Add job timeouts and PR concurrency to workflows

.github/workflows/auto-approve-publish-deployments.yml

@@ -17,6 +17,7 @@ permissions:
 jobs:
   approve:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Approve pending npm/nuget deployments
         env:

.github/workflows/build.yml

@@ -1,5 +1,9 @@
 name: Build
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   DOTNET_VERSION: "10.0.x"
 
@@ -25,6 +29,7 @@ on:
 jobs:
   dotnet-build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - uses: actions/checkout@v4
@@ -45,6 +50,7 @@ jobs:
   # push; Publish still does the multi-arch build) so a broken image fails on the pull request instead.
   docker-build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/cleanup-pr-artifacts.yml

@@ -1,5 +1,9 @@
 name: Cleanup PR Artifacts
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     types: [closed]

.github/workflows/deploy-production.yml

@@ -35,6 +35,7 @@ jobs:
     # (the cluster's control plane accepts connections from anywhere, so a hosted runner reaches it;
     # the DOTNET_INSTALL_DIR workaround below is then unnecessary but harmless).
     runs-on: [self-hosted, linux, cratis]
+    timeout-minutes: 60
     # If the `production` environment carries required reviewers, the deploy pauses for approval —
     # which is the desired behavior for a production rollout, but it will not proceed unattended.
     environment: production

.github/workflows/documentation.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   trigger:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Trigger Documentation Build
         uses: peter-evans/repository-dispatch@v3

.github/workflows/eval.yml

@@ -40,6 +40,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       contains(github.event.pull_request.labels.*.name, 'eval')
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     # Postgres + pgvector, matching docker-compose.yml (pgvector/pgvector:pg17, db/user/pass all `prompter`).
     services:

.github/workflows/publish.yml

@@ -25,6 +25,7 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     outputs:
       version: ${{ steps.release.outputs.version }}
       publish: ${{ steps.release.outputs.should-publish }}
@@ -44,6 +45,7 @@ jobs:
     if: needs.release.outputs.publish == 'true'
     needs: [release]
     runs-on: ubuntu-latest
+    timeout-minutes: 60
 
     steps:
       - uses: actions/checkout@v4
@@ -81,6 +83,7 @@ jobs:
     if: needs.release.outputs.publish == 'true'
     needs: [release]
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     outputs:
       ready: ${{ steps.check.outputs.ready }}
 
@@ -121,6 +124,7 @@ jobs:
     # and failing on those would make this job noise that everyone learns to ignore.
     if: always() && needs.release.result == 'success' && contains(fromJSON('["no-label", "error"]'), needs.release.outputs.reason)
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     needs: [release]
 
     steps:

.github/workflows/verify-semver-label.yml

@@ -29,6 +29,7 @@ permissions:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Require exactly one semantic version label