[Copilot]

ubuntu-slim supports job timeouts of at most 15 minutes. This change checks literal timeouts at compile time and switches default framework runners to ubuntu-latest when more time is needed.

• Runner selection: Upgrade only compiler-default runners; preserve explicit overrides.
• Validation: Reject explicit ubuntu-slim jobs exceeding 15 minutes with an actionable error. Ignore runner and timeout expressions.
• Compiler output: Apply checks after job augmentation; update documentation, golden fixtures, and generated workflow locks.

For example, this configuration selects ubuntu-latest for the safe-output job:

safe-outputs:
  timeout-minutes: 30
  add-comment:

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Commit pushed: a5f403a

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · ~11 AIC · ⌖ ~16 AIC · ◇ ~5 AIC · ⊞ 12.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~9 AIC · ⌖ ~6 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #72131

[pelikhan]

@copilot include comment in .lock.yml explaining why latest is used when this code pattern is activated.

[github-actions]

Review: no blocking findings

The changed runner-timeout handling is internally consistent with the documented behavior and the added tests cover the main literal, explicit-override, and expression cases. The specialist pass was unavailable because its file-read invocation was rejected; this review is based on the pre-fetched diff and targeted source inspection.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review to run again}

[github-actions]

🏗️ Design Decision Gate — ADR Required

This PR adds more than 100 new lines of core business logic (263 lines in pkg/, including the new compiler pass pkg/workflow/runner_timeouts.go), but it does not link an Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/72131-enforce-ubuntu-slim-timeout-limit-at-compile-time.md. Please review and complete it before merging.

🔒 This PR cannot merge until an ADR is linked in the PR body.

Decision captured in the draft: a compiler pass runs after job augmentation and checks each job against the 15-minute ubuntu-slim timeout limit. It switches compiler-default framework runners to ubuntu-latest, keeps explicit runner overrides, and fails compilation when a user explicitly chooses ubuntu-slim with a longer timeout. The pass skips expression-valued runners and timeouts, and reusable-workflow jobs.

📋 What to do next

1. Review the draft ADR committed to your branch. It was generated from the PR description and pkg/workflow/runner_timeouts.go.
2. Complete the missing sections. Add context the AI could not infer, refine the reasoning, and confirm the alternatives listed: rejecting all over-limit cases, silently capping the timeout, and making ubuntu-latest the default everywhere. Also fill in the [TODO: verify] Deciders field.
3. Commit the finalized ADR to docs/adr/ on your branch.
4. Reference the ADR in this PR body by adding a line such as:

   ADR: ADR-72131: Enforce the ubuntu-slim Timeout Limit at Compile Time and Upgrade Default Runners

Once the ADR is linked in the PR body, this gate will run again and check that the code matches the decision.

❓ Why ADRs Matter

ADRs keep a searchable, permanent record of why the codebase looks the way it does. Future contributors, including you, will thank you.

📋 Michael Nygard ADR Format Reference

A complete ADR has these four sections:

• Context: What is the problem? What forces are at play?
• Decision: What did you decide, and why?
• Alternatives Considered: What else could have been done?
• Consequences: What are the trade-offs, positive and negative?

ADRs are stored in docs/adr/ and numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus55 · ~25 AIC · ⌖ ~42 AIC · ⊞ 1.9K · ◷
_{Comment /review to run again}

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

2 open issues

• Avoid failing explicit slim runners with default safe-outputs timeout · New
• Diagnose the applicable runner field for framework jobs · New

What changed in this PR

This PR adds runner-aware timeout validation to gh-aw’s compiler, upgrading compiler-default framework runners when a literal job timeout exceeds ubuntu-slim’s 15-minute limit.

Changes:

• Resolve runner/timeout compatibility after job augmentation while preserving explicit runner selections.
• Add unit and compilation coverage for timeout boundaries, runner forms, and expressions.
• Update reference documentation, WASM golden fixtures, and generated workflow locks.

An isolated check confirmed the reported self-hosted-label false positive. Project tests, workflow compilation, and security scanners were not run.

File	Description
pkg/​workflow/​testdata/​TestWasmGolden_CompileFixtures/​with-imports.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_CompileFixtures/​smoke-copilot.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_CompileFixtures/​playwright-cli-mode.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_CompileFixtures/​basic-copilot.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_AllEngines/​pi.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_AllEngines/​gemini.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_AllEngines/​copilot.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_AllEngines/​codex.golden	Updated as part of this pull request.
pkg/​workflow/​testdata/​TestWasmGolden_AllEngines/​claude.golden	Updated as part of this pull request.
pkg/​workflow/​runner_timeouts.go	Updated as part of this pull request.
pkg/​workflow/​runner_timeouts_test.go	Updated as part of this pull request.
pkg/​workflow/​compiler_yaml.go	Updated as part of this pull request.
docs/​src/​content/​docs/​reference/​frontmatter.md	Updated as part of this pull request.
.github/​workflows/​workflow-skill-extractor.lock.yml	Updated as part of this pull request.
.github/​workflows/​workflow-normalizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​workflow-health-manager.lock.yml	Updated as part of this pull request.
.github/​workflows/​workflow-generator.lock.yml	Updated as part of this pull request.
.github/​workflows/​windows.lock.yml	Updated as part of this pull request.
.github/​workflows/​windows-grower.lock.yml	Updated as part of this pull request.
.github/​workflows/​weekly-safe-outputs-spec-review.lock.yml	Updated as part of this pull request.
.github/​workflows/​weekly-network-domains-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​weekly-issue-summary.lock.yml	Updated as part of this pull request.
.github/​workflows/​weekly-editors-health-check.lock.yml	Updated as part of this pull request.
.github/​workflows/​weekly-blog-post-writer.lock.yml	Updated as part of this pull request.
.github/​workflows/​video-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​update-astro.lock.yml	Updated as part of this pull request.
.github/​workflows/​unbloat-docs.lock.yml	Updated as part of this pull request.
.github/​workflows/​uk-ai-operational-resilience.lock.yml	Updated as part of this pull request.
.github/​workflows/​ubuntu-image-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​typist.lock.yml	Updated as part of this pull request.
.github/​workflows/​tidy.lock.yml	Updated as part of this pull request.
.github/​workflows/​test-quality-sentinel.lock.yml	Updated as part of this pull request.
.github/​workflows/​terminal-stylist.lock.yml	Updated as part of this pull request.
.github/​workflows/​technical-doc-writer.lock.yml	Updated as part of this pull request.
.github/​workflows/​super-linter.lock.yml	Updated as part of this pull request.
.github/​workflows/​sub-issue-closer.lock.yml	Updated as part of this pull request.
.github/​workflows/​step-name-alignment.lock.yml	Updated as part of this pull request.
.github/​workflows/​static-analysis-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​stale-repo-identifier.lock.yml	Updated as part of this pull request.
.github/​workflows/​stale-pr-cleanup.lock.yml	Updated as part of this pull request.
.github/​workflows/​squad.lock.yml	Updated as part of this pull request.
.github/​workflows/​squad-plan.lock.yml	Updated as part of this pull request.
.github/​workflows/​squad-implement-worker.lock.yml	Updated as part of this pull request.
.github/​workflows/​squad-game-planner.lock.yml	Updated as part of this pull request.
.github/​workflows/​spec-librarian.lock.yml	Updated as part of this pull request.
.github/​workflows/​spec-extractor.lock.yml	Updated as part of this pull request.
.github/​workflows/​spec-enforcer.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-workflow-call.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-workflow-call-with-inputs.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-work-queue.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-work-queue-worker.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-work-queue-dispatcher.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-update-cross-repo-pr.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-test-tools.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-temporary-id.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-service-ports.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-security-alerts.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-repo-memory-ledger.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pydantic.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-project.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pi.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pi-sub-agents.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pi-routed.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pi-routed-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-pi-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-otel-backends.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-opencode.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-multi-pr.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-kiro.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-issues.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-goose.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-github-codex.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-github-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-gemini.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-drive.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-deepseek-harness.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-cursor.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-crush.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-create-cross-repo-pr.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-sub-agents.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-small.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-sdk.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-sdk-routed.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-sdk-routed-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-routed.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-routed-steering.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-routed-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-mai.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-dynamic-workflow.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-arm.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-aoai-entra.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-copilot-aoai-apikey.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-codex.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-codex-bare-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-codex-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-sub-agents.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-routed.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-on-copilot.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-dynamic.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-copilot.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-copilot-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-claude-auto.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-ci.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-checkout-pr-dispatch.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-call-workflow.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-builtin-ledgers.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-azure-pi.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-azure-codex.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-aider.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-agent-scoped-approved.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-agent-public-none.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-agent-public-approved.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-agent-all-none.lock.yml	Updated as part of this pull request.
.github/​workflows/​smoke-agent-all-merged.lock.yml	Updated as part of this pull request.
.github/​workflows/​slide-deck-maintainer.lock.yml	Updated as part of this pull request.
.github/​workflows/​skillet.lock.yml	Updated as part of this pull request.
.github/​workflows/​sighthound-security-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​sergo.lock.yml	Updated as part of this pull request.
.github/​workflows/​semantic-function-refactor.lock.yml	Updated as part of this pull request.
.github/​workflows/​security-review.lock.yml	Updated as part of this pull request.
.github/​workflows/​security-compliance.lock.yml	Updated as part of this pull request.
.github/​workflows/​scout.lock.yml	Updated as part of this pull request.
.github/​workflows/​schema-feature-coverage.lock.yml	Updated as part of this pull request.
.github/​workflows/​schema-consistency-checker.lock.yml	Updated as part of this pull request.
.github/​workflows/​safe-output-health.lock.yml	Updated as part of this pull request.
.github/​workflows/​research.lock.yml	Updated as part of this pull request.
.github/​workflows/​repository-quality-improver.lock.yml	Updated as part of this pull request.
.github/​workflows/​repo-tree-map.lock.yml	Updated as part of this pull request.
.github/​workflows/​repo-audit-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​release.lock.yml	Updated as part of this pull request.
.github/​workflows/​refiner.lock.yml	Updated as part of this pull request.
.github/​workflows/​refactoring-cadence.lock.yml	Updated as part of this pull request.
.github/​workflows/​q.lock.yml	Updated as part of this pull request.
.github/​workflows/​python-data-charts.lock.yml	Updated as part of this pull request.
.github/​workflows/​purelock.lock.yml	Updated as part of this pull request.
.github/​workflows/​prompt-clustering-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​pr-triage-agent.lock.yml	Updated as part of this pull request.
.github/​workflows/​pr-sous-chef.lock.yml	Updated as part of this pull request.
.github/​workflows/​pr-nitpick-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​pr-description-caveman.lock.yml	Updated as part of this pull request.
.github/​workflows/​pr-code-quality-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​portfolio-analyst.lock.yml	Updated as part of this pull request.
.github/​workflows/​ponytail-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​poem-bot.lock.yml	Updated as part of this pull request.
.github/​workflows/​plan.lock.yml	Updated as part of this pull request.
.github/​workflows/​pdf-summary.lock.yml	Updated as part of this pull request.
.github/​workflows/​org-health-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​objective-impact-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​notion-issue-summary.lock.yml	Updated as part of this pull request.
.github/​workflows/​necromancer.lock.yml	Updated as part of this pull request.
.github/​workflows/​metrics-collector.lock.yml	Updated as part of this pull request.
.github/​workflows/​mergefest.lock.yml	Updated as part of this pull request.
.github/​workflows/​mcp-inspector.lock.yml	Updated as part of this pull request.
.github/​workflows/​mattpocock-skills-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​lockfile-stats.lock.yml	Updated as part of this pull request.
.github/​workflows/​linter-miner.lock.yml	Updated as part of this pull request.
.github/​workflows/​lint-monster.lock.yml	Updated as part of this pull request.
.github/​workflows/​layout-spec-maintainer.lock.yml	Updated as part of this pull request.
.github/​workflows/​jsweep.lock.yml	Updated as part of this pull request.
.github/​workflows/​issue-triage-agent.lock.yml	Updated as part of this pull request.
.github/​workflows/​issue-monster.lock.yml	Updated as part of this pull request.
.github/​workflows/​issue-arborist.lock.yml	Updated as part of this pull request.
.github/​workflows/​instructions-janitor.lock.yml	Updated as part of this pull request.
.github/​workflows/​impeccable-skills-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​hourly-ci-cleaner.lock.yml	Updated as part of this pull request.
.github/​workflows/​hippo-embed.lock.yml	Updated as part of this pull request.
.github/​workflows/​grumpy-reviewer.lock.yml	Updated as part of this pull request.
.github/​workflows/​gpclean.lock.yml	Updated as part of this pull request.
.github/​workflows/​go-pattern-detector.lock.yml	Updated as part of this pull request.
.github/​workflows/​go-logger.lock.yml	Updated as part of this pull request.
.github/​workflows/​go-fan.lock.yml	Updated as part of this pull request.
.github/​workflows/​glossary-maintainer.lock.yml	Updated as part of this pull request.
.github/​workflows/​github-remote-mcp-auth-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​github-mcp-tools-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​github-mcp-structural-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​functional-pragmatist.lock.yml	Updated as part of this pull request.
.github/​workflows/​front-page-copy-guard.lock.yml	Updated as part of this pull request.
