ci: put a clock on every job

[lens0021]

Not one job in this repository carried timeout-minutes, so each of them was free to wait out GitHub's six-hour default. On 2026-08-18 one did.

What happened

The smoke job on #469 ran for six hours and was killed by the platform. It did not fail — it stalled, in playwright install --with-deps, which runs apt. The runner's Ubuntu mirror stopped answering:

15:56:12  Ign:3 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease
15:56:14  Ign:2 ...                                        (retrying)
15:56:18  Ign:2 ...                                        (retrying)
15:56:19  Hit:2 https://archive.ubuntu.com/ubuntu noble InRelease
15:56:20  Get:5 https://archive.ubuntu.com/ubuntu noble-security InRelease [126 kB]
21:51:59  ##[error]The operation was canceled.

apt fell back to archive.ubuntu.com, fetched the release files, and then produced nothing for the next five hours and fifty-five minutes. The orphan the runner reaped on the way out names the culprit:

Terminate orphan process: pid (4405) (npm exec playwright install --with-deps chromium)

Whether a mirror answers is not ours to decide. How long we wait to hear that it did not is.

What this changes

Every job gets roughly three times what it has been taking, so a stall is reported in minutes while a slow but healthy run never trips it.

job	minutes	recently takes
the ten linters, semantic-pull-request	10	5–25 s
caddy, check-translations, deploy-pages, release-please, prepare	15	under a minute
phpunit, plan, updatecli	20	35–90 s
phan, coverage, preview, docker-image, smoke, publish	30	2–10 min
binary	60	~9 min per arch, on native runners

The rationale lives in smoke.yml, next to the job that earned it, rather than repeated fourteen times.

Not changed

The three jobs that call a reusable workflow — nightly.yml's binary, release-please.yml's binary and docker — are left alone. A job with uses: cannot carry timeout-minutes; they take the timeout of the job they call, which binary.yml and docker-image.yml now have.

This does not stop the stall, and it is not a retry. It is only the difference between hearing about one in twenty minutes and in six hours.

Checked

uv run --frozen --group lint yamllint --strict . passes, which is the command the yamllint job runs.

---

Generated by Claude Code

[github-actions]

OpenTofu Plan

github_repository.this: Refreshing state... [id=wikven]
github_repository_pages.this: Refreshing state... [id=436976489]
github_repository_ruleset.default: Refreshing state... [id=17638220]

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

View run