From 6820d943b93281cbdc0923329fc75462d7a630dc Mon Sep 17 00:00:00 2001
From: woksin <sindrewilting@gmail.com>
Date: Tue, 25 Aug 2026 22:19:20 +0200
Subject: [PATCH 1/2] chore: add job timeouts and pull request concurrency to
 workflows

Jobs had no timeout-minutes, so a hung job could hold one of the
organization's 20 shared hosted-runner slots for the 6 hour default - a
contributor to the 2026-08-25 runner starvation. Verification workflows
triggered by pull requests also lacked a concurrency group, so rapid
successive pushes stacked duplicate runs instead of cancelling stale ones.

Rules applied: quick checks 15 min, builds 30 min, publish/release 60 min,
integration/benchmarks 120 min; cancel-in-progress only on pull-request
verification workflows, never on publish, release or deploy workflows.
---
 .github/workflows/auto-approve-publish-deployments.yml | 1 +
 .github/workflows/cleanup-pr-artifacts.yml             | 4 ++++
 .github/workflows/dotnet-build.yml                     | 2 ++
 .github/workflows/javascript-build.yml                 | 1 +
 .github/workflows/publish.yml                          | 4 ++++
 .github/workflows/verify-semver-label.yml              | 1 +
 6 files changed, 13 insertions(+)

diff --git a/.github/workflows/auto-approve-publish-deployments.yml b/.github/workflows/auto-approve-publish-deployments.yml
index 921dfb3..f12cb01 100644
--- a/.github/workflows/auto-approve-publish-deployments.yml
+++ b/.github/workflows/auto-approve-publish-deployments.yml
@@ -17,6 +17,7 @@ permissions:
 jobs:
   approve:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Approve pending npm/nuget deployments
         env:
diff --git a/.github/workflows/cleanup-pr-artifacts.yml b/.github/workflows/cleanup-pr-artifacts.yml
index 448a2d3..3874a79 100644
--- a/.github/workflows/cleanup-pr-artifacts.yml
+++ b/.github/workflows/cleanup-pr-artifacts.yml
@@ -1,5 +1,9 @@
 name: Cleanup PR Artifacts
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     types: [closed]
diff --git a/.github/workflows/dotnet-build.yml b/.github/workflows/dotnet-build.yml
index 5894573..02cbf15 100644
--- a/.github/workflows/dotnet-build.yml
+++ b/.github/workflows/dotnet-build.yml
@@ -39,6 +39,7 @@ on:
 jobs:
   dotnet-build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     outputs:
       spec-projects: ${{ steps.discover-specs.outputs.projects }}
 
@@ -88,6 +89,7 @@ jobs:
   specs:
     needs: [dotnet-build]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/javascript-build.yml b/.github/workflows/javascript-build.yml
index 6869b8f..ef1c401 100644
--- a/.github/workflows/javascript-build.yml
+++ b/.github/workflows/javascript-build.yml
@@ -25,6 +25,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4a7e6f8..735e4e7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -48,6 +48,7 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     outputs:
       version: ${{ steps.release.outputs.version }}
       publish: ${{ steps.release.outputs.should-publish }}
@@ -64,6 +65,7 @@ jobs:
   publish-dotnet-packages:
     if: needs.release.outputs.publish == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     needs: [release]
     permissions:
       id-token: write   # Required for NuGet trusted publishing using OIDC tokens
@@ -89,6 +91,7 @@ jobs:
   publish-npm-packages:
     if: needs.release.outputs.publish == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     needs: [release]
     permissions:
       contents: read
@@ -128,6 +131,7 @@ jobs:
   verify-published:
     if: always() && needs.release.result == 'success' && contains(fromJSON('["no-label", "error"]'), needs.release.outputs.reason)
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     needs: [release]
     steps:
       - run: |
diff --git a/.github/workflows/verify-semver-label.yml b/.github/workflows/verify-semver-label.yml
index e3918f5..4c2ead9 100644
--- a/.github/workflows/verify-semver-label.yml
+++ b/.github/workflows/verify-semver-label.yml
@@ -26,6 +26,7 @@ permissions:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Require exactly one semantic version label

From 13f407344c19765979320677003c57ab8d723637 Mon Sep 17 00:00:00 2001
From: woksin <sindrewilting@gmail.com>
Date: Tue, 25 Aug 2026 22:30:11 +0200
Subject: [PATCH 2/2] chore: retrigger checks (semver label was added after the
 gate first ran)