improvement(ci): timeouts, docs-only PR skip, fork-isolated caches, Node pin; remove i18n workflow

[waleedlatif1]

Follow-up hardening from a full CI audit (all 9 workflows reviewed + run-history analysis).

Changes

1. timeout-minutes on every runnable job (was: none anywhere). Hung jobs previously ran to GitHub's 6-hour default — not theoretical: the i18n workflow burned three consecutive full 6-hour runs in February before its schedule was pulled (~18h of runner time). Bounds chosen from observed worst cases plus margin: 5m trivial jobs, 10m promote/manifests/release, 15m lint/test/build/migrate/publish, 30m docker matrices (ARM app build runs ~13m).

2. Docs-only PRs skip CI. paths-ignore on the pull_request trigger for apps/docs/content/** and **/*.md. Push runs stay unfiltered — they feed the deploy pipeline. Safe: no ruleset pins required checks.

3. Fork-PR cache isolation. Sticky-disk keys are now scoped by github.event_name, so pull_request runs (which include fork PRs on this public repo) never write to the disks that push runs — and therefore production image builds — read from. This closes a cache-poisoning path that standard branch protections don't cover, since Blacksmith disks are shared per key across the org. Cost: PR and push caches warm independently (one cold run each after merge).

4. node-version: 22 in test-build and docs-embeddings (was latest — a new Node major could silently change build behavior; publish workflows were already pinned).

5. Delete i18n.yml. Schedule was already removed after the repeated 6-hour hangs; it's been workflow_dispatch-only with stale "weekly run" comments since. Restorable from history if auto-translation returns.

Audit notes (no action needed)

The audit found the security fundamentals already strong: all actions SHA-pinned, no pull_request_target, untrusted input handled via env:/JS (never shell-interpolated), AWS via OIDC, least-privilege top-level permissions. Deliberately skipped: Vitest sharding (suite too fast to pay for it), merge queue (squash-to-staging flow doesn't need it), Turbo remote cache (sticky disks already provide shared caching).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 16, 2026 8:36pm

[cursor]

PR Summary

Medium Risk
Fork cache isolation and deploy-adjacent CI behavior affect supply-chain trust for image builds; changes are workflow-only with no app runtime impact, but a mis-scoped sticky key could cause extra cold runs or missed isolation.

Overview
Follow-up CI hardening across the workflow set: every runnable job now has timeout-minutes so hung work cannot burn the default 6-hour limit.

Pull requests that only touch apps/docs/content/** or **/*.md no longer trigger CI; push runs stay unfiltered so deploy pipelines still run on docs commits.

In test-build, Blacksmith sticky-disk keys are scoped by github.event_name and a -fork suffix for fork PRs so untrusted PR runs cannot poison caches used by push/production image builds. Node is pinned to 22 in test-build and docs-embeddings (replacing latest).

The i18n.yml workflow is deleted (it was already manual-only after schedule removal).

Companion, migrations, publish, and other workflows receive matching timeout additions only.

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

[greptile-apps]

Greptile Summary

This PR hardens the repository's CI workflows. The main changes are:

• Adds explicit timeouts to runnable jobs.
• Skips application CI for documentation-only pull requests.
• Separates sticky-disk caches for push, internal PR, and fork PR runs.
• Pins Node.js 22 in build and embeddings workflows.
• Removes the dormant i18n workflow.

Confidence Score: 5/5

This looks safe to merge.

• The migration job now allows its 30-minute lock wait plus setup and execution time.
• Fork PR caches are separate from internal PR and push caches.
• No blocking issues remain in the reviewed changes.

Important Files Changed

Filename	Overview
.github/workflows/migrations.yml	Raises the migration timeout to 45 minutes so the configured advisory-lock wait can complete.
.github/workflows/test-build.yml	Pins Node.js 22, adds job timeouts, and isolates sticky-disk caches by event and fork status.
.github/workflows/ci.yml	Adds docs-only PR filtering and explicit timeouts across build, promotion, manifest, and release jobs.
.github/workflows/docs-embeddings.yml	Pins Node.js 22 and adds a 30-minute job timeout.
.github/workflows/i18n.yml	Removes the inactive manual translation workflow.

_{Reviews (4): Last reviewed commit: "improvement(ci): 45m migrate timeout (co..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1748c25. Configure here.}