository owner is NVIDIA. The changed jobs have timeouts. The CodeQL result job retains always() evaluation for eligible events.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: derekwaynecarr, alangou

Merge Risk: ⚪ Minimal · up to 8e4d3

The workflow changes preserve the intended event eligibility, and no concrete merge-blocking behavior is indicated.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the two main changes: skipping scheduled upstream jobs in forks and adding job timeouts.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ashsolei]

Separat granskning (agent)

Bedömning: godkänd

Granskat: diff och fullständiga workflow-filer på PR-huvudet (YAML parsas). Upstream-ägaren NVIDIA är verifierad.

Kontrollerat OK

• codeql.yml: result blir (guard) && (always()). always() finns kvar, så resultatjobbet körs även när analyze faller.
• cargo-deny, codeql och workflow-security är också workflow_call-mål. Anroparkedjan security-scan → release-qualification → release-tag/release-prerelease triggas bara av push och dispatch. Guarden på schedule påverkar därför inte release-kvalificeringen.
• timeout-minutes ligger bara på vanliga jobb. Inga uses:-jobb har ändrats.
• Inget annat har ändrats.

OBS

• Guarden på result är redundant, eftersom analyze redan skippas på schedule i forken. Den är ofarlig.

🤖 Generated with Claude Code