# NousResearch/hermes-agent · CI workflow hardening: timeouts, concurrency, permissions

## Open now

- 2 issues, 2 PRs open on GitHub.
- #62103: ci: workflow jobs missing timeout-minutes inherit the 6-hour default
- #62256: ci: typecheck workflow lacks a concurrency group and job timeouts
- PR #62102: ci: add timeout-minutes to workflow jobs
- PR #62257: ci: add concurrency group and job timeouts to typecheck workflow

These issues and pull requests address missing job timeout settings, absent concurrency groups, and token permission hardening across CI workflows. The changes aim to prevent runaway jobs and tighten workflow security configurations.

## TL;DR

- 7 member(s): 2 open issue(s), 0 closed issue(s), 2 open PR(s), 0 merged PR(s), 3 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.26`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #62103: ci: workflow jobs missing timeout-minutes inherit the 6-hour default
- #62256: ci: typecheck workflow lacks a concurrency group and job timeouts

## Prior & competing PRs

- **#46422: fix(workflows): harden token permissions**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#46425`, `#46425`
- **#62102: ci: add timeout-minutes to workflow jobs**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `.github/workflows/ci.yml`, `.github/workflows/contributor-check.yml`, `.github/workflows/deploy-site.yml`, `.github/workflows/docs-site-checks.yml`, `.github/workflows/history-check.yml`, `.github/workflows/skills-index-freshness.yml`, `.github/workflows/skills-index.yml`, `.github/workflows/supply-chain-audit.yml`, `.github/workflows/tests.yml`, `.github/workflows/upload_to_pypi.yml`
- **#62257: ci: add concurrency group and job timeouts to typecheck workflow**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `.github/workflows/typecheck.yml`
- **#62427: fix(62103): ci: workflow jobs missing timeout-minutes inherit the 6-hour default**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#62102`
- **#62952: fix(62256): ci: typecheck workflow lacks a concurrency group and job timeouts**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#62257`

## Fix status

- No merged fix on record.
- Subsystem: `other`