From 52f6c7347878ecf39000f48e2edb41d49a8e1932 Mon Sep 17 00:00:00 2001
From: yeasy <yangbaohua@gmail.com>
Date: Thu, 23 Jul 2026 08:26:48 -0700
Subject: [PATCH] ci: bound every workflow job with timeout-minutes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A wedged Chrome/mdPress step held a harness runner for 27 minutes yesterday
(normal run: ~4 min) and ignored `gh run cancel`; it only stopped because that
job happened to carry timeout-minutes: 30. An audit found 66 of the 101 jobs
across the cluster had no timeout at all — the same hang there would have held
a runner for GitHub's 6-hour default.

Values come from measured run history, not guesses. Across ~120 successful
runs the slowest workflow tops out at 10 min (Update Preview Publications),
CI at 6.5, Update Preview PDF at 4.8:

  30 min — jobs that run Chrome/mdPress/pandoc (3x the observed max, and the
           value harness already used)
  15 min — release, publish, deploy, check-link, chaincode-tests
  10 min — dependabot auto-merge

Every value has at least 6x headroom over its job's observed maximum, so this
should never turn a slow-but-working run into a failure.

Verified: all 72 workflow files still parse, and all 101 jobs now carry an
integer timeout in range.
---
 .github/workflows/auto-release.yml         | 2 ++
 .github/workflows/check-link.yml           | 1 +
 .github/workflows/ci.yaml                  | 1 +
 .github/workflows/dependabot-automerge.yml | 1 +
 .github/workflows/pages.yml                | 2 ++
 .github/workflows/preview-pdf.yml          | 2 ++
 6 files changed, 9 insertions(+)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index d9c7c50..9e0c593 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -13,6 +13,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -134,6 +135,7 @@ jobs:
       attestations: write
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Download verified release bundle
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/check-link.yml b/.github/workflows/check-link.yml
index c460b2c..14c6942 100644
--- a/.github/workflows/check-link.yml
+++ b/.github/workflows/check-link.yml
@@ -9,6 +9,7 @@ permissions:
 jobs:
   check-link:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6f27823..de734e5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -14,6 +14,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 2d23065..fddb46e 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -10,6 +10,7 @@ jobs:
       pull-requests: write
       checks: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.actor == 'dependabot[bot]'
     steps:
       - name: Dependabot metadata
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index ea2127e..4ea11dc 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -19,6 +19,7 @@ jobs:
       contents: read
       pages: read
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -75,6 +76,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Deploy Pages
         id: deployment
diff --git a/.github/workflows/preview-pdf.yml b/.github/workflows/preview-pdf.yml
index 63cd267..91592be 100644
--- a/.github/workflows/preview-pdf.yml
+++ b/.github/workflows/preview-pdf.yml
@@ -17,6 +17,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -88,6 +89,7 @@ jobs:
       contents: write
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}