fix(ISV-7182): Increase taskrun timeouts

[RichardPlesnik]

Merge Request Checklists

• Development is done in feature branches
• Code changes are submitted as pull request into a primary branch [Provide reason for non-primary branch submissions]
• Code changes are covered with unit and integration tests.
• Code passes all automated code tests:
  • Linting
  • Code formatter - Black
  • Security scanners
  • Unit tests
  • Integration tests
• Code is reviewed by at least 1 team member
• Pull request is tagged with "risk/good-to-go" label for minor changes

[qodo-code-review]

Review Summary by Qodo

Fix index-signature-verification pipeline timeouts and scheduling

🐞 Bug fix ✨ Enhancement

Walkthroughs

Description

• Increase pipeline and task timeouts to prevent premature failures
  - Pipeline timeout increased from 30m to 90m
  - Individual task timeouts set to 1h30m for signature verification
• Adjust CronJob schedule from hourly to every 2 hours
• Fix notification logic to skip timeouts and cancellations
  - Added checks for PipelineRunTimeout and TaskRunCancelled statuses

Diagram

flowchart LR
  A["Pipeline Configuration"] -->|"Increase timeouts"| B["1h30m task timeout"]
  A -->|"Extend pipeline"| C["90m pipeline timeout"]
  D["CronJob Schedule"] -->|"Change frequency"| E["Every 2 hours"]
  F["Notification Logic"] -->|"Skip additional statuses"| G["Timeout & Cancelled"]

Loading

File Changes

1. ansible/roles/config_ocp_cluster/files/tasks/chat-pipelinerun-summary.yml 🐞 Bug fix +1/-1

Add timeout and cancellation status checks

• Enhanced notification skip logic to handle additional pipeline statuses
• Added checks for PipelineRunTimeout and TaskRunCancelled states
• Prevents Slack notifications for timeout and cancellation events

ansible/roles/config_ocp_cluster/files/tasks/chat-pipelinerun-summary.yml

---

2. ansible/roles/index_signature_verification/files/pipelines/index-signature-verification-pipeline.yml ✨ Enhancement +3/-0

Set task timeouts for signature verification

• Added 1h30m timeout to verify-signatures-certified-operators task
• Added 1h30m timeout to verify-signatures-redhat-marketplace task
• Added 1h30m timeout to verify-signatures-community-operators task

ansible/roles/index_signature_verification/files/pipelines/index-signature-verification-pipeline.yml

---

3. ansible/roles/index_signature_verification/tasks/main.yml ✨ Enhancement +2/-2

Increase pipeline timeout and adjust schedule

• Increased pipeline timeout from 30m to 90m in TriggerTemplate
• Changed CronJob schedule from hourly (0 * * * *) to every 2 hours (0 */2 * * *)
• Allows longer execution time for signature verification operations

ansible/roles/index_signature_verification/tasks/main.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. No timeout safety margin 🐞 Bug ☼ Reliability

Description

The index-signature-verification PipelineRun sets timeouts.pipeline: 90m, which is exactly the
same duration as each Pipeline task timeout ("1h30m"), leaving no buffer for scheduling/startup
overhead and increasing the chance the PipelineRun hits the overall timeout first. This repo’s other
PipelineRuns typically set pipeline timeout higher than task timeout (and often also set
timeouts.tasks) to provide a safety margin.

Code

ansible/roles/index_signature_verification/tasks/main.yml[98]

+                pipeline: 90m

Evidence

The Pipeline defines per-task timeouts of 1h30m, while the TriggerTemplate creates PipelineRuns with
an overall pipeline timeout of 90m (the same duration). In contrast, other PipelineRuns in this repo
set pipeline timeout greater than task timeout, indicating an established pattern to avoid premature
pipeline-level timeouts.

ansible/roles/index_signature_verification/files/pipelines/index-signature-verification-pipeline.yml[9-34]
ansible/roles/index_signature_verification/tasks/main.yml[92-105]
ansible/roles/operator-pipeline/tasks/operator-hosted-pipeline-trigger.yml[83-99]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`index-signature-verification` sets `Pipeline` task timeouts to 1h30m, but the created `PipelineRun` has `timeouts.pipeline: 90m` (equal). With no buffer, the overall PipelineRun timeout can be reached before tasks get their full configured runtime due to scheduling/startup overhead.

### Issue Context
Other PipelineRuns in this repo set `pipeline` timeout higher than `tasks` timeout (and often set both), which provides a safety margin.

### Fix Focus Areas
- ansible/roles/index_signature_verification/tasks/main.yml[92-105]

### Suggested change
Update the TriggerTemplate’s PipelineRun timeouts to include a buffer, e.g.:
- set `timeouts.pipeline` to something > 90m (e.g., `2h`), and
- optionally add `timeouts.tasks: "1h30m"` (or similar) to match the per-task intent while keeping `pipeline` larger.

Keep the values consistent with the pattern used in `operator-hosted-pipeline-trigger.yml` (pipeline > tasks).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---