Repository navigation
fix(ci): agents.yml sets timeout-minutes on a reusable-workflow caller job — workflow fails at startup, and check:workflows cannot see it #1481
Description
fix(ci): agents.yml sets timeout-minutes on a reusable-workflow caller job — workflow fails at startup, and check:workflows cannot see it
Evidence (verified on main eeebf4143d, 2026-11-02)
.github/workflows/agents.yml:44-46 — the repo's only job-level reusable-workflow call now carries a key GitHub does not allow on a caller job:
jobs:
scheduled:
uses: developing-today/code/.github/workflows/pm-scheduled.yml@main
timeout-minutes: 60Added by commit fb06892c2d ("ci: add job timeouts to agents.yml", PR #1480, merged as eeebf4143d minutes before this filing).
GitHub's reusable-workflow reference is explicit about the caller job's allowed keywords: "When you call a reusable workflow, you can only use the following keywords in the job containing the call: jobs.<job_id>.name, uses, with, secrets, strategy, needs, if, concurrency, permissions, cache-mode" (docs.github.com, "Reusing workflow configurations"). timeout-minutes is not among them — a caller job has no steps of its own, so there is nothing for it to time out; the called workflow owns its jobs' timeouts.
Observed behavior since the change:
- Actions run
41566885724(push, headeeebf4143d,.github/workflows/agents.yml): conclusion failure, and the run's jobs list is empty — the workflow never started a job.gh run viewreports: "This run likely failed because of a workflow file issue." - The scheduled agent dispatches this workflow exists for (bolt / palette / suggestions slots, per the file's own header) therefore do not run at all on this revision.
The repo's own gate cannot catch this class:
bun run check:workflowson the same main exits 0 ("All 29 workflows … follow the workflow policies").script/check-workflows.ts(workflowViolations) skips caller jobs entirely:if ("uses" in job) continue. Its header even documents why the exemption exists — "the caller cannot settimeout-minuteson such a job" — but the gate only exempts caller jobs from the timeout requirement; it never flags a forbidden key placed on one. test.yml runs this gate on every push to main, so CI is green on a workflow file GitHub rejects at startup.agents.ymlis the only workflow in the repo with a job-leveluses:(grep over.github/workflows/*.yml), so today this blind spot has exactly one live instance — this one.
Related: #1406 (the workflow-policy gate this extends), #970 (prior startup-failure class in this repo's workflows), #61 / #1326 / #1184 (the timeout-minutes convention that motivated the change — it applies to jobs with steps, not to caller jobs).
Why it matters
A well-intentioned timeout sweep silently disabled the repo's scheduled-agent dispatcher: the workflow fails validation before any job exists, so there is no failing job to alert on — the runs just read "failure" with an empty jobs list. And the policy gate built in #1406 to keep workflow files valid-by-construction is blind to exactly the key-placement error that caused it, so the same mistake can recur in any future caller workflow.
Acceptance criteria
-
.github/workflows/agents.yml: thescheduledcaller job no longer setstimeout-minutes(or any other key outside GitHub's caller-job allowlist); if a dispatch timeout is wanted, it is set on the jobs inside the called workflow (developing-today/codepm-scheduled.yml), not here. - A
workflow_dispatch(or push) run ofagents.ymlon the fixed revision starts jobs instead of failing at startup with an empty jobs list. -
script/check-workflows.tsflags non-allowlisted keys on reusable-workflow caller jobs (at minimumtimeout-minutes,runs-on,steps,env,defaults), with coverage inscript/check-workflows.test.ts; the gate fails on the pre-fixagents.ymland passes on the fixed tree. -
bun run check:workflowspasses on the fixed tree, and no other workflow's caller jobs (if any appear) regress.
Activity
dezren39 commentedon Nov 3, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 3, 2026
Main-CI watch (fleet): reusing this issue for the newest main-branch failure of
.github/workflows/agents.ymlinstead of filing a duplicate.Filed by main-ci-failure-fix-trigger (fleet). One fix track per failing workflow; duplicates are suppressed until this issue closes.
dezren39 commentedon Nov 3, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 3, 2026
Progress update (queue task 6729): verified run 41566885724 is the cited main push run for
agents.yml, concludedfailurewith zero jobs; the worktree is clean at the failing headeeebf4143d6c227d3d5ecd728e94e8cbf1b33a6f. I’m extending the workflow policy checker and tests, and removing the unsupported caller-job timeout. The called workflow lives indeveloping-today/code; I will not change its internals here. The queue checkpoint helper is not at the documented~/tools/repo-queue.pypath, so I’m locating it.dezren39 commentedon Nov 3, 2026
🤖 Agent note · dispatched
~/git/fleet/6729-1481-ci-agents, branchqueue/6729-1481-ci-agents(from origin/main eeebf41, the failing run's head).github/workflows/agents.yml— run https://github.com/developing-today/opencode/actions/runs/41566885724 (this issue's packet, enqueued by new-issue-creator as task 6729, was claimed by this trigger and dispatched; the trigger's own enqueue deduped to task 6729 — no duplicate task).github/workflows/agents.ymlandscript/check-workflows.ts/ its tests.dezren39 commentedon Nov 3, 2026
Progress update (queue task 6729):
check:workflowsnow fails against the originalagents.ymlwith a specificreusable-workflow-caller-keysviolation forscheduled.timeout-minutes, demonstrating the previous blind spot is closed. Removed that caller key; the focused test file passes (18 tests) andbun run check:workflowspasses across all 29 workflows. Added cases fortimeout-minutes,runs-on,steps,env, anddefaults, plus an allowlisted-caller case. The task helper was present at/home/user/hatch/tools/repo-queue.pyrather than~/tools/repo-queue.py; I’m checkpointing there, then will review, commit, push, and open a PR without merging.dezren39 commentedon Nov 3, 2026
Update: PR #1482 is open at #1482 (base
main, branchqueue/6729-1481-ci-agents). The workflow timeout key is removed and the reusable-caller allowlist check plus tests are included. It is not merged; I’m parking task 6729 with the PR link while CI/review and the post-merge main run remain outstanding.