SandObserver · Aug 30, 2026 · Aug 30, 2026
diff --git a/.github/workflows/ca-template-changes.yml b/.github/workflows/ca-template-changes.yml
@@ -11,6 +11,7 @@ permissions: {}
 jobs:
   update:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app

diff --git a/.github/workflows/ca-template-check.yml b/.github/workflows/ca-template-check.yml
@@ -23,6 +23,7 @@ permissions:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -11,6 +11,7 @@ on:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       actions: read
       contents: read

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -33,6 +33,7 @@ permissions:
 jobs:
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml
@@ -19,6 +19,7 @@ concurrency:
 jobs:
   prep:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app

diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
@@ -18,6 +18,7 @@ concurrency:
 jobs:
   tag:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Mint a token for the release app
         id: app

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ jobs:
   build-and-push:
     needs: e2e
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -246,6 +247,7 @@ jobs:
   release-page:
     needs: build-and-push
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     # Every write here is the app token's.
     permissions: {}
     outputs:
@@ -308,6 +310,7 @@ jobs:
     needs: release-page
     if: needs.release-page.outputs.prerelease == 'false'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions: {}
     steps:
       - name: Request a documentation site rebuild

diff --git a/.github/workflows/scan-published.yml b/.github/workflows/scan-published.yml
@@ -17,6 +17,7 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       # Both published platforms, and one failing must not hide the other.
       fail-fast: false

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-Original file line number
+Diff line change
@@ Expand Up / @@ -11,6 +11,7 @@ permissions: {} @@
     jobs:
       update:
         runs-on: ubuntu-latest
+        timeout-minutes: 10
         steps:
           - name: Mint a token for the release app
             id: app
@@ Expand Down @@