[billfreeman44]

Fleet sweep from the plan in igl-gotv docs/plans/workflow_hardening_sweep.md, which carries the evidence for each change.

What changed here:

• publish.yml: added run-name
• publish.yml: added timeout-minutes to 2 job(s)
• version.yml: dispatch input moved out of the shell line
• version.yml: added run-name
• version.yml: added timeout-minutes to 1 job(s)

CHANGELOG updated.

Warning

version.yml, promote.yml, publish.yml and redeploy.yml are tag- or dispatch-triggered, so PR CI never exercises them. A green check here does not cover them - they were validated by parsing the YAML.

[Copilot]

Pull request overview

This PR hardens the release/publish GitHub Actions workflows to reduce “silent wrong-thing” failures by improving run visibility and adding safety limits around long-running jobs.

Changes:

• Add human-readable run-name values to version and publish workflows.
• Add timeout-minutes to the version release job and both publish jobs.
• In version.yml, pass the version through env: and quote it in the shell command instead of interpolating into the run: line.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Adds a release note describing the workflow hardening changes (needs correction re: concurrency).
.github/workflows/version.yml	Adds run-name, job timeout, and moves version input into an env var for safer npm version execution.
.github/workflows/publish.yml	Adds run-name and job timeouts for npm and GitHub Packages publishing jobs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[billfreeman44]

Acted on the review:

• corrected the CHANGELOG bullet

Not taken, with reasons:

• Use || instead of concatenating inputs.* and client_payload.*. Raised on most of these PRs. The concatenation is the fleet's established idiom - it appears in roughly 200 places across every repo, and it works because exactly one of the two is ever populated: workflow_dispatch fills inputs, repository_dispatch fills client_payload. Switching a handful of files to || would leave the fleet reading two ways at once, which is the drift this sweep exists to reduce. Worth doing as its own consistency pass over all of them, not piecemeal here.
• Make the version input required: true. A fair point, and out of scope: it changes who can start a release, not how safely it runs. Recorded as a follow-up rather than folded in silently.