ci: put a clock on every job

.github/workflows/binary.yml

@@ -34,6 +34,7 @@ jobs:
       matrix:
         arch: ${{ case(inputs.tag != '', fromJSON('["x86_64", "aarch64"]'), fromJSON('["x86_64"]')) }}
     runs-on: ${{ case(matrix.arch == 'aarch64', 'ubuntu-24.04-arm', 'ubuntu-latest') }}
+    timeout-minutes: 60
     permissions:
       contents: write  # gh release upload
       id-token: write  # sign the build provenance attestation

.github/workflows/deploy-docs.yml

@@ -28,6 +28,7 @@ concurrency:
 jobs:
   deploy-pages:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/docker-image.yml

@@ -29,6 +29,7 @@ concurrency:
 jobs:
   docker-image:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/lint.yml

@@ -19,6 +19,7 @@ concurrency:
 jobs:
   biome:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -57,6 +58,7 @@ jobs:
 
   rumdl:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -65,6 +67,7 @@ jobs:
 
   taplo:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -77,6 +80,7 @@ jobs:
 
   yamllint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -86,6 +90,7 @@ jobs:
 
   mago:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -104,6 +109,7 @@ jobs:
 
   zizmor:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       security-events: write
     steps:
@@ -114,6 +120,7 @@ jobs:
 
   typos:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -123,6 +130,7 @@ jobs:
   # MediaWiki coding-standard checks mago doesn't cover: docs, naming, and forbidden patterns.
   phpcs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -142,6 +150,7 @@ jobs:
   # silence someone inherits.
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -197,6 +206,7 @@ jobs:
   # reads the working tree. Keeping the job name keeps the required check.
   composer-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/nightly.yml

@@ -18,6 +18,7 @@ jobs:
   # Build only when a feat/fix landed since the last nightly; skip a run with only chores/CI.
   gate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
@@ -40,6 +41,7 @@ jobs:
     needs: gate
     if: needs.gate.outputs.proceed == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write  # create the dated pre-release
     outputs:
@@ -80,6 +82,7 @@ jobs:
   publish:
     needs: [prepare, binary]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write  # publish (un-draft) the release
     steps:

.github/workflows/pr-preview.yml

@@ -38,6 +38,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
       && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/quibble.yml

@@ -35,6 +35,7 @@ jobs:
   # phan needs a full MediaWiki environment to resolve core symbols; mago and phpcs can't provide one.
   phan:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -53,6 +54,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       id-token: write

.github/workflows/release-please.yml

@@ -11,6 +11,7 @@ permissions: {}
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -51,6 +52,7 @@ jobs:
     needs: [release-please, binary, docker]
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write  # publish (un-draft) the release
     steps:

.github/workflows/semantic-pull-request.yml

@@ -22,6 +22,7 @@ concurrency:
 jobs:
   semantic-pull-request:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       pull-requests: write
     steps:

.github/workflows/smoke.yml

@@ -39,6 +39,15 @@ concurrency:
 jobs:
   smoke:
     runs-on: ubuntu-latest
+    # Every job in this repository carries one of these, and this is the job that earned them. On
+    # 2026-08-18 the runner's Ubuntu mirror stopped answering during `playwright install
+    # --with-deps`; apt fell back to archive.ubuntu.com, fetched the release files and then sat
+    # there. With no timeout the job waited out GitHub's six-hour default before anyone was told
+    # anything. The mirror is not ours to fix; how long we wait to hear about it is.
+    #
+    # Three times what the job takes -- around ten minutes, two bakes and a browser install -- so a
+    # stall is reported in minutes while a slow but healthy run never trips it.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/test.yml

@@ -17,6 +17,7 @@ jobs:
   # Compile the Caddy plugin so a Go build error is caught on the PR, not later in the binary build.
   caddy:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -33,6 +34,7 @@ jobs:
   # Run the extension's PHPUnit tests against a real MediaWiki: the 1.46 base the build ships on, and master.
   phpunit:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:

.github/workflows/tofu.yml

@@ -29,6 +29,7 @@ concurrency:
 jobs:
   plan:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
       issues: write

.github/workflows/translations.yml

@@ -23,6 +23,7 @@ concurrency:
 jobs:
   check-translations:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/updatecli.yml

@@ -14,6 +14,7 @@ permissions: {}
 jobs:
   updatecli:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
       pull-requests: write