ci: add timeout-minutes to every workflow job

.github/workflows/analyzers.yml

@@ -28,6 +28,8 @@ jobs:
   dogfood:
     name: Dogfood analyzers
     runs-on: ubuntu-latest
+    # Dogfood build is ~30s; a generous cap over a hung run.
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -47,6 +49,8 @@ jobs:
   floor:
     name: Dogfood analyzers on the Roslyn floor
     runs-on: ubuntu-latest
+    # Downloads the floor SDK then builds (~1 min); cap a hung run.
+    timeout-minutes: 15
     env:
       # Single source of truth for the throwaway package version, passed to BOTH the pack (-p:Version) and
       # the consume (-p:FloorCheckVersion) steps. The run-number.attempt suffix makes every run produce a

.github/workflows/ci.yml

@@ -28,6 +28,8 @@ jobs:
   build-test:
     name: Build & test (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    # Fail a hung run fast instead of holding a runner to the 6-hour default; build+test finishes in ~2 min.
+    timeout-minutes: 15
     strategy:
       # Run both legs to completion so a platform-specific failure is always visible.
       fail-fast: false

.github/workflows/codeql.yml

@@ -24,6 +24,8 @@ jobs:
   analyze:
     name: CodeQL analyze (C#)
     runs-on: ubuntu-latest
+    # Buildless CodeQL is ~2 min; cap a stuck analysis well above that.
+    timeout-minutes: 20
     permissions:
       # Required to upload results to the code-scanning dashboard.
       security-events: write

.github/workflows/commit-lint.yml

@@ -14,6 +14,8 @@ jobs:
   commit-lint:
     name: Conventional commits
     runs-on: ubuntu-latest
+    # Message linting is seconds; cap a stuck runner.
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

.github/workflows/dependabot-automerge.yml

@@ -24,6 +24,8 @@ jobs:
   automerge:
     name: Auto-merge Dependabot patch/minor
     runs-on: ubuntu-latest
+    # Fetch metadata + enable auto-merge is seconds; cap a stuck runner.
+    timeout-minutes: 10
     # Only act on PRs raised by Dependabot.
     if: github.actor == 'dependabot[bot]'
     permissions:

.github/workflows/dependency-review.yml

@@ -27,6 +27,8 @@ jobs:
   review:
     name: Dependency review
     runs-on: ubuntu-latest
+    # The dependency-graph diff is seconds; cap a stuck runner.
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

.github/workflows/release-dryrun.yml

@@ -43,6 +43,8 @@ jobs:
   pack:
     name: Dry-run pack (build + SBOM, no publish)
     runs-on: ubuntu-latest
+    # Build + pack is ~1 min; cap a hung run.
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

.github/workflows/release.yml

@@ -48,6 +48,8 @@ jobs:
   pack-push:
     name: Pack & push NuGet
     runs-on: ubuntu-latest
+    # build + test + pack + attest + push is ~4 min; cap a hung release rather than the 6-hour default.
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

.github/workflows/sonar.yml

@@ -28,6 +28,8 @@ jobs:
   analyze:
     name: SonarQube Cloud analysis
     runs-on: ubuntu-latest
+    # Scanner + build + test + coverage is ~3 min; cap a stuck analysis well above that.
+    timeout-minutes: 20
     # PRs opened from a fork cannot read SONAR_TOKEN; skip the analysis there rather
     # than fail. Branches in this repository (the normal case) run normally.
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository