ci: add per-job timeout backstops

.github/workflows/ci.yml

@@ -18,6 +18,9 @@ concurrency:
 jobs:
   lint-typecheck:
     runs-on: ubuntu-latest
+    # Backstop so a wedged step can't pin the runner until GitHub's ~6h
+    # default. Generous vs. the ~1-2min this job actually takes.
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       # pnpm version is read from `packageManager` in root package.json.
@@ -37,6 +40,7 @@ jobs:
 
   test-unit:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       # pnpm version is read from `packageManager` in root package.json.
@@ -55,6 +59,9 @@ jobs:
 
   test-browser:
     runs-on: ubuntu-latest
+    # Higher cap: a hung Playwright/chromium page is the most likely
+    # thing to wedge, and the chromium download adds cold-start time.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       # pnpm version is read from `packageManager` in root package.json.
@@ -76,6 +83,7 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       # pnpm version is read from `packageManager` in root package.json.

.github/workflows/release.yml

@@ -44,6 +44,9 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Full suite + browser tests + rebuild + npm publish in one job.
+    # Backstop against a wedged test/publish holding the runner open.
+    timeout-minutes: 25
     steps:
       - name: Checkout
         uses: actions/checkout@v4