improvement(ci): timeouts, docs-only PR skip, fork-isolated caches, Node pin; remove i18n workflow (#5714)

* improvement(ci): job timeouts everywhere, docs-only PR skip, event-scoped sticky disks, Node pin; drop dead i18n workflow

- timeout-minutes on every runnable job (defaults ran hung jobs to the
  6-hour cap — the i18n workflow burned three full 6-hour runs in Feb
  before its schedule was pulled)
- paths-ignore on the pull_request trigger: docs content and markdown
  don't affect the app build or images; push runs stay unfiltered
- sticky-disk keys scoped by event name so fork PR runs never share a
  disk with the push runs that feed production image builds
- node-version pinned to 22 (was 'latest', non-deterministic)
- delete i18n.yml: schedule already removed after repeated 6-hour hangs,
  workflow_dispatch-only since, comments stale

* improvement(ci): 45m migrate timeout (covers 30m lock wait), fork-namespaced PR sticky disks

- migrate.ts waits up to 30 minutes for the migration advisory lock
  (LOCK_ACQUIRE_DEADLINE_MS); the 15m job timeout would preempt that
  designed wait, so the bound is 45m
- fork PRs now get their own sticky-disk namespace so an untrusted fork
  run can't poison the disks that trusted internal-PR runs restore

.github/workflows/ci.yml

@@ -5,6 +5,11 @@ on:
     branches: [main, staging, dev]
   pull_request:
     branches: [main, staging, dev]
+    # Docs content and markdown don't affect the app build or images; push
+    # runs stay unfiltered because they feed the deploy pipeline.
+    paths-ignore:
+      - 'apps/docs/content/**'
+      - '**/*.md'
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -24,6 +29,7 @@ jobs:
   detect-version:
     name: Detect Version
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
       version: ${{ steps.extract.outputs.version }}
@@ -76,6 +82,7 @@ jobs:
     needs: [detect-version, migrate-dev]
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 30
     permissions:
       contents: read
       id-token: write
@@ -139,6 +146,7 @@ jobs:
     needs: [migrate-dev]
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -185,6 +193,7 @@ jobs:
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -284,6 +293,7 @@ jobs:
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 10
     permissions:
       contents: read
       id-token: write
@@ -353,6 +363,7 @@ jobs:
   build-ghcr-arm64:
     name: Build ARM64 (GHCR Only)
     runs-on: blacksmith-8vcpu-ubuntu-2404-arm
+    timeout-minutes: 30
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
@@ -401,6 +412,7 @@ jobs:
   create-ghcr-manifests:
     name: Create GHCR Manifests
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 10
     needs: [promote-images, build-ghcr-arm64, detect-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
@@ -466,6 +478,7 @@ jobs:
   check-docs-changes:
     name: Check Docs Changes
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     outputs:
       docs_changed: ${{ steps.filter.outputs.docs }}
@@ -494,6 +507,7 @@ jobs:
   create-release:
     name: Create GitHub Release
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 10
     needs: [create-ghcr-manifests, detect-version]
     if: needs.detect-version.outputs.is_release == 'true'
     permissions:

.github/workflows/companion-pr-check.yml

@@ -30,6 +30,7 @@ permissions:
 jobs:
   companion:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:

.github/workflows/docs-embeddings.yml

@@ -11,6 +11,7 @@ jobs:
   process-docs-embeddings:
     name: Process Documentation Embeddings
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 30
     if: github.ref == 'refs/heads/main'
 
     steps:
@@ -25,7 +26,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: latest
+          node-version: 22
 
