CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed

Job-level timeout-minutes is parsed but not enforced by this runner; only
the runner's jobTimeout bounds a job. Also fixes the devshell coverage
comment, the shellcheck job comment, an option description citing a script
that is not in the repo, and comment file pointers that resolve to nothing.

.forgejo/workflows/ci.yml

@@ -7,14 +7,14 @@ on:
   # Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API
   workflow_dispatch:
 
+# No job sets `timeout-minutes`: this runner parses a job-level key but does not
+# enforce it. The runner's `services.hyperhive.deploy.ci-runner.jobTimeout`
+# (default 1h) is the only bound on how long a job runs.
 jobs:
   check:
     name: nix flake check
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    # 30 min is well above a cold-cache rebuild (~15 min observed) and well
-    # under the runner's 3h cap
-    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3
       - name: check
@@ -24,7 +24,6 @@ jobs:
     name: tracker-tag lint
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint
@@ -34,7 +33,6 @@ jobs:
     name: comment-block lint
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint
@@ -44,7 +42,6 @@ jobs:
     name: doc-pointer lint
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint
@@ -54,7 +51,6 @@ jobs:
     name: attribution-trailer lint
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
         with:
@@ -66,22 +62,23 @@ jobs:
     name: dashboard-description lint
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint
         # jq isn't a project dependency elsewhere in this repo — same
-        # nix-shell-for-one-tool shape the vale/shellcheck jobs above use.
+        # nix-shell-for-one-tool shape the vale jobs below use.
         run: nix shell nixpkgs#jq --command sh scripts/check-dashboard-descriptions.sh
 
   shellcheck:
     name: shellcheck
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v3
       - name: lint
+        # `nix develop` enters the whole devshell for this one tool, which pins
+        # shellcheck to flake.lock; the vale and jq jobs take theirs from the registry.
+        #
         # By shebang, not a `*.sh` glob — scripts/pre-push has no suffix.
         run: |
           files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
@@ -95,7 +92,6 @@ jobs:
     name: prose lint (vale)
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint
@@ -108,7 +104,6 @@ jobs:
     name: prose lint (vale, errors)
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint

.forgejo/workflows/coverage.yml

@@ -5,7 +5,7 @@ name: coverage
 #
 # ⚠️ The hour is deliberate: at the default job capacity of 1
 # (`services.hyperhive.deploy.ci-runner.concurrency`) this job holds the
-# runner for its whole timeout and everything else queues behind it.
+# runner for its whole run and everything else queues behind it.
 #
 # Separate from ci.yml because a `workflow_dispatch` trigger there fires every
 # job in that file, and this must not run per pull request.
@@ -19,10 +19,9 @@ jobs:
     name: cargo llvm-cov
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    # Above the 30 min `nix flake check` allows, because instrumented
+    # Instrumented builds are slower than the ordinary ones and this starts
-    # builds are slower than the ordinary ones and this starts from a
+    # from a cache that the normal jobs never populate. The runner's
-    # cache that the normal jobs never populate.
+    # `jobTimeout` (default 1h) is the only bound; a longer run is killed.
-    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v3
       - name: coverage

.forgejo/workflows/flake-update.yml

@@ -24,7 +24,6 @@ jobs:
     name: nix flake update
     if: vars.PUBLIC_FORGE != 'true'
     runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
-    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3
       - name: update and open a PR if the lock changed

nix/devshell.nix

@@ -1,6 +1,6 @@
 # Dev shell: the rust toolchain plus the exact native build inputs
 # the crane derivations use (git, sqlite, pkg-config, cmake — see
-# ../rust.nix), so a plain `cargo build` / `cargo test` in the shell
+# ./rust.nix), so a plain `cargo build` / `cargo test` in the shell
 # sees the same toolchain shape as CI.
 { pkgs, rust }:
 {
@@ -46,8 +46,8 @@
     #
     # Coverage is deliberately NOT part of `nix flake check`: an
     # instrumented build cannot reuse the normal test artifacts, so it
-    # roughly doubles a test job. It runs on manual dispatch — see
+    # roughly doubles a test job. It runs nightly and on manual dispatch — see
-    # .forgejo/workflows/coverage.yml for why that rather than nightly.
+    # .forgejo/workflows/coverage.yml.
     LLVM_PROFDATA = "${pkgs.llvmPackages.llvm}/bin/llvm-profdata";
     LLVM_COV = "${pkgs.llvmPackages.llvm}/bin/llvm-cov";
   };

nix/host-modules/hive-forge/default.nix

@@ -143,8 +143,8 @@ in
   # view: the names and ports it answers on, the URLs it advertises, and the
   # client id it is registered under. What lives here is what the host running
   # it decides — which build it runs, how it is served, what it mirrors, and
-  # where its host-local secrets sit. Same rule as ./swarm-victorialogs.nix,
+  # where its host-local secrets sit. Same rule as ../swarm-victorialogs.nix,
-  # and the renames are in ./deploy.nix with the rest.
+  # and the renames are in ../deploy.nix with the rest.
   options.services.hyperhive.deploy.forgejo = {
     package = lib.mkOption {
       type = lib.types.package;

nix/host-modules/hive-tls.nix

@@ -40,7 +40,7 @@ let
   # reach the store, and waiting on a login to that store would take that
   # path down whenever it is sealed. There the gateway starts on the hive
   # leaf, or on a host without a hive on a throwaway self-signed pair
-  # (../hive-gateway/default.nix), and the issuing script re-imports the
+  # (./hive-gateway/default.nix), and the issuing script re-imports the
   # services leaf into the running nginx once it lands.
   #
   # Nor on a host fronting no swarm name: it asks the store for the root
@@ -51,7 +51,7 @@ let
 
   # The hive leaf, `hive-tls-resign` and the hive identity it needs exist only
   # where a hive runs. A gateway host without one serves the swarm-services
-  # leaf in their place (../hive-gateway/default.nix).
+  # leaf in their place (./hive-gateway/default.nix).
   runsHive = hyperhiveCfg.deploy.hive-controller.enable;
 
   # The gateway's own leaf is only issued when the gateway actually serves a

nix/host-modules/swarm-victorialogs-service.nix

@@ -57,8 +57,8 @@ in
         ⚠️ Every swarm container shares the host's network namespace, so
         this is a swarm-wide claim rather than a per-container one — two
         modules picking the same number collide at runtime with no bind
-        error and nothing in any log. `state/eval-port-collisions.sh`
+        error and nothing in any log. No repo-wide
-        checks the class.
+        check catches it.
       '';
     };