BEST-PRAC-2 — Job timeout not configured - Pipefort

Field	Value
Category	`BEST-PRAC-2`
Severity	LOW
Auto-fix	✓ (what it does)

What the check does

Flags any job that doesn’t declare timeout-minutes: at the job level.

Why it matters

GitHub Actions jobs default to a 6-hour timeout. A stuck step (hanging network call, infinite loop, runaway test) burns runner minutes — billed against your account on hosted runners, and tying up infra on self-hosted ones. Explicit per-job timeouts cap the blast radius.

Vulnerable example

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test

Safe alternative

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - run: npm test

Pick a duration that gives headroom over the 95th-percentile run time but doesn’t bleed runner minutes when something hangs.

Auto-fix

--fix adds timeout-minutes: 30 to each flagged job. That’s a conservative default — tighten it once you know typical runtimes.