       - name: Cache Bun dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

.github/workflows/i18n.yml

@@ -1,178 +0,0 @@
-name: 'Auto-translate Documentation'
-
-on:
-  workflow_dispatch: # Manual trigger only (scheduled runs disabled)
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  translate:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    if: github.actor != 'github-actions[bot]' # Prevent infinite loops
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          ref: staging
-          token: ${{ secrets.GH_PAT }}
-          fetch-depth: 0
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.13
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Run Lingo.dev translations
-        env:
-          LINGODOTDEV_API_KEY: ${{ secrets.LINGODOTDEV_API_KEY }}
-        run: |
-          cd apps/docs
-          bunx lingo.dev@latest i18n
-      
-      - name: Check for translation changes
-        id: changes
-        run: |
-          cd apps/docs
-          git config --local user.email "action@github.com"
-          git config --local user.name "GitHub Action"
-          
-          if [ -n "$(git status --porcelain content/docs)" ]; then
-            echo "changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "changes=false" >> $GITHUB_OUTPUT
-          fi
-      
-      - name: Create Pull Request with translations
-        if: steps.changes.outputs.changes == 'true'
-        uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5
-        with:
-          token: ${{ secrets.GH_PAT }}
-          commit-message: "feat(i18n): update translations"
-          title: "feat(i18n): update translations"
-          body: |
-            ## Summary
-            Automated weekly translation updates for documentation.
-
-            This PR was automatically created by the scheduled weekly i18n workflow, updating translations for all supported languages using Lingo.dev AI translation engine.
-
-            **Triggered**: Weekly scheduled run
-            **Workflow**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-            
-            ## Type of Change
-            - [ ] Bug fix
-            - [ ] New feature  
-            - [ ] Breaking change
-            - [x] Documentation
-            - [ ] Other: ___________
-            
-            ## Testing
-            This PR includes automated translations for modified English documentation content:
-            - 🇪🇸 Spanish (es) translations
-            - 🇫🇷 French (fr) translations
-            - 🇨🇳 Chinese (zh) translations
-            - 🇯🇵 Japanese (ja) translations
-            - 🇩🇪 German (de) translations
-            
-            **What reviewers should focus on:**
-            - Verify translated content accuracy and context
-            - Check that all links and references work correctly in translated versions
-            - Ensure formatting, code blocks, and structure are preserved
-            - Validate that technical terms are appropriately translated
-            
-            ## Checklist
-            - [x] Code follows project style guidelines (automated translation)
-            - [x] Self-reviewed my changes (automated process)
-            - [ ] Tests added/updated and passing
-            - [x] No new warnings introduced
-            - [x] I confirm that I have read and agree to the terms outlined in the [Contributor License Agreement (CLA)](./CONTRIBUTING.md#contributor-license-agreement-cla)
-            
-            ## Screenshots/Videos
-            <!-- Translation changes are text-based - no visual changes expected -->
-            <!-- Reviewers should check the documentation site renders correctly for all languages -->
-          branch: auto-translate/weekly-${{ github.run_id }}
-          base: staging
-          labels: |
-            i18n
-
-  verify-translations:
-    needs: translate
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    if: always() # Run even if translation fails
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          ref: staging
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.13
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: |
-          cd apps/docs
-          bun install --frozen-lockfile
-
-      - name: Build documentation to verify translations
-        env:
-          DATABASE_URL: postgresql://dummy:dummy@localhost:5432/dummy
-        run: |
-          cd apps/docs
-          bun run build
-
-      - name: Report translation status
-        run: |
-          cd apps/docs
-          echo "## Translation Status Report" >> $GITHUB_STEP_SUMMARY
-          echo "**Weekly scheduled translation run**" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          en_count=$(find content/docs/en -name "*.mdx" | wc -l)
-          es_count=$(find content/docs/es -name "*.mdx" 2>/dev/null | wc -l || echo 0)
-          fr_count=$(find content/docs/fr -name "*.mdx" 2>/dev/null | wc -l || echo 0)
-          zh_count=$(find content/docs/zh -name "*.mdx" 2>/dev/null | wc -l || echo 0)
-          ja_count=$(find content/docs/ja -name "*.mdx" 2>/dev/null | wc -l || echo 0)
-          de_count=$(find content/docs/de -name "*.mdx" 2>/dev/null | wc -l || echo 0)
-          
-          es_percentage=$((es_count * 100 / en_count))
-          fr_percentage=$((fr_count * 100 / en_count))
-          zh_percentage=$((zh_count * 100 / en_count))
-          ja_percentage=$((ja_count * 100 / en_count))
-          de_percentage=$((de_count * 100 / en_count))
-          
-          echo "### Coverage Statistics" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇬🇧 English**: $en_count files (source)" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇪🇸 Spanish**: $es_count/$en_count files ($es_percentage%)" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇫🇷 French**: $fr_count/$en_count files ($fr_percentage%)" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇨🇳 Chinese**: $zh_count/$en_count files ($zh_percentage%)" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇯🇵 Japanese**: $ja_count/$en_count files ($ja_percentage%)" >> $GITHUB_STEP_SUMMARY
-          echo "- **🇩🇪 German**: $de_count/$en_count files ($de_percentage%)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "🔄 **Auto-translation PR**: Check for new pull request with updated translations" >> $GITHUB_STEP_SUMMARY

.github/workflows/migrations.yml

@@ -25,6 +25,7 @@ jobs:
   migrate:
     name: Apply Database Migrations
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 45
 
     steps:
       - name: Checkout code

.github/workflows/publish-cli.yml

@@ -12,6 +12,7 @@ permissions:
 jobs:
   publish-npm:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/publish-python-sdk.yml

@@ -12,6 +12,7 @@ permissions:
 jobs:
   publish-pypi:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/publish-ts-sdk.yml

@@ -12,6 +12,7 @@ permissions:
 jobs:
   publish-npm:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/test-build.yml

@@ -11,6 +11,7 @@ jobs:
   test-build:
     name: Lint and Test
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
 
     steps:
       - name: Checkout code
@@ -24,24 +25,28 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: latest
+          node-version: 22
 
+      # Sticky-disk keys are scoped by event name, and fork PRs get their own
+      # namespace on top: untrusted fork runs must never share a disk with
+      # push runs (whose disks feed production image builds) or with trusted
+      # internal-PR runs.
       - name: Mount Bun cache (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-bun-cache
+          key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ~/.bun/install/cache
 
       - name: Mount node_modules (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-node-modules
+          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./node_modules
 
       - name: Mount Turbo cache (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-turbo-cache
+          key: ${{ github.repository }}-turbo-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./.turbo
 
       - name: Install dependencies
@@ -184,6 +189,7 @@ jobs:
   build:
     name: Build App
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
 
     steps:
       - name: Checkout code
@@ -197,24 +203,24 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: latest
+          node-version: 22
 
       - name: Mount Bun cache (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-bun-cache
+          key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ~/.bun/install/cache
 
       - name: Mount node_modules (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-node-modules
+          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./node_modules
 
       - name: Mount Turbo cache (Sticky Disk)
         uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
         with:
-          key: ${{ github.repository }}-turbo-cache-build
+          key: ${{ github.repository }}-turbo-cache-build-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./.turbo
 
       - name: Restore Next.js build cache