Fix/security reliability workflow hardening

.github/workflows/accessibility.yml

@@ -17,6 +17,7 @@ jobs:
   jest-axe-tests:
     name: Jest-Axe Accessibility Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -47,6 +48,7 @@ jobs:
   lighthouse-audit:
     name: Lighthouse Accessibility Audit
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -100,6 +102,7 @@ jobs:
   axe-core-audit:
     name: Axe-Core Full Page Audit
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -143,6 +146,7 @@ jobs:
   pa11y-audit:
     name: Pa11y Accessibility Audit
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -200,6 +204,7 @@ jobs:
   keyboard-navigation-tests:
     name: Keyboard Navigation Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -223,6 +228,7 @@ jobs:
   color-contrast-check:
     name: Color Contrast Validation
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: frontend
@@ -269,6 +275,7 @@ jobs:
       - keyboard-navigation-tests
       - color-contrast-check
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Success

.github/workflows/contract-deployment.yml

@@ -25,14 +25,15 @@ jobs:
   build-and-test:
     name: Build and Test Contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     outputs:
       wasm-path: ${{ steps.build.outputs.wasm-path }}
       contract-hash: ${{ steps.build.outputs.contract-hash }}
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@63eb9591781c46a70274cb3ebdf190fce92702e8 # v1
         with:
           profile: minimal
           toolchain: stable
@@ -116,6 +117,7 @@ jobs:
     name: Deploy to Testnet
     needs: build-and-test
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: github.ref == 'refs/heads/develop' || github.event.inputs.environment == 'testnet'
     environment:
       name: testnet
@@ -183,6 +185,7 @@ jobs:
     name: Deploy to Mainnet
     needs: build-and-test
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: github.ref == 'refs/heads/main'
     environment:
       name: mainnet
@@ -255,6 +258,7 @@ jobs:
     name: Version and Archive Artifacts
     needs: build-and-test
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -291,6 +295,7 @@ jobs:
     name: Notify Deployment Status
     needs: [build-and-test, deploy-testnet]
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: always()
     steps:
       - name: Determine deployment status
@@ -303,7 +308,7 @@ jobs:
 
       - name: Send Slack notification
         if: vars.SLACK_WEBHOOK_URL != ''
-        uses: slackapi/slack-github-action@v3.0.3
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           payload: |
             {

.github/workflows/dependency-scan.yml

@@ -12,11 +12,14 @@ jobs:
   scan-rust:
     name: Scan Rust Dependencies
     runs-on: ubuntu-latest
+    # cargo install cargo-audit has hung indefinitely on runner network
+    # issues before; keep this shorter than the default 20.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Install cargo-audit
         run: cargo install cargo-audit
@@ -58,6 +61,7 @@ jobs:
   scan-npm:
     name: Scan NPM Dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -98,6 +102,7 @@ jobs:
   scan-trivy:
     name: Scan with Trivy
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -120,6 +125,7 @@ jobs:
   report-vulnerabilities:
     name: Report Vulnerabilities
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: [scan-rust, scan-npm, scan-trivy]
     if: always()
     steps:

.github/workflows/deploy.yml

@@ -19,6 +19,7 @@ jobs:
   validate-secrets:
     name: Validate Required Secrets
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Check required secrets are set
         run: |
@@ -53,12 +54,13 @@ jobs:
   security-scan:
     name: Checkov Security Scan
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: validate-secrets
     steps:
       - uses: actions/checkout@v4
 
       - name: Run Checkov
-        uses: bridgecrewio/checkov-action@v12
+        uses: bridgecrewio/checkov-action@7b972723c44fb3d256283fac96fae5d7c1894bb7 # v12
         with:
           directory: infrastructure/terraform
           framework: terraform
@@ -73,6 +75,7 @@ jobs:
   plan:
     name: Terraform Plan
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: [validate-secrets, security-scan]
     strategy:
       matrix:
@@ -81,12 +84,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
         with:
           terraform_version: ${{ env.TERRAFORM_VERSION }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@451ce2a72e8d729a59ebeaacab82dbce58e7af4c # v6
         with:
           role-to-assume: ${{ secrets[format('AWS_ROLE_{0}', matrix.environment)] }}
           aws-region: ${{ env.AWS_REGION }}
@@ -126,6 +129,9 @@ jobs:
   apply:
     name: Terraform Apply
     runs-on: ubuntu-latest
+    # Kept short: this job holds a DynamoDB state lock and max-parallel: 1
+    # means a hung apply blocks every other environment behind it.
+    timeout-minutes: 15
     needs: plan
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     strategy:
@@ -136,12 +142,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
         with:
           terraform_version: ${{ env.TERRAFORM_VERSION }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@451ce2a72e8d729a59ebeaacab82dbce58e7af4c # v6
         with:
           role-to-assume: ${{ secrets[format('AWS_ROLE_{0}', matrix.environment)] }}
           aws-region: ${{ env.AWS_REGION }}

.github/workflows/docker.yml

@@ -15,26 +15,27 @@ jobs:
   build:
     name: Build and Push Docker Image
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Log in to Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -45,7 +46,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
@@ -64,6 +65,7 @@ jobs:
   scan:
     name: Scan Docker Image
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: build
     if: github.event_name != 'pull_request'
     steps:
@@ -86,16 +88,17 @@ jobs:
   test-image:
     name: Test Docker Image
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: build
     if: github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Build image for testing
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           load: true

.github/workflows/e2e-staging.yml

@@ -13,6 +13,7 @@ jobs:
   e2e-staging:
     name: Playwright — Staging
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     defaults:
       run:

.github/workflows/license-check.yml

@@ -10,11 +10,12 @@ jobs:
   rust-licenses-contracts:
     name: Rust License Check — contracts/predict-iq
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Cache cargo registry
         uses: actions/cache@v5
@@ -34,11 +35,12 @@ jobs:
   rust-licenses-api:
     name: Rust License Check — services/api
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Cache cargo registry
         uses: actions/cache@v5
@@ -58,6 +60,7 @@ jobs:
   npm-licenses-frontend:
     name: NPM License Check — frontend
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -89,6 +92,7 @@ jobs:
   npm-licenses-tts:
     name: NPM License Check — services/tts
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -125,6 +129,7 @@ jobs:
       - npm-licenses-frontend
       - npm-licenses-tts
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Success
         run: echo "All dependency licenses are compliant."

.github/workflows/msrv.yml

@@ -16,6 +16,7 @@ jobs:
   msrv:
     name: Build with Minimum Supported Rust Version
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -27,7 +28,7 @@ jobs:
           echo "MSRV detected: $MSRV"
 
       - name: Install MSRV toolchain (${{ steps.msrv.outputs.version }})
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
         with:
           toolchain: ${{ steps.msrv.outputs.version }}
 

.github/workflows/openapi-validation.yml

@@ -18,6 +18,7 @@ jobs:
   spectral-lint:
     name: Spectral — OpenAPI structural lint
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -42,11 +43,12 @@ jobs:
   contract-tests:
     name: OpenAPI Contract Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Cache cargo dependencies
         uses: actions/cache@v5
@@ -77,6 +79,7 @@ jobs:
     name: All OpenAPI Checks Passed
     needs: [spectral-lint, contract-tests]
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Success
         run: echo "OpenAPI spec is valid and in sync with routes."