.github/​workflows/​firewall.lock.yml	Updated as part of this pull request.
.github/​workflows/​firewall-escape.lock.yml	Updated as part of this pull request.
.github/​workflows/​feature-grower.lock.yml	Updated as part of this pull request.
.github/​workflows/​example-workflow-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​example-permissions-warning.lock.yml	Updated as part of this pull request.
.github/​workflows/​example-failure-category-filter.lock.yml	Updated as part of this pull request.
.github/​workflows/​evoskill-evolver.lock.yml	Updated as part of this pull request.
.github/​workflows/​eslint-refiner.lock.yml	Updated as part of this pull request.
.github/​workflows/​eslint-monster.lock.yml	Updated as part of this pull request.
.github/​workflows/​eslint-miner.lock.yml	Updated as part of this pull request.
.github/​workflows/​eslint-factory-dispatcher.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-pydantic-ai.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-pi.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-opencode.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-kiro.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-goose.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-gemini.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-dispatcher.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-deepseek-harness.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-cursor.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-crush.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-copilot.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-codex.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-claude.lock.yml	Updated as part of this pull request.
.github/​workflows/​engine-conformance-aider.lock.yml	Updated as part of this pull request.
.github/​workflows/​duplicate-code-detector.lock.yml	Updated as part of this pull request.
.github/​workflows/​draft-pr-cleanup.lock.yml	Updated as part of this pull request.
.github/​workflows/​docs-noob-tester.lock.yml	Updated as part of this pull request.
.github/​workflows/​dictation-prompt.lock.yml	Updated as part of this pull request.
.github/​workflows/​developer-docs-consolidator.lock.yml	Updated as part of this pull request.
.github/​workflows/​dev.lock.yml	Updated as part of this pull request.
.github/​workflows/​dev-hawk.lock.yml	Updated as part of this pull request.
.github/​workflows/​detection-analysis-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​designer-drift-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​design-decision-gate.lock.yml	Updated as part of this pull request.
.github/​workflows/​deployment-incident-monitor.lock.yml	Updated as part of this pull request.
.github/​workflows/​dependabot-go-checker.lock.yml	Updated as part of this pull request.
.github/​workflows/​dependabot-burner.lock.yml	Updated as part of this pull request.
.github/​workflows/​delight.lock.yml	Updated as part of this pull request.
.github/​workflows/​deepsec-security-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​deep-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​dead-code-remover.lock.yml	Updated as part of this pull request.
.github/​workflows/​dataflow-pr-discussion-dataset.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-yamllint-fixer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-workflow-updater.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-workflow-security-model.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-work-queues-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-work-queue-formal-verification.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-windows-terminal-integration-builder.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-windows-defender-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-vulnhunter-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-trajectory-grader-implementer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-token-consumption-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-testify-uber-super-expert.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-team-status.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-team-evolution-insights.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-syntax-error-quality.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-storify.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-squid-image-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-spending-forecast.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-spec-coverage-kiro.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-spdd-spec-planner.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-semgrep-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-security-red-team.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-security-observability.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-secrets-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-schema-audit-cursor.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-safeoutputs-git-simulator.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-safe-outputs-conformance.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-safe-output-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-safe-output-integrator.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-report-dispatcher.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-repo-chronicle.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-rendering-scripts-verifier.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-reliability-review.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-regulatory.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-regression-audit-kiro.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-pr-review-cursor.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-performance-summary.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-observability-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-news.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-multi-device-docs-tester.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-model-resolution.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-model-inventory.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-mcp-concurrency-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-max-ai-credits-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-malicious-code-scan.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-issues-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-hippo-learn.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-harness-experiment-proposer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-graft-intelligence.