Give the C++ and C# workflows a timeout and an exact checkout tag

Task: MIL-007#4

Task: MIL-007#5

.gitea/scoped_workflows/publish-wiki.yml

@@ -23,12 +23,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/scoped_workflows/sync-github-metadata.yml

@@ -16,9 +16,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/workflows/quality-checks-cpp.yml

@@ -43,6 +43,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
       STD: ${{ inputs.std }}
@@ -52,10 +53,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/quality-checks-csharp.yml

@@ -34,6 +34,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
       PROJECT: ${{ inputs.project }}
@@ -41,10 +42,10 @@ jobs:
       DOTNET_ROOT: /tmp/dotnet
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/quality-checks.yml

@@ -45,6 +45,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       LANGUAGES: ${{ inputs.languages }}
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
@@ -55,10 +56,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/release.yml

@@ -26,9 +26,10 @@ jobs:
     permissions:
       contents: write
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Check and publish the release
         env:

.gitea/workflows/sync-milestones.yml

@@ -45,9 +45,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           token: ${{ secrets.TOKEN_FOR_GITEA }}
 
@@ -67,23 +68,11 @@ jobs:
           git submodule update --init --recursive --depth=1
 
       - name: Make sure curl and jq are available
-        run: |
+        run: bash framework/scripts/ci-publish-milestones.sh ensure-tools
-          set -euo pipefail
-          if command -v curl >/dev/null && command -v jq >/dev/null; then exit 0; fi
-          sudo_cmd=""
-          if [ "$(id -u)" -ne 0 ]; then sudo_cmd="sudo"; fi
-          $sudo_cmd apt-get update -qq
-          $sudo_cmd apt-get install -y -qq curl jq
 
       - name: Publish accepted milestones
         env:
           GITEA_TOKEN: ${{ secrets.TOKEN_FOR_GITEA }}
           # Empty on a push (a real run); "true" or "false" on a manual run.
           DRY_RUN: ${{ inputs.dry_run }}
-        run: |
+        run: bash framework/scripts/ci-publish-milestones.sh publish
-          set -euo pipefail
-          if [ "$DRY_RUN" = "true" ]; then
-            bash framework/scripts/sync-project.sh --accepted-only
-          else
-            bash framework/scripts/sync-project.sh --accepted-only --apply
-          fi

.gitea/workflows/validate-workflows.yml

@@ -11,9 +11,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Create a virtual environment and install test dependencies
         run: |

AGENTS.md

@@ -15,6 +15,49 @@ framework.
 the working tree first; edit, summarise and stop. The commit/PR rules below
 apply once a commit has been asked for.
 
+## Related repositories
+
+This project is one of four repositories that change together. Each has one
+job; a change goes to the repository that owns it, not to the one that happens
+to be open.
+
+| Repository | Owns | Consumed by | Pinned or released as |
+| --- | --- | --- | --- |
+| `TirSystem/SQA-QC-Checklists` | the QC checklists (`qc/artifacts/`, `qc/code/`) | `sqa-qc-framework` | a commit, pinned as the `qc/` submodule |
+| `TirSystem/sqa-qc-framework` | the skills, process documents, catalog, templates (`templates/ci/`) and scripts | every project, as the `framework/` submodule | a release tag (`v0.5.2`, ...) |
+| `TirSystem/github-action` | the shared workflows (`quality-checks`, `release`), the scoped workflows (`publish-wiki`, `sync-github-metadata`) and the scripts they call (`tools/`) | every repository of the organisation, by `uses:` and `ref:` | a release tag and a moving major tag (`v1`), made by its release workflow |
+| `TirSystem/sqa-and-qc` | the SQA and AI project management: project artifacts, review records, the traceability matrix | itself | the pull request that merges it |
+
+Where a thing lives:
+
+- A QC checklist, a convention or a template is changed in its owner above and
+  reaches this project by moving the pin. The review record of a checklist is
+  written in the project that reviews it (`docs/sqa/reviews/`), not in the
+