ci: bound all 16 unbounded workflow jobs on main with timeout-minutes

The main branch carries a different, older set of workflow files than
development (which now calls the shared reusable workflows in
ConductionNL/.github, bounded at source). None of main's 16 jobs
declared timeout-minutes, so a hung job burned a runner for GitHub's
6-hour default.

These are not dead files: release-workflow.yaml has recent runs on
main, and the PR-triggered jobs (php-checks matrix, frontend-quality,
lint-check, both check-branch duplicates) fire on every PR into main,
i.e. on every release.

Bounds are derived from measured fleet-wide durations (successful and
failed executions, skipped excluded) and are deliberately loose -- a
timeout that fires under normal contention turns a slow run into a
phantom defect.

php-checks is set to 30 rather than 20: one job-level bound covers all
six matrix legs, and while lint/PHPCS/PHPMD/Psalm/PHPStan run ~4 min,
the PHPUnit leg has been observed at 18.9 min while succeeding.

No job here calls a reusable workflow, so timeout-minutes is valid on
all 16. Additions only; no step, trigger, or job was modified.

Author: juanclaude-conduction

.github/workflows/beta-release.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/code-quality.yml

@@ -12,6 +12,11 @@ jobs:
   php-checks:
     name: ${{ matrix.check.name }}
     runs-on: ubuntu-latest
+    # One job-level bound covers every matrix leg, so it must clear the
+    # SLOWEST leg. Lint/PHPCS/PHPMD/Psalm/PHPStan run ~4 min, but the PHPUnit
+    # leg has been observed at 18.9 min while SUCCEEDING — a 20 bound would
+    # leave ~6% headroom and turn a slow-but-healthy run into a red check.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -49,6 +54,8 @@ jobs:
   frontend-quality:
     name: Frontend Quality
     runs-on: ubuntu-latest
+    # Observed max 5.3 min across 49 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout

.github/workflows/documentation.yml

@@ -12,6 +12,8 @@ jobs:
   deploy:
     name: Deploy Documentation
     runs-on: ubuntu-latest
+    # Observed max 2.5 min across 23 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
     if: github.event_name == 'push'
     permissions:
       contents: write

.github/workflows/pr-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   check-branch:
     runs-on: ubuntu-latest
+    # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom.
+    timeout-minutes: 10
     steps:
       - name: Check branch
         run: |

.github/workflows/pull-request-from-branch-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   check-branch:
     runs-on: ubuntu-latest
+    # Observed max 0.1 min across 123 fleet runs; 10 leaves ample headroom.
+    timeout-minutes: 10
     steps:
       - name: Check branch
         run: |

.github/workflows/pull-request-lint-check.yaml

@@ -9,6 +9,8 @@ on:
 jobs:
   lint-check:
     runs-on: ubuntu-latest
+    # Observed max 1.4 min across 176 fleet runs; 15 leaves ample headroom.
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository

.github/workflows/push-development-to-beta.yaml

@@ -12,6 +12,8 @@ on:
 jobs:
   create-pr:
     runs-on: ubuntu-latest
+    # Observed max 5.6 min across 152 fleet runs; 20 leaves ample headroom.
+    timeout-minutes: 20
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-beta.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-stable.yaml

@@ -14,6 +14,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -149,6 +152,8 @@ jobs:
 
   update-changelog:
     runs-on: ubuntu-latest
+    # Observed ~0.2 min; 15 leaves ample headroom.
+    timeout-minutes: 15
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3

.github/workflows/release-unstable.yaml

@@ -8,6 +8,9 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed max 0.7 min across 26 fleet runs; 45 matches the shared release
+    # jobs — a spurious release failure is expensive, so keep this loose.
+    timeout-minutes: 45
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3