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-grader-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-go-test-stubs-aider.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-go-test-parallelizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-github-docs-seo-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-geo-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-function-namer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-formal-spec-verifier.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-firewall-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-file-diet.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-fact.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-experiment-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-evals-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-elixir-credo-snippet-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-ecosystem-explorer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-documentation-diagram.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-doc-updater.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-doc-healer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-credit-limit-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-compiler-threat-spec-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-compiler-quality.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-community-attribution.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-code-metrics.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-code-debt-aider.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-cli-tools-tester.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-cli-performance.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-choice-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-caveman-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-cache-strategy-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-byok-ollama-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-awf-spec-compiler-surfacing.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-aw-cross-repo-compile-check.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-astrostylelite-markdown-spellcheck.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-assign-issue-to-user.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-arxiv-researcher.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-architecture-diagram.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-ambient-context-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-agentrx-trace-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-agent-of-the-day-blog-writer.lock.yml	Updated as part of this pull request.
.github/​workflows/​daily-action-setup-security-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​craft.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-session-insights.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-pr-prompt-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-pr-nlp-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-pr-merged-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-opt.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-cli-deep-research.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-centralization-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-centralization-drilldown.lock.yml	Updated as part of this pull request.
.github/​workflows/​copilot-agent-analysis.lock.yml	Updated as part of this pull request.
.github/​workflows/​contribution-check.lock.yml	Updated as part of this pull request.
.github/​workflows/​constraint-solving-potd.lock.yml	Updated as part of this pull request.
.github/​workflows/​commit-changes-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​codex-github-remote-mcp-test.lock.yml	Updated as part of this pull request.
.github/​workflows/​code-simplifier.lock.yml	Updated as part of this pull request.
.github/​workflows/​code-scanning-fixer.lock.yml	Updated as part of this pull request.
.github/​workflows/​cloclo.lock.yml	Updated as part of this pull request.
.github/​workflows/​cli-version-checker.lock.yml	Updated as part of this pull request.
.github/​workflows/​cli-consistency-checker.lock.yml	Updated as part of this pull request.
.github/​workflows/​claude-code-user-docs-review.lock.yml	Updated as part of this pull request.
.github/​workflows/​ci-coach.lock.yml	Updated as part of this pull request.
.github/​workflows/​chaos-pr-bundle-fuzzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​changeset.lock.yml	Updated as part of this pull request.
.github/​workflows/​breaking-change-checker.lock.yml	Updated as part of this pull request.
.github/​workflows/​bot-detection.lock.yml	Updated as part of this pull request.
.github/​workflows/​blog-auditor.lock.yml	Updated as part of this pull request.
.github/​workflows/​aw-issue-clustering.lock.yml	Updated as part of this pull request.
.github/​workflows/​aw-failure-investigator.lock.yml	Updated as part of this pull request.
.github/​workflows/​avenger.lock.yml	Updated as part of this pull request.
.github/​workflows/​auto-triage-issues.lock.yml	Updated as part of this pull request.
.github/​workflows/​audit-workflows.lock.yml	Updated as part of this pull request.
.github/​workflows/​artifacts-summary.lock.yml	Updated as part of this pull request.
.github/​workflows/​archivx-agentic-workflows-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​architecture-guardian.lock.yml	Updated as part of this pull request.
.github/​workflows/​archie.lock.yml	Updated as part of this pull request.
.github/​workflows/​approach-validator.lock.yml	Updated as part of this pull request.
.github/​workflows/​api-consumption-report.lock.yml	Updated as part of this pull request.
.github/​workflows/​ai-moderator.lock.yml	Updated as part of this pull request.
.github/​workflows/​agentic-token-trend-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​agentic-token-optimizer.lock.yml	Updated as part of this pull request.
.github/​workflows/​agentic-token-audit.lock.yml	Updated as part of this pull request.
.github/​workflows/​agent-persona-explorer.lock.yml	Updated as part of this pull request.
.github/​workflows/​agent-performance-analyzer.lock.yml	Updated as part of this pull request.
.github/​workflows/​agent-job-health.lock.yml	Updated as part of this pull request.
.github/​workflows/​actions-aw-linter-factory.lock.yml	Updated as part of this pull request.
.github/​workflows/​ace-editor.lock.yml	Updated as part of this pull request.
.github/​workflows/​ab-testing-advisor.lock.yml	Updated as part of this pull request.

