docs: recommend self-hosted runner with higher timeout for long scans

README.md

@@ -50,7 +50,7 @@ jobs:
 
 ### Job timeout
 
-A job gets 6 hours by default (`timeout-minutes` defaults to `360`), which is enough for Shannon.
+A job gets 6 hours by default (`timeout-minutes` defaults to `360`), which is enough for most scans. For larger repositories or slower model providers a scan can take longer than 6 hours; since GitHub-hosted runners are capped at 6 hours, a self-hosted runner is recommended for those.
 
 ## Examples
 
@@ -110,7 +110,7 @@ with:
 | `api-key` | | - | LLM provider API key (`SHANNON_AI_API_KEY`) for any non-Bedrock provider, including the default Anthropic model. |
 | `aws-bearer-token-bedrock` | | - | Amazon Bedrock bearer token (`AWS_BEARER_TOKEN_BEDROCK`). Required for `model: amazon-bedrock:...`. |
 | `aws-region` | | - | AWS region for Bedrock (`AWS_REGION`). Required for `model: amazon-bedrock:...`. |
-| `version` | | `2.6.0` | Version of the `@keygraph/shannon` npm package to run. |
+| `version` | | `3.0.0` | Version of the `@keygraph/shannon` npm package to run. |
 | `pipeline-testing` | | `false` | Minimal prompts for fast pipeline testing. |
 | `fail-on-severity` | | `none` | Fail the job if any exploited finding is at or above this severity: `none`, `low`, `medium`, `high`, `critical`. See [Pass / fail](#pass--fail). |
 | `upload-sarif` | | `false` | Upload `report.sarif` (when produced) to GitHub code scanning. Requires `security-events: write`. |

action.yml

@@ -49,7 +49,7 @@ inputs:
   version:
     description: 'Version of the @keygraph/shannon npm package to run.'
     required: false
-    default: '2.6.0'
+    default: '3.0.0'
   pipeline-testing:
     description: 'Run with minimal prompts for fast pipeline testing.'
     required: false

examples/pr-scan.yml

@@ -10,6 +10,10 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    # For larger repos or slower model providers, use a self-hosted runner (GitHub-hosted caps at 6h):
+    # https://docs.github.com/actions/hosting-your-own-runners/adding-self-hosted-runners
+    # runs-on: [self-hosted, linux]
+    # timeout-minutes: 720
     steps:
       - uses: actions/checkout@v4
 

examples/release-scan.yml

@@ -12,6 +12,10 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    # For larger repos or slower model providers, use a self-hosted runner (GitHub-hosted caps at 6h):
+    # https://docs.github.com/actions/hosting-your-own-runners/adding-self-hosted-runners
+    # runs-on: [self-hosted, linux]
+    # timeout-minutes: 720
     steps:
       - uses: actions/checkout@v4
 

examples/weekly-scan.yml

@@ -13,6 +13,10 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    # For larger repos or slower model providers, use a self-hosted runner (GitHub-hosted caps at 6h):
+    # https://docs.github.com/actions/hosting-your-own-runners/adding-self-hosted-runners
+    # runs-on: [self-hosted, linux]
+    # timeout-minutes: 720
     steps:
       - uses: actions/checkout@v4