From 904b121c5b749e8e7b6a8660a647cd2074d087f9 Mon Sep 17 00:00:00 2001
From: SandObserver <260779319+SandObserver@users.noreply.github.com>
Date: Sun, 30 Aug 2026 14:50:48 -0400
Subject: [PATCH] Add a timeout to every workflow job

Without timeout-minutes a hung job holds a runner for the 360-minute
default. Each limit is set well above the job's observed runtime.
---
 .github/workflows/ca-template-changes.yml | 1 +
 .github/workflows/ca-template-check.yml   | 1 +
 .github/workflows/codeql.yml              | 1 +
 .github/workflows/e2e.yml                 | 1 +
 .github/workflows/release-prep.yml        | 1 +
 .github/workflows/release-tag.yml         | 1 +
 .github/workflows/release.yml             | 3 +++
 .github/workflows/scan-published.yml      | 1 +
 .github/workflows/test.yml                | 1 +
 9 files changed, 11 insertions(+)

diff --git a/.github/workflows/ca-template-changes.yml b/.github/workflows/ca-template-changes.yml
index aac93da0..5ebce35e 100644
--- a/.github/workflows/ca-template-changes.yml
+++ b/.github/workflows/ca-template-changes.yml
@@ -11,6 +11,7 @@ permissions: {}
 jobs:
   update:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app
diff --git a/.github/workflows/ca-template-check.yml b/.github/workflows/ca-template-check.yml
index 0af9c019..1598db8d 100644
--- a/.github/workflows/ca-template-check.yml
+++ b/.github/workflows/ca-template-check.yml
@@ -23,6 +23,7 @@ permissions:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4e178d31..55ec033c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,7 @@ on:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 52815ccf..3a44b8cf 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -33,6 +33,7 @@ permissions:
 jobs:
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml
index 72dca1af..b2b0cadd 100644
--- a/.github/workflows/release-prep.yml
+++ b/.github/workflows/release-prep.yml
@@ -19,6 +19,7 @@ concurrency:
 jobs:
   prep:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 5e0cf39e..b3b96ae5 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -18,6 +18,7 @@ concurrency:
 jobs:
   tag:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20362c72..9a7d4881 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ jobs:
   build-and-push:
     needs: e2e
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -246,6 +247,7 @@ jobs:
   release-page:
     needs: build-and-push
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     # Every write here is the app token's.
     permissions: {}
     outputs:
@@ -308,6 +310,7 @@ jobs:
     needs: release-page
     if: needs.release-page.outputs.prerelease == 'false'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions: {}
     steps:
       - name: Request a documentation site rebuild
diff --git a/.github/workflows/scan-published.yml b/.github/workflows/scan-published.yml
index 99b2e809..e24a17f8 100644
--- a/.github/workflows/scan-published.yml
+++ b/.github/workflows/scan-published.yml
@@ -17,6 +17,7 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       # Both published platforms, and one failing must not hide the other.
       fail-fast: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 05373f90..b377e261 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1