_{Review effort: Max}

[pelikhan]

@copilot this PR must fix the issue in #72092

[github-actions]

Skills-Based Review 🧠

Applied /grill-with-docs, /codebase-design, and /tdd (PR triaged as new_feature; high-impact files: pkg/workflow/runner_timeouts.go, pkg/workflow/runner_timeouts_test.go, pkg/workflow/compiler_yaml.go, docs/src/content/docs/reference/frontmatter.md). Requesting changes on a docs/design clarity gap that corroborates the existing human reviewer comment on ab-testing-advisor.lock.yml.

📋 Key Themes & Highlights

Key Themes

• Silent cost upgrade on zero config: resolveJobRunnerTimeouts checks the effective resolved timeout, not just user-authored frontmatter. Because safe_outputs jobs default to a 45-minute internal timeout (defaultSafeOutputsTimeoutMinutes in compiler_safe_outputs_job.go), any workflow enabling safe-outputs with no timeout configuration at all gets its default runner silently switched from ubuntu-slim to ubuntu-latest. This is almost certainly what the existing PR comment on ab-testing-advisor.lock.yml line 2691 is flagging ("this job should still be using the slim runner since no timeout has been set") — the reviewer's intuition about the documented behavior does not match the implementation.
• Docs wording: the new docs paragraph says the switch happens when a job's "literal timeout-minutes" exceeds 15, which reads as "only when the user writes an explicit value" — but the check also fires on compiler-internal defaults. This is the root of the confusion.
• Test naming: the test case that proves this is intentional ("safe outputs default timeout selects larger runner") is well-covered functionally but is not framed as the cost/surprise caveat it represents, making it easy to mistake for an oversight rather than a deliberate tradeoff.

Positive Highlights

• ✅ Clean integration: resolveJobRunnerTimeouts is wired into buildJobsAndValidate at exactly the right point — after job augmentation, so it inspects effective/final timeouts rather than each builder's own defaults.
• ✅ Solid defensive checks: expression-based runners/timeouts (${{ ... }}) are correctly skipped rather than misparsed, and usesUbuntuSlim correctly distinguishes runner-group labels from a bare group name.
• ✅ Good test coverage overall: 15 table-driven unit cases plus 7 integration-style compile tests cover expressions, custom jobs, array/group runner forms, and explicit-override error paths.
• ✅ Appropriately fails loudly (compile error) rather than silently for custom/non-framework jobs that explicitly select ubuntu-slim with a too-long timeout.

Investigation Note

The diff is small and fully reviewed (407 lines, dominated by mechanical .golden/.lock.yml regenerations); no remaining uncertainty beyond what is flagged above.

