ci: bound all 16 unbounded workflow jobs on main with timeout-minutes

.github/workflows/beta-release.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/code-quality.yml

@@ -12,6 +12,11 @@ jobs:
   php-checks:
     name: ${{ matrix.check.name }}
     runs-on: ubuntu-latest
+    # One job-level bound covers every matrix leg, so it must clear the
+    # SLOWEST leg. Lint/PHPCS/PHPMD/Psalm/PHPStan run ~4 min, but the PHPUnit
+    # leg has been observed at 18.9 min while SUCCEEDING — a 20 bound would
+    # leave ~6% headroom and turn a slow-but-healthy run into a red check.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -49,6 +54,8 @@ jobs:
   frontend-quality:
     name: Frontend Quality
     runs-on: ubuntu-latest
+    # Observed max 5.3 min across 49 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout

.github/workflows/documentation.yml

@@ -12,6 +12,8 @@ jobs:
   deploy:
     name: Deploy Documentation
     runs-on: ubuntu-latest
+    # Observed max 2.5 min across 23 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
     if: github.event_name == 'push'
     permissions:
       contents: write

.github/workflows/pr-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   check-branch:
     runs-on: ubuntu-latest
+    # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom.
+    timeout-minutes: 10
     steps:
       - name: Check branch
         run: |

.github/workflows/pull-request-from-branch-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   check-branch:
     runs-on: ubuntu-latest
+    # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom.
+    timeout-minutes: 10
     steps:
       - name: Check branch
         run: |

.github/workflows/pull-request-lint-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   lint-check:
     runs-on: ubuntu-latest
+    # Observed max 1.4 min across 176 fleet runs; 15 leaves ample headroom.
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository

.github/workflows/push-development-to-beta.yaml

@@ -12,6 +12,8 @@ on:
 jobs:
   create-pr:
     runs-on: ubuntu-latest
+    # Observed max 5.6 min across 152 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-beta.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-stable.yaml

@@ -14,6 +14,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -149,6 +152,8 @@ jobs:
 
   update-changelog:
     runs-on: ubuntu-latest
+    # Observed ~0.2 min; 15 leaves ample headroom.
+    timeout-minutes: 15
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-unstable.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-workflow.yaml

@@ -15,6 +15,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/sync-beta.yaml

@@ -12,6 +12,8 @@ on:
 jobs:
   sync-to-beta-release:
     runs-on: ubuntu-latest
+    # Branch-sync job; fleet sync jobs run well under a minute. 20 is generous.
+    timeout-minutes: 20
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/sync-dev.yaml

@@ -11,6 +11,8 @@ on:
 jobs:
   sync-to-development-release:
     runs-on: ubuntu-latest
+    # Branch-sync job; fleet sync jobs run well under a minute. 20 is generous.
+    timeout-minutes: 20
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/unstable-release.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code