Add job runtime caps

Author: kdeldycke

.github/workflows/_release-build.yaml

@@ -61,6 +61,7 @@ jobs:
       github.event_name == 'push'
       && startsWith(github.event.head_commit.message, 'Release `v')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       issues: write
     steps:
@@ -108,6 +109,7 @@ jobs:
   metadata:
     name: 🧬 Project metadata
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
@@ -146,6 +148,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).is_python_project
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -182,6 +185,8 @@ jobs:
         ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix
         || fromJSON(needs.metadata.outputs.metadata).new_commits_matrix }}
     runs-on: ubuntu-26.04
+    # Wider than the default: this job provisions a toolchain, so its runtime tracks how much it has to install.
+    timeout-minutes: 30
     permissions:
       id-token: write
     steps:

.github/workflows/_release-engine.yaml

@@ -44,6 +44,7 @@ jobs:
   metadata:
     name: 🧬 Project metadata
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       has_virustotal_key: ${{ steps.check-vt-key.outputs.has_key }}
       metadata: ${{ steps.metadata.outputs.metadata }}
@@ -486,6 +487,7 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix }}
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -522,6 +524,7 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix }}
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       # Allow project without REPOMATIC_PAT to create a GitHub release.
       contents: write
@@ -598,6 +601,7 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix }}
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       attestations: write
       contents: write
@@ -684,6 +688,7 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix }}
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       attestations: write
       contents: write
@@ -781,6 +786,7 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.metadata.outputs.metadata).release_commits_matrix }}
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -950,6 +956,7 @@ jobs:
       group: sync-dev-release-${{ github.repository }}
       cancel-in-progress: false
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -982,6 +989,7 @@ jobs:
       fromJSON(needs.metadata.outputs.metadata).is_python_project
       && fromJSON(needs.metadata.outputs.metadata).release_commits_matrix
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write

.github/workflows/autofix.yaml

@@ -50,6 +50,7 @@ jobs:
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
       && !startsWith(github.event.head_commit.message || '', '[changelog] ')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       issues: write
     steps:
@@ -75,6 +76,7 @@ jobs:
     # repomatic/runner_images.py for why the announcement feed is the source.
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       issues: write
     steps:
@@ -105,6 +107,7 @@ jobs:
       github.head_ref)
       && !startsWith(github.event.head_commit.message || '', '[changelog] ')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
@@ -131,6 +134,7 @@ jobs:
     # Ruff can format code in both Python and Markdown files.
     if: fromJSON(needs.metadata.outputs.metadata).python_files || fromJSON(needs.metadata.outputs.metadata).doc_files
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -172,6 +176,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).is_python_project
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -209,6 +214,7 @@ jobs:
     # way: `repomatic run mdformat` provisions that through mdformat's
     # `path_tools` instead of apt. See docs/test-matrix.md.
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -251,6 +257,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).shfmt_files
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -285,6 +292,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).json_files
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -321,6 +329,7 @@ jobs:
     if: >
       !startsWith(github.event.head_commit.message || '', '[changelog] ')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -357,6 +366,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).is_python_project
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -392,6 +402,7 @@ jobs:
     if: >
       !startsWith(github.event.head_commit.message || '', '[changelog] ')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -422,6 +433,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).image_files
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -465,6 +477,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).gitignore_exists
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -489,6 +502,7 @@ jobs:
     # ([tool.uv] package = false) has a [project] table but nothing to version.
     if: fromJSON(needs.metadata.outputs.metadata).is_python_package
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -511,6 +525,7 @@ jobs:
       - metadata
     if: fromJSON(needs.metadata.outputs.metadata).mailmap_exists
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -558,6 +573,7 @@ jobs:
     needs:
       - metadata
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -704,6 +720,7 @@ jobs:
       fromJSON(needs.metadata.outputs.metadata).is_python_project
       && fromJSON(needs.metadata.outputs.metadata).active_autodoc
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write

.github/workflows/autolock.yaml

@@ -27,6 +27,8 @@ jobs:
   lock:
     name: 🔒 Lock inactive threads
     runs-on: ubuntu-26.04
+    # Wider than the default: this job provisions a toolchain, so its runtime tracks how much it has to install.
+    timeout-minutes: 30
     permissions:
       contents: read
       issues: write

.github/workflows/cancel-runs.yaml

@@ -32,6 +32,7 @@ jobs:
     name: ✂️ Cancel PR runs
     if: github.event.pull_request.number
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       actions: write
     steps:

.github/workflows/changelog.yaml

@@ -72,6 +72,7 @@ jobs:
       github.event_name == 'push' ||
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
@@ -103,6 +104,7 @@ jobs:
       github.event_name == 'workflow_run'
       || !fromJSON(needs.metadata.outputs.metadata).release_commits_matrix
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -134,6 +136,7 @@ jobs:
       - metadata
     # Always run since metadata already filters appropriate events.
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -218,6 +221,7 @@ jobs:
     # the branch is already current, so the extra run is cheap and idempotent.
     if: github.event_name != 'schedule'
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write

.github/workflows/debug.yaml

@@ -41,6 +41,7 @@ jobs:
   metadata:
     name: 🧬 Project metadata
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       build_targets: ${{ steps.extend-matrix.outputs.targets }}
     steps:
@@ -75,6 +76,8 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.metadata.outputs.build_targets) }}
     runs-on: ${{ matrix.os }}
+    # Wider than the default: this job provisions a toolchain, so its runtime tracks how much it has to install.
+    timeout-minutes: 30
     steps:
       # `toJSON()` already pretty-prints, so each context reaches the log
       # readable with no jq in the way, which also keeps this step identical on

.github/workflows/docs.yaml

@@ -43,6 +43,7 @@ jobs:
   metadata:
     name: 🧬 Project metadata
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
@@ -65,6 +66,8 @@ jobs:
       fromJSON(needs.metadata.outputs.metadata).is_python_project
       && fromJSON(needs.metadata.outputs.metadata).is_sphinx
     runs-on: ubuntu-26.04
+    # Wider than the default: this job provisions a toolchain, so its runtime tracks how much it has to install.
+    timeout-minutes: 30
     permissions:
       id-token: write
       pages: write
@@ -125,6 +128,11 @@ jobs:
     # once ran on a lean image with a 15-minute job cap, which killed the whole
     # crawl outright rather than failing a step.
     runs-on: ubuntu-26.04-arm
+    # Widest cap in the repository, for the reason just above: this crawl is the
+    # one job whose runtime is set by other people's servers. Triple the 15
+    # minutes that already killed it once, against a measured 10.4-minute worst
+    # case, so the growth has somewhere to go.
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0

.github/workflows/labels.yaml

@@ -55,6 +55,7 @@ jobs:
       github.head_ref)
       && !startsWith(github.event.head_commit.message || '', '[changelog] ')
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     outputs:
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
@@ -74,6 +75,7 @@ jobs:
     # Restrict job to the main branch pushes and workflow calls only, as this is a project-management task.
     if: github.event_name == 'push' || github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       issues: write
     steps:
@@ -102,6 +104,7 @@ jobs:
       (github.event_name == 'pull_request' || github.event_name == 'issues')
       && (! fromJSON(needs.metadata.outputs.metadata).is_bot)
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       contents: read
       issues: write
@@ -126,6 +129,7 @@ jobs:
       (github.event_name == 'pull_request' || github.event_name == 'issues')
       && (! fromJSON(needs.metadata.outputs.metadata).is_bot)
     runs-on: ubuntu-26.04
+    timeout-minutes: 15
     permissions:
       issues: write
       pull-requests: write