Guardrails / azure

Pipeline jobs declare a timeout

azure/job-timeout-set@v1

Every job declares a timeout, and none of them asks for the maximum, so a hung job is stopped instead of holding an agent.

Id	azure/job-timeout-set
Version	v1
Category	azure
Default severity	info
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	azure

Collectors

This guardrail doesn't gather anything itself. It relies on the collectors below, which the CLI runs once per build before any check, and reads what they found from GUARDRAIL_FACTS. If a collector collects nothing, this guardrail is skipped, not failed.

Collector	Gathers	Inputs it is given
azure	The Azure Pipelines YAML the repository carries, read as Azure writes it: what starts a run, the stages and jobs it declares, the pool each job lands on and how long it may run, and every task a step reaches for with the version it asks for, alongside the macro, template and runtime expressions a script interpolates. Names and shapes only, never a secret, an input value or a variable value.	pipelines

The inputs above are this guardrail's own inputs, passed straight through to the collector. Setting one in buildnote.json changes what is collected, and two guardrails configured the same way share a single collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "checks": [
          {
              "use": "azure/job-timeout-set@v1",
              "severity": "info",
              "with": {
                  "pipelines": "azure-pipelines*.yml,azure-pipelines*.yaml",
                  "maxMinutes": "60"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
pipelines	Comma separated globs naming the Azure Pipelines definitions to read.	azure-pipelines*.yml,azure-pipelines*.yaml	GUARDRAIL_INPUT_PIPELINES
maxMinutes	Longest timeout accepted. A job that declares more than this is treated as declaring none.	60	GUARDRAIL_INPUT_MAXMINUTES

How to fix

Set a timeout on each job:

jobs:
  - job: build
    timeoutInMinutes: 15
    steps:
      - script: ./gradlew check

A job that doesn't declare one gets 60 minutes on a Microsoft-hosted agent and runs forever on a self-hosted one. timeoutInMinutes: 0 asks for the maximum, which on a self-hosted agent means no limit at all, so the guardrail treats it the same as declaring nothing.