From f5e11cdcab53fffb903721aeee3b012e706c7ca9 Mon Sep 17 00:00:00 2001
From: AminDhouib <amin@devino.ca>
Date: Tue, 15 Sep 2026 20:24:33 -0400
Subject: [PATCH] ci: add per-job timeout-minutes to every workflow job

No job in this repository declared timeout-minutes, so a wedged step
could hold a runner until the 6 h Actions default. Each job now carries
an explicit ceiling. The rule is 3 x the observed p90 duration rounded
up to the nearest 5 minutes; every job below was unobserved in the 72 h
of run history, so each takes its class default.

.github/workflows/ci.yml
  build-and-import      30  class default (build)
  lint                  15  class default (lint)
  spec-parity           20  class default (unit-test)
  test                  20  class default (unit-test)
  typecheck             15  class default (typecheck)

.github/workflows/publish.yml
  build-and-publish     30  class default (build)

.github/workflows/smoke.yml
  smoke                 20  class default (unit-test)

.github/workflows/spec-drift.yml
  check                 30  class default (other)

No concurrency edit was planned for this repository.
ci.yml already declares group: ci-${{ github.ref }}, cancel-in-progress: true.
---
 .github/workflows/ci.yml         | 5 +++++
 .github/workflows/publish.yml    | 1 +
 .github/workflows/smoke.yml      | 1 +
 .github/workflows/spec-drift.yml | 1 +
 4 files changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f668ebd..5cf1f4d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -24,6 +25,7 @@ jobs:
 
   typecheck:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -37,6 +39,7 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
@@ -55,6 +58,7 @@ jobs:
 
   spec-parity:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -67,6 +71,7 @@ jobs:
 
   build-and-import:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8ef8284..8e674e1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,7 @@ on:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     environment: pypi
     permissions:
       id-token: write # required for PyPI trusted publishing
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 68745ff..89987a9 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -9,6 +9,7 @@ on:
 jobs:
   smoke:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
diff --git a/.github/workflows/spec-drift.yml b/.github/workflows/spec-drift.yml
index b493259..5a4f79e 100644
--- a/.github/workflows/spec-drift.yml
+++ b/.github/workflows/spec-drift.yml
@@ -16,6 +16,7 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5