# NousResearch/hermes-agent · CI typecheck workflow permissions and timeouts

## Open now

- 1 issue, 2 PRs open on GitHub.
- #45722: Set explicit read-only permissions on Typecheck workflow
- PR #45731: fix(ci): add explicit read-only permissions to Typecheck workflow
- PR #62257: ci: add concurrency group and job timeouts to typecheck workflow

These items address hardening the Typecheck CI workflow by setting explicit read-only token permissions and adding concurrency groups and job timeouts. All changes are scoped to CI configuration security and reliability improvements.

## TL;DR

- 4 member(s): 1 open issue(s), 0 closed issue(s), 2 open PR(s), 0 merged PR(s), 1 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #45722: Set explicit read-only permissions on Typecheck workflow

## Prior & competing PRs

- **#45731: fix(ci): add explicit read-only permissions to Typecheck workflow**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `d682f320b35a13084371a541a835e1d988c982b8`
  - files: `.github/workflows/typecheck.yml`
- **#46422: fix(workflows): harden token permissions**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#46425`
- **#62257: ci: add concurrency group and job timeouts to typecheck workflow**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `.github/workflows/typecheck.yml`

## Fix status

- No merged fix on record.
- Subsystem: `other`