Guardrails / azure

Pipeline jobs declare a timeout

azure/job-timeout-set@v1

Every job declares how long it may run, and none of them asks for the maximum, so a hung job is cut off rather than holding an agent.

Id	azure/job-timeout-set
Version	v1
Category	azure
Default severity	info
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	azure

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
azure	The Azure Pipelines YAML the repository carries, read as Azure writes it: what starts a run, the stages and jobs it declares, the pool each job lands on and how long it may run, and every task a step reaches for with the version it asks for, alongside the macro, template and runtime expressions a script interpolates. Names and shapes only, never a secret, an input value or a variable value.	pipelines

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "azure/job-timeout-set@v1",
              "severity": "info",
              "with": {
                  "pipelines": "azure-pipelines*.yml,azure-pipelines*.yaml",
                  "maxMinutes": "60"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
pipelines	Comma separated globs naming the Azure Pipelines definitions to read.	azure-pipelines*.yml,azure-pipelines*.yaml	GUARDRAIL_INPUT_PIPELINES
maxMinutes	Longest timeout accepted. A job declaring more than this is treated as declaring none.	60	GUARDRAIL_INPUT_MAXMINUTES

How to fix

Declare one on each job:

jobs:
  - job: build
    timeoutInMinutes: 15
    steps:
      - script: ./gradlew check

A job that declares none takes 60 minutes on a Microsoft hosted agent and runs forever on a self hosted one. timeoutInMinutes: 0 asks for the maximum, which on a self hosted agent is no limit at all, so it is the one value worth reading as declaring nothing.