From 1bad75c3673824be336cf02b46e36a72461aef64 Mon Sep 17 00:00:00 2001
From: Jens Tirsvad Nielsen <jenstirsvad@gmail.com>
Date: Sun, 11 Oct 2026 12:49:24 +0800
Subject: [PATCH] Add timeouts to every job and pin actions/checkout to an
 exact tag

Findings of QC-WF-001 (criteria 8 and 14) applied to the workflows of this
repository and to the two scoped workflows:

- timeout-minutes on every job: quality-checks 15, release 15,
  validate-workflows 10, sync-milestones 15, publish-wiki 10,
  sync-github-metadata 5.
- actions/checkout@v4 becomes actions/checkout@v4.2.2.

No change to inputs, secrets or behaviour. The 6-line run blocks of
sync-milestones.yml move to a script in the framework in a separate change.
---
 .gitea/scoped_workflows/publish-wiki.yml         | 5 +++--
 .gitea/scoped_workflows/sync-github-metadata.yml | 3 ++-
 .gitea/workflows/quality-checks.yml              | 5 +++--
 .gitea/workflows/release.yml                     | 3 ++-
 .gitea/workflows/sync-milestones.yml             | 3 ++-
 .gitea/workflows/validate-workflows.yml          | 3 ++-
 CHANGELOG.md                                     | 7 +++++++
 7 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/.gitea/scoped_workflows/publish-wiki.yml b/.gitea/scoped_workflows/publish-wiki.yml
index d7923e2..305b2ec 100644
--- a/.gitea/scoped_workflows/publish-wiki.yml
+++ b/.gitea/scoped_workflows/publish-wiki.yml
@@ -23,12 +23,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1
diff --git a/.gitea/scoped_workflows/sync-github-metadata.yml b/.gitea/scoped_workflows/sync-github-metadata.yml
index a0ddf86..5f0dffe 100644
--- a/.gitea/scoped_workflows/sync-github-metadata.yml
+++ b/.gitea/scoped_workflows/sync-github-metadata.yml
@@ -16,9 +16,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1
diff --git a/.gitea/workflows/quality-checks.yml b/.gitea/workflows/quality-checks.yml
index 7fd90d5..cc144de 100644
--- a/.gitea/workflows/quality-checks.yml
+++ b/.gitea/workflows/quality-checks.yml
@@ -45,6 +45,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       LANGUAGES: ${{ inputs.languages }}
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
@@ -55,10 +56,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 32e17bf..2b4a617 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -26,9 +26,10 @@ jobs:
     permissions:
       contents: write
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Check and publish the release
         env:
diff --git a/.gitea/workflows/sync-milestones.yml b/.gitea/workflows/sync-milestones.yml
index 66fa462..bde4f2d 100644
--- a/.gitea/workflows/sync-milestones.yml
+++ b/.gitea/workflows/sync-milestones.yml
@@ -45,9 +45,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           token: ${{ secrets.TOKEN_FOR_GITEA }}
 
diff --git a/.gitea/workflows/validate-workflows.yml b/.gitea/workflows/validate-workflows.yml
index fc52570..e31f372 100644
--- a/.gitea/workflows/validate-workflows.yml
+++ b/.gitea/workflows/validate-workflows.yml
@@ -11,9 +11,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Create a virtual environment and install test dependencies
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e229ac0..a701ebe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,13 @@ Each release lists its changes in these groups, in this order:
 
 ## [Unreleased]
 
+### Changed
+
+- Every job has a `timeout-minutes` (5 to 15), so a hung step no longer holds a
+  runner for the host's default limit.
+- `actions/checkout` is referenced by the exact tag `v4.2.2` instead of the
+  moving tag `v4`. No change for callers.
+
 ## [1.1.0] - 2026-10-11
 
 ### Added