fix(governance): reject invalid reusable timeouts

[hyperpolymath]

Summary

• extend the workflow loadability gate beyond YAML syntax to reject reusable-workflow call jobs that declare timeout-minutes
• support the existing yq, Python/PyYAML, and Ruby parser paths
• add a passing reusable-caller fixture and a planted failing fixture

Why

GitHub accepts these files as YAML but rejects them as Actions workflows before creating a job. Six Burble callers therefore produced zero-job startup failures while ordinary PR checks did not appear. GitHub permits timeout configuration inside the called workflow, not on the caller job whose top-level key is uses.

Verification

• bash -n passes
• scripts/tests/policy-gates-test.sh passes including the new positive/negative controls
• tools/policy/check-workflows-parse.sh passes all 157 Standards workflows
• git diff --check

[coderabbitai]

Important

Approval pending

CodeRabbit has no unresolved comments, but it has not reviewed the latest commit.

Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The pull request successfully implements the logic to reject invalid reusable workflow timeouts across multiple parsers (yq, Python, Ruby). Codacy analysis indicates the code is up to standards with no new quality issues detected. However, there are critical implementation errors in the shell test script (scripts/tests/policy-gates-test.sh) regarding directory creation and hardcoded paths that will cause the automated tests to fail or error out during the fixture setup. Additionally, while the core requirements are met, there is no test scenario ensuring that standard jobs (those not using a reusable workflow) still allow the timeout-minutes key, which is a necessary regression check.

About this PR

• The current test suite lacks a scenario to verify that standard jobs (non-reusable workflow calls) containing 'timeout-minutes' are still correctly accepted. This is necessary to ensure no regression in standard workflow support.

Test suggestions

• Found recommended test scenario: A reusable workflow call job WITHOUT 'timeout-minutes' passes the gate
• Found recommended test scenario: A reusable workflow call job WITH 'timeout-minutes' is rejected with a specific error message
• Found recommended test scenario: The check correctly identifies the invalid pattern using the 'yq' parser path
• Found recommended test scenario: The check correctly identifies the invalid pattern using the 'python' parser path
• Found recommended test scenario: The check correctly identifies the invalid pattern using the 'ruby' parser path
• Missing recommended test scenario: Standard jobs (not using 'uses') with 'timeout-minutes' continue to pass the gate

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Missing recommended test scenario: Standard jobs (not using 'uses') with 'timeout-minutes' continue to pass the gate

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud