From 8b43fc2063350fb80e8d55ef7f7e888d6884fb60 Mon Sep 17 00:00:00 2001
From: Justin Mitchel <jmitchel3@gmail.com>
Date: Thu, 25 Jun 2026 14:23:13 -0600
Subject: [PATCH 1/2] ci: bump actions off deprecated Node 20 + add job
 timeouts

GitHub is force-running our actions on Node 24 because they target the now-
deprecated Node 20. Bump to current majors:
- actions/checkout v4 -> v7
- actions/setup-python v5 -> v6
- actions/upload-artifact v4 -> v7
- actions/download-artifact v4 -> v8
- astral-sh/setup-uv v4 -> v8

Also add timeout-minutes to every job (tests/coverage/release) and to the
hang-prone external steps (tox, build, PyPI publish), so a stuck runner can't
burn the 6-hour default.
---
 .github/workflows/workflow.yaml | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index e45ed0a..730eb4e 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -24,6 +24,7 @@ jobs:
   tests:
     name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
 
     strategy:
       matrix:
@@ -33,15 +34,15 @@ jobs:
         - '3.13'
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v8
       with:
         enable-cache: true
         cache-dependency-glob: tests/requirements/*.txt
@@ -51,9 +52,12 @@ jobs:
 
     - name: Run tox targets for ${{ matrix.python-version }}
       run: tox run -f py$(echo ${{ matrix.python-version }} | tr -d .)
+      # Spins up a TimescaleDB container via testcontainers; bound so a stuck
+      # pull/test can't hang the job.
+      timeout-minutes: 15
 
     - name: Upload coverage data
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: coverage-data-${{ matrix.python-version }}
         path: '${{ github.workspace }}/.coverage.*'
@@ -63,22 +67,23 @@ jobs:
   coverage:
     name: Coverage
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     needs: tests
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v8
 
       - name: Install dependencies
         run: uv pip install --system coverage[toml]
 
       - name: Download data
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: ${{ github.workspace }}
           pattern: coverage-data-*
@@ -92,7 +97,7 @@ jobs:
 
       - name: Upload HTML report
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: html-report
           path: htmlcov
@@ -100,6 +105,7 @@ jobs:
   release:
     if: success() && startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     environment: release
 
     permissions:
@@ -107,11 +113,14 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@v8
 
       - name: Build
         run: uv build
+        timeout-minutes: 5
 
       - uses: pypa/gh-action-pypi-publish@release/v1
+        # External upload to PyPI; bound so a stalled upload can't hang the job.
+        timeout-minutes: 10

From c0a9e97137c3601d0b6bec53bad76f33c05e4688 Mon Sep 17 00:00:00 2001
From: Justin Mitchel <jmitchel3@gmail.com>
Date: Thu, 25 Jun 2026 14:25:33 -0600
Subject: [PATCH 2/2] ci: pin setup-uv to v8.2.0 (no moving v8 major tag)

---
 .github/workflows/workflow.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 730eb4e..3803a1b 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -42,7 +42,7 @@ jobs:
         allow-prereleases: true
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v8
+      uses: astral-sh/setup-uv@v8.2.0
       with:
         enable-cache: true
         cache-dependency-glob: tests/requirements/*.txt
@@ -77,7 +77,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.2.0
 
       - name: Install dependencies
         run: uv pip install --system coverage[toml]
@@ -115,7 +115,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v8
+      - uses: astral-sh/setup-uv@v8.2.0
 
       - name: Build
         run: uv build