@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~191 AIC · ⌖ ~20 AIC · ⊞ 10.2K
_{Comment /matt to run again}

Done

[Copilot]

@copilot include comment in .lock.yml explaining why latest is used when this code pattern is activated.

Added in 4440fd7: automatically upgraded runs-on output now includes a YAML comment explaining the configured timeout exceeds ubuntu-slim’s 15-minute limit.

[Copilot]

@copilot this PR must fix the issue in #72092

Issue #72092 is addressed: pull-request code-publication jobs default to ubuntu-latest, while API-only jobs remain slim and cap their implicit timeout at 15 minutes. Commit 3222ba6.

@copilot include comment in .lock.yml explaining why latest is used when this code pattern is activated.

Generated locks now include an inline explanation when the compiler selects ubuntu-latest. Commit 3222ba6.

[pelikhan]

@copilot run pr-finisher skill

[Copilot]

@copilot run pr-finisher skill

Ran pr-finisher on 3222ba6; no file changes were needed. make fmt, make lint, and make agent-report-progress passed, including impacted tests and all 348 workflow drift checks. Replied to three additional addressed review threads.

Not yet merge-ready: six threads still need resolution (available tools cannot resolve them), the draft ADR needs finalization/linking, and current build workflows require maintainer approval. The prior CGO failure reproduces in the unchanged TestNormalizeOutput_DefaultRuntimeVersions: its preserved v0.5.0 fixture conflicts with the current MCP gateway version assertion. CI on this HEAD remains unverified; a maintainer must approve/re-trigger it before merge. No merge performed.

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (pkg/workflow/runner_timeouts.go:64): This check only looks at whether the runner was set explicitly. It doesn't check whether the timeout was. As a result, any workflow that sets runs-on-slim: ubuntu-slim (or safe-outputs.runs-on: ubuntu-slim) now fails to compile. Safe outputs are enabled by default, and safe_outputs always gets the compiler's 45-minute default, so the failure happens even when the author never configured a timeout. - Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs #72131 (comment)
3. Review (pkg/workflow/runner_timeouts.go:45): For framework jobs, the recommended runs-on: ubuntu-latest does not fix this error: top-level runs-on only changes the agent job, while safe_outputs still inherits runs-on-slim or safe-outputs.runs-on. The same mismatch occurs for detection, whose runner comes from safe-outputs.threat-detection.runs-on. Please identify the applicable runner field in the diagnostic so following the suggested remediation actually resolves the failure. - Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs #72131 (comment)
4. Fix failing check impacted-go-tests (FAILURE): https://github.com/github/gh-aw/actions/runs/40361921787/job/121724953525.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 3222ba6
Sous-chef work: 42e5d572d9d75b7168fe7d0aeda0717cc07e65ed240f6d299e6fec661214f1ac 798e46d8ee26f551819ad4a5e052d1d80ab90b63e521a0b8ad239acfa8f866d1 821c04d0deae9beec3eb37fc4faf1a374a6714e91fbc9ca5d8abbabc7fb0850c
Sous-chef state: d05b9bcc3da58db44b54b76ebf64b02cd41863318cfd0a11856e6e74acfc1280

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · ~4 AIC · ⌖ ~10 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot fix ci failures

[Copilot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged current main with make merge-main (6730dc05) and pushed 878df956 fixing the cited impacted-go-tests failure: the API-only safe-output test now expects its capped 15-minute timeout. Added compilation regression coverage for both explicit slim runner forms and field-specific safe-output/detection/custom-job diagnostics; replied to both listed review threads.

Build, formatting, lint, focused regressions, impacted tests, and all 348 workflow drift checks passed. Secret scanning passed. CodeQL was requested but skipped analysis because the database is too large.

Both listed threads remain unresolved: this environment has no thread-resolution tool and its gh CLI is unauthenticated. A maintainer must mark them resolved. CI on the pushed HEAD is unverified and needs maintainer re-triggering; I did not trigger CI or merge the PR. Working tree is clean.

[github-actions]

🎉 This pull request is included in a new release.

Release: v1.0.1