From 2eb951660f56084b79dc6ffd15eedb0103fc68e7 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:48:03 +0000
Subject: [PATCH] Add timeout-minutes and concurrency groups to all workflows

Every job now has a timeout-minutes (build 20, CodeQL 120, dependency
review 10, release 30) so a hung step can't run to the 6h default. Every
workflow has a concurrency group: CI/scan workflows cancel superseded
runs for the same ref; the release workflow serializes and never cancels
an in-progress release to avoid partial publishes.

Refs java-helpers/simple-builders#163

Co-Authored-By: Andreas Igel <andreas.igel@computacenter.com>
---
 .github/workflows/codeql.yml                | 6 ++++++
 .github/workflows/dependency-review.yml     | 6 ++++++
 .github/workflows/maven-central-release.yml | 7 +++++++
 .github/workflows/maven.yml                 | 6 ++++++
 4 files changed, 25 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e30c65f1..dd0ce759 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,6 +19,11 @@ on:
   schedule:
     - cron: '20 2 * * 2'
 
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,6 +33,7 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: 120
     permissions:
       # required for all workflows
       security-events: write
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d19e21b7..147f309b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -12,6 +12,11 @@ on:
   pull_request:
     branches: [ "main" ]
 
+# Cancel superseded runs for the same PR to save runner minutes.
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 # If using a dependency submission action in this workflow this permission will need to be set to:
 #
 # permissions:
@@ -26,6 +31,7 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: 'Checkout repository'
         uses: actions/checkout@v4
diff --git a/.github/workflows/maven-central-release.yml b/.github/workflows/maven-central-release.yml
index 83285e49..62839cd8 100644
--- a/.github/workflows/maven-central-release.yml
+++ b/.github/workflows/maven-central-release.yml
@@ -14,9 +14,16 @@ on:
         required: true
         type: string
 
+# Serialize releases: never run two release jobs at once, and never cancel an
+# in-progress release (cancelling mid-deploy could leave a partial publish).
+concurrency:
+  group: maven-central-release
+  cancel-in-progress: false
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
       
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 2f7e1ae4..95355ea2 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -15,10 +15,16 @@ on:
     branches: [ "main" ]
     types: [opened, synchronize, reopened]
 
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: maven-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       pull-requests: write