ci(workflows): timeout-minutes + SHA-pinned actions

[hyperpolymath]

Summary

Hardens all GitHub Actions workflows with timeout-minutes: 60 on every steps-based job, and confirms all action uses: lines are already SHA-pinned.

Jobs that received timeout-minutes: 60

27 jobs across 12 files:

File	Jobs
build-validation.yml	validate-rust, validate-elixir
reuse.yml	reuse-lint
cflite_pr.yml	pr-fuzzing
cflite_batch.yml	batch-fuzzing
fuzz.yml	fuzz-core, fuzz-debugger
instant-sync.yml	dispatch
scorecard-enforcer.yml	scorecard, check-critical
dogfood-gate.yml	a2ml-validate
elixir-ci.yml	build-test, coverage, bench-compile, audit
coq-build.yml	build
rust-ci.yml	fmt, clippy, test, doc, audit, deny, bench-compile, coverage, mutants, fuzz-compile
codeql.yml	analyze

Already had timeout-minutes: 60: ghcr-publish.yml → build-and-push (unchanged).

Reusable-workflow caller jobs — intentionally left WITHOUT timeout-minutes

timeout-minutes is invalid on jobs that use uses: at the job level (reusable-workflow callers). These were correctly left untouched:

File	Job	Calls
hypatia-scan.yml	hypatia	hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@…
governance.yml	governance	hyperpolymath/standards/.github/workflows/governance-reusable.yml@…
security-scan.yml	scan	hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@…
secret-scanner.yml	scan	hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@…
spark-theatre-gate.yml	spark-theatre-gate	hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@…
scorecard.yml	analysis	hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@…
mirror.yml	mirror	hyperpolymath/standards/.github/workflows/mirror-reusable.yml@…

SHA-pinned actions

No new pinning was required — all uses: lines in step definitions were already pinned to 40-hex SHAs at the time of this PR. Verification:

grep -rn 'uses: [^#]*@v[0-9]' .github/workflows/
(no output — zero unpinned actions)

Verification

YAML parse (all 20 files):

OK: build-validation.yml, cflite_batch.yml, cflite_pr.yml, codeql.yml,
    coq-build.yml, dogfood-gate.yml, elixir-ci.yml, fuzz.yml,
    ghcr-publish.yml, governance.yml, hypatia-scan.yml, instant-sync.yml,
    mirror.yml, reuse.yml, rust-ci.yml, scorecard-enforcer.yml,
    scorecard.yml, secret-scanner.yml, security-scan.yml,
    spark-theatre-gate.yml

No unpinned actions: grep -rn 'uses: [^#]*@v[0-9]' .github/workflows/ → no matches

reuse lint: COMPLIANT — 768/768 files with copyright + license information (REUSE 3.3)

---

https://claude.ai/code/session_01W9Voe3JceP66Bna9FT4jME

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 150 issues detected

Severity	Count
🔴 Critical	17
🟠 High	50
🟡 Medium	83

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in security-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "security-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in spark-theatre-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "spark-theatre-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence