From e632cc27250c584fa1cd1f0866f4c05e3cf153da Mon Sep 17 00:00:00 2001
From: AminDhouib <amin@devino.ca>
Date: Tue, 15 Sep 2026 20:22:10 -0400
Subject: [PATCH] ci: add per-job timeout-minutes to every workflow job

No job in this repository declared timeout-minutes, so a wedged step
could hold a runner until the 6 h Actions default. Each job now carries
an explicit ceiling. The rule is 3 x the observed p90 duration rounded
up to the nearest 5 minutes; every job below was unobserved in the 72 h
of run history, so each takes its class default.

.github/workflows/ci.yml
  build-and-import      30  class default (build)
  e2e                   45  class default (e2e)
  lint                  15  class default (lint)
  test                  20  class default (unit-test)
  typecheck             15  class default (typecheck)

.github/workflows/publish.yml
  assert-version        30  class default (other)
  build-and-publish     30  class default (build)
  verify                20  class default (unit-test)

.github/workflows/spec-drift.yml
  drift                 30  class default (other)

No concurrency edit was planned for this repository.
ci.yml already declares group: ci-${{ github.ref }}, cancel-in-progress: true.
---
 .github/workflows/ci.yml         | 5 +++++
 .github/workflows/publish.yml    | 3 +++
 .github/workflows/spec-drift.yml | 1 +
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc02b76..b4cdc0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -22,6 +23,7 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
@@ -41,6 +43,7 @@ jobs:
 
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     needs: [lint, test]
     steps:
       - uses: actions/checkout@v4
@@ -62,6 +65,7 @@ jobs:
 
   typecheck:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -77,6 +81,7 @@ jobs:
 
   build-and-import:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9ec3129..c7eeb85 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,6 +29,7 @@ permissions:
 jobs:
   assert-version:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
@@ -54,6 +55,7 @@ jobs:
   verify:
     needs: assert-version
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -71,6 +73,7 @@ jobs:
   build-and-publish:
     needs: [assert-version, verify]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     environment: pypi
     permissions:
       id-token: write # required for PyPI trusted publishing
diff --git a/.github/workflows/spec-drift.yml b/.github/workflows/spec-drift.yml
index 22df5cd..547b5c1 100644
--- a/.github/workflows/spec-drift.yml
+++ b/.github/workflows/spec-drift.yml
@@ -16,6 +16,7 @@ permissions:
 jobs:
   drift:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5