Enforce explicit job and step timeouts on Visual Regression Checker workflow

.github/workflows/visual-regression-checker.md

@@ -35,7 +35,11 @@ network:
     - playwright
     - local
     - node
+jobs:
+  agent:
+    timeout-minutes: 15
 safe-outputs:
+  timeout-minutes: 10
   add-comment:
     max: 1
 timeout-minutes: 15
@@ -54,10 +58,12 @@ steps:
 
   - name: Install dependencies
     working-directory: ./docs
+    timeout-minutes: 5
     run: npm ci
 
   - name: Build documentation
     working-directory: ./docs
+    timeout-minutes: 5
     run: npm run build
 
   - name: Start docs server
@@ -70,6 +76,7 @@ steps:
 
   - name: Wait for server readiness
     # runner-guard:ignore RGS-012 -- loopback-only port/readiness checks for the docs server started in this job; no external network or secrets are involved.
+    timeout-minutes: 2
     run: |
       MAX_WAIT=90
       WAITED=0

pkg/workflow/step_types.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"math"
 	"strconv"
 
 	"github.com/github/gh-aw/pkg/importinpututil"
@@ -117,34 +118,13 @@ func MapToStep(stepMap map[string]any) (*WorkflowStep, error) {
 		step.With = with
 	}
 	if env, ok := stepMap["env"].(map[string]any); ok {
-		// Convert map[string]any to map[string]string
-		step.Env = make(map[string]string)
-		for k, v := range env {
-			if strVal, ok := v.(string); ok {
-				step.Env[k] = strVal
-			} else if v != nil {
-				// Arrays and maps are serialized as JSON so that shell consumers
-				// (e.g. jq --argjson) receive valid JSON. This handles both the
-				// []any / map[string]any case returned by encoding/json and the
-				// typed-slice case (e.g. []string) returned by goccy/go-yaml.
-				step.Env[k] = marshalEnvValue(v)
-			}
-		}
+		step.Env = parseStepEnv(env)
 	}
 	if continueOnError, ok := stepMap["continue-on-error"]; ok {
-		switch value := continueOnError.(type) {
-		case bool:
-			templatableValue := TemplatableBool(strconv.FormatBool(value))
-			step.ContinueOnError = &templatableValue
-		case string:
-			if value == "true" || value == "false" || isExpression(value) {
-				templatableValue := TemplatableBool(value)
-				step.ContinueOnError = &templatableValue
-			}
-		}
+		step.ContinueOnError = parseStepContinueOnError(continueOnError)
 	}
-	if timeoutMinutes, ok := stepMap["timeout-minutes"].(int); ok {
-		step.TimeoutMinutes = timeoutMinutes
+	if timeoutMinutesVal, ok := stepMap["timeout-minutes"]; ok {
+		step.TimeoutMinutes = parseStepTimeoutMinutes(timeoutMinutesVal)
 	}
 
 	stepType := "unknown"
@@ -157,6 +137,56 @@ func MapToStep(stepMap map[string]any) (*WorkflowStep, error) {
 	return step, nil
 }
 
+func parseStepEnv(env map[string]any) map[string]string {
+	result := make(map[string]string)
+	for k, v := range env {
+		if strVal, ok := v.(string); ok {
+			result[k] = strVal
+		} else if v != nil {
+			result[k] = marshalEnvValue(v)
+		}
+	}
+	return result
+}
+
+func parseStepContinueOnError(val any) *TemplatableBool {
+	switch value := val.(type) {
+	case bool:
+		templatableValue := TemplatableBool(strconv.FormatBool(value))
+		return &templatableValue
+	case string:
+		if value == "true" || value == "false" || isExpression(value) {
+			templatableValue := TemplatableBool(value)
+			return &templatableValue
+		}
+	}
+	return nil
+}
+
+func parseStepTimeoutMinutes(val any) int {
+	switch v := val.(type) {
+	case int:
+		return v
+	case int64:
+		if v > 0 && v <= int64(math.MaxInt) {
+			return int(v)
+		}
+	case uint64:
+		if v <= uint64(math.MaxInt) {
+			return int(v)
+		}
+	case float64:
+		if v > 0 && v <= float64(math.MaxInt) {
+			return int(v)
+		}
+	case string:
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return 0
+}
+
 // Clone creates a deep copy of the WorkflowStep
 func (s *WorkflowStep) Clone() *WorkflowStep {
 	clone := &WorkflowStep{

pkg/workflow/step_types_test.go

@@ -663,6 +663,33 @@ func TestSliceToSteps_RoundTrip(t *testing.T) {
 	}
 }
 
+func TestMapToStep_TimeoutMinutesNumericTypes(t *testing.T) {
+	tests := []struct {
+		name string
+		val  any
+		want int
+	}{
+		{"int", 5, 5},
+		{"int64", int64(10), 10},
+		{"uint64", uint64(15), 15},
+		{"float64", float64(20), 20},
+		{"string", "25", 25},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stepMap := map[string]any{
+				"name":            "Test",
+				"run":             "echo test",
+				"timeout-minutes": tt.val,
+			}
+			step, err := MapToStep(stepMap)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, step.TimeoutMinutes)
+		})
+	}
+}
+
 func TestMapToStep_InvalidTypes(t *testing.T) {
 	tests := []struct {
 		name        string