From a9c961b41df7ee3ee3affc99c06ed9d85a2c6942 Mon Sep 17 00:00:00 2001
From: Tim Hartmann <timhartmann7@proton.me>
Date: Wed, 19 Aug 2026 09:15:02 +0400
Subject: [PATCH] ci: bound the apt steps and give every job a timeout

A stalled Azure apt mirror left "Install GUI build dependencies" retrying for 36
minutes before the run was cancelled; the job normally finishes in five. Nothing
bounded it - apt waits two minutes per repository by default and no job in either
workflow set timeout-minutes, so GitHub's six-hour default applied.

Make apt fail over to the next mirror in seconds, cap the three apt steps at six
minutes, and cap each CI job well above a cold-cache run.
---
 .github/workflows/ci.yml      | 11 +++++++++++
 .github/workflows/release.yml | 14 ++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87e77d4..9c802cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ jobs:
   hygiene:
     name: Repo hygiene guard
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -27,6 +28,7 @@ jobs:
   build-and-test:
     name: Build & Test (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -75,6 +77,7 @@ jobs:
   gui:
     name: GUI checks
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -108,7 +111,14 @@ jobs:
       # installs more, but those are the bundler's (icons, AppImage) and this job only
       # compiles.
       - name: Install GUI build dependencies
+        timeout-minutes: 6
         run: |
+          # The runner image points apt at an Azure mirror that intermittently
+          # black-holes connections. apt then retries every repository for two
+          # minutes apiece: one run spent 36 minutes here before it was cancelled.
+          # Fail over to the next mirror in seconds instead.
+          printf 'Acquire::Retries "2";\nAcquire::http::Timeout "15";\nAcquire::https::Timeout "15";\n' \
+            | sudo tee /etc/apt/apt.conf.d/99-omnyssh-ci-timeouts > /dev/null
           sudo apt-get update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev
 
@@ -138,6 +148,7 @@ jobs:
   tui-build-independence:
     name: TUI builds without the GUI toolchain
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8a185e2..f506305 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -119,7 +119,14 @@ jobs:
       # itself; gcc-aarch64-linux-gnu only supplies the ELF linker.
       - name: Install aarch64 cross linker
         if: matrix.target == 'aarch64-unknown-linux-musl'
+        timeout-minutes: 6
         run: |
+          # The runner image points apt at an Azure mirror that intermittently
+          # black-holes connections. apt then retries every repository for two
+          # minutes apiece: one run spent 36 minutes here before it was cancelled.
+          # Fail over to the next mirror in seconds instead.
+          printf 'Acquire::Retries "2";\nAcquire::http::Timeout "15";\nAcquire::https::Timeout "15";\n' \
+            | sudo tee /etc/apt/apt.conf.d/99-omnyssh-ci-timeouts > /dev/null
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu
 
@@ -222,7 +229,14 @@ jobs:
       # the AppImage). Only Linux needs them; macOS/Windows use system webviews.
       - name: Install Linux bundle dependencies
         if: runner.os == 'Linux'
+        timeout-minutes: 6
         run: |
+          # The runner image points apt at an Azure mirror that intermittently
+          # black-holes connections. apt then retries every repository for two
+          # minutes apiece: one run spent 36 minutes here before it was cancelled.
+          # Fail over to the next mirror in seconds instead.
+          printf 'Acquire::Retries "2";\nAcquire::http::Timeout "15";\nAcquire::https::Timeout "15";\n' \
+            | sudo tee /etc/apt/apt.conf.d/99-omnyssh-ci-timeouts > /dev/null
           sudo apt-get update
           sudo apt-get install -y \
             libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev \