fix(ci): cap every job at 30m and name hanging tests (refs #303)

.github/workflows/codelens-benchmark.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   benchmark:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python

.github/workflows/codelens-ci.yml

@@ -16,6 +16,7 @@ jobs:
   test:
     name: Test Suite
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository
@@ -37,20 +38,26 @@ jobs:
           # and causes a native use-after-free SIGSEGV in tree_sitter_python._binding
           # even on shallow files (issue #235). python_parser.py's keep_alive
           # mitigation is insufficient for 0.26; 0.25.x is known-safe.
-          pip install "tree-sitter>=0.21.0,<0.26" pyyaml pytest pytest-cov pygls lsprotocol
+          # pytest-timeout: names the hanging test instead of letting the job
+          # burn the 6h ceiling in silence (issue #303).
+          pip install "tree-sitter>=0.21.0,<0.26" pyyaml pytest pytest-cov pytest-timeout pygls lsprotocol
           # Install optional grammar packages for full parser coverage
           pip install tree-sitter-python tree-sitter-javascript tree-sitter-html tree-sitter-css || true
           pip install tree-sitter-typescript tree-sitter-rust || true
 
       - name: Run test suite
         run: |
+          # --timeout: the whole suite runs in ~160s locally, so any single
+          # test past 120s is stuck, not slow. `thread` method dumps its stack.
           cd scripts && python -m pytest ../tests/ -v --tb=short \
+            --timeout=120 --timeout-method=thread \
             --ignore=../tests/test_integration.py
 
   # ─── Benchmark ─────────────────────────────────────────────────
   benchmark:
     name: Quick Benchmark
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: test
 
     steps:
@@ -81,6 +88,7 @@ jobs:
   self-check:
     name: CodeLens Self-Check
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: test
 
     steps:
@@ -125,6 +133,7 @@ jobs:
   upload-sarif:
     name: Upload SARIF to Code Scanning
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: self-check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 

.github/workflows/codelens-quality-gate.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   quality-gate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       matrix:
         python-version: ['3.9', '3.10', '3.11', '3.12']
@@ -47,6 +48,7 @@ jobs:
 
   benchmark:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: quality-gate
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 

.github/workflows/codelens-sarif.yml

@@ -16,6 +16,7 @@ jobs:
   sarif:
     name: Generate SARIF for Code Scanning
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository

.github/workflows/design-doc-check.yml

@@ -32,6 +32,7 @@ jobs:
   check:
     name: Design Doc Required
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository

.github/workflows/docker-publish.yml

@@ -49,6 +49,7 @@ jobs:
   build-and-push:
     name: Build & Push ${{ matrix.variant }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: github.repository == 'Wolfvin/CodeLens'
     strategy:
       fail-fast: false

.github/workflows/publish-pypi.yml

@@ -18,6 +18,7 @@ jobs:
   build:
     name: Build sdist + wheel
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository
@@ -56,6 +57,7 @@ jobs:
   publish-pypi:
     name: Publish to PyPI
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     environment: pypi  # Requires manual approval for first-time publishes
 
@@ -75,6 +77,7 @@ jobs:
   publish-testpypi:
     name: Publish to TestPyPI (on manual trigger)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     if: github.event_name == 'workflow_dispatch'
     environment: testpypi

.github/workflows/refresh-vuln-db.yml

@@ -32,6 +32,7 @@ permissions:
 jobs:
   refresh-vuln-db:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     # Only run on the main repo (not forks). Schedule triggers on forks
     # are disabled by GitHub anyway, but this guards workflow_dispatch.
     if: github.repository == 'Wolfvin/CodeLens'