> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BEST-PRAC-2 — Job timeout not configured

> Without timeout-minutes, GitHub Actions jobs can run for up to 6 hours.

| Field    | Value                         |
| -------- | ----------------------------- |
| Category | `BEST-PRAC-2`                 |
| Severity | **LOW**                       |
| Auto-fix | ✓ ([what it does](#auto-fix)) |

## What the check does

Flags any job that doesn't declare `timeout-minutes:` at the job level.

## Why it matters

GitHub Actions jobs default to a **6-hour** timeout. A stuck step (hanging network call, infinite loop, runaway test) burns runner minutes — billed against your account on hosted runners, and tying up infra on self-hosted ones.

Explicit per-job timeouts cap the blast radius.

## Vulnerable example

```yaml theme={null}
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test
```

## Safe alternative

```yaml theme={null}
jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - run: npm test
```

Pick a duration that gives headroom over the 95th-percentile run time but doesn't bleed runner minutes when something hangs.

## Auto-fix

`--fix` adds `timeout-minutes: 30` to each flagged job. That's a conservative default — tighten it once you know typical runtimes.