ci: rework test workflows

.github/workflows/actionlint.yml

@@ -30,6 +30,7 @@ permissions:
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     name: actionlint
     steps:
       - uses: actions/checkout@v4

.github/workflows/almalinux-8-build.yml

@@ -24,9 +24,13 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     container:
       image: almalinux:8
     name: Test rsync on AlmaLinux 8

.github/workflows/android-static-build.yml

@@ -28,6 +28,9 @@ on:
     - cron: '42 8 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   # Minimum supported API level. 24 (Android 7.0) runs on every modern
   # phone while keeping broad reach; bump if you need newer Bionic APIs.
@@ -36,6 +39,7 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: ${{ matrix.abi }}
     strategy:
       fail-fast: false

.github/workflows/asan-build.yml

@@ -23,9 +23,13 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   asan:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: rsync ASan+UBSan (clang)
     env:
       # rsync intentionally leaks small allocations at process exit, so leak

.github/workflows/coverage.yml

@@ -4,24 +4,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+# Coverage duplicates the Ubuntu suite to measure it rather than protect a
+# distinct PR failure mode. Keep that cost scheduled and available on demand.
 on:
-  push:
-    branches: [ master ]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/coverage.yml'
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/coverage.yml'
   schedule:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: gcov coverage
     steps:
     - uses: actions/checkout@v4

.github/workflows/cygwin-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: windows-2022
+    timeout-minutes: 60
     name: Test rsync on Cygwin
     steps:
     - uses: actions/checkout@v4

.github/workflows/fleettest.yml

@@ -31,9 +31,13 @@ on:
   schedule:
     - cron: '17 7 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   fleettest:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: fleettest against localhost
     steps:
     - uses: actions/checkout@v4

.github/workflows/freebsd-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on FreeBSD
     steps:
     - uses: actions/checkout@v4

.github/workflows/macos-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: macos-latest
+    timeout-minutes: 45
     name: Test rsync on macOS
     steps:
     - uses: actions/checkout@v4

.github/workflows/netbsd-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on NetBSD
     steps:
     - uses: actions/checkout@v4

.github/workflows/openbsd-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on OpenBSD
     steps:
     - uses: actions/checkout@v4

.github/workflows/scan-build.yml

@@ -17,6 +17,9 @@ on:
       - '!.github/workflows/scan-build.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # GATING run: pinned clang-18 on a pinned runner so the checker set -- and
   # thus the expected zero -- is deterministic.  The tree is kept clean for
@@ -25,6 +28,7 @@ jobs:
   # and the runner (ubuntu-24.04, whose apt repos carry those packages).
   gate-clang18:
     runs-on: ubuntu-24.04
+    timeout-minutes: 45
     name: scan-build gate (clang-18, pinned)
     steps:
     - uses: actions/checkout@v4
@@ -66,6 +70,7 @@ jobs:
   # broken run from affecting the workflow's required status.
   informational-latest:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: scan-build (latest clang, informational)
     continue-on-error: true
     steps:

.github/workflows/solaris-build.yml

@@ -18,9 +18,13 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on Solaris
     steps:
     - uses: actions/checkout@v4

.github/workflows/ubuntu-build.yml

@@ -18,10 +18,26 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-latest
-    name: Test rsync on Ubuntu
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            name: Test rsync on Ubuntu latest
+            artifact: ubuntu-bin
+            nonroot: true
+          - runner: ubuntu-22.04
+            name: Test rsync on Ubuntu 22.04
+            artifact: ubuntu-22.04-bin
+            nonroot: false
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    name: ${{ matrix.name }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -51,6 +67,7 @@ jobs:
       # is env-dependent here (chroot-acl), so leave RSYNC_EXPECT_SKIPPED unset.
       run: sudo ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
     - name: check (non-root, targeted)
+      if: matrix.nonroot
       # Every run above is root (sudo), so privilege-sensitive tests never hit
       # their non-root path. Run those here as the unprivileged 'runner' user
       # (NO sudo). Explicit test names make runtests.py full_run False, so
@@ -72,7 +89,7 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         retention-days: 45
-        name: ubuntu-bin
+        name: ${{ matrix.artifact }}
         path: |
           rsync
           rsync-ssl

.github/workflows/ubuntu-version-mix.yml

@@ -39,9 +39,13 @@ on:
   schedule:
     - cron: '52 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   version-mix:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: rsync version-mix
     steps:
     - uses: actions/checkout@v4

.github/workflows/valgrind.yml

@@ -4,25 +4,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+# ASan+UBSan remains the per-PR memory-safety gate. Run the four slower
+# Valgrind combinations daily and on demand instead of occupying PR runners.
 on:
-  push:
-    branches: [ master ]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/valgrind.yml'
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/valgrind.yml'
   schedule:
     - cron: '17 4 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   memcheck:
     runs-on: ubuntu-latest
-    timeout-minutes: 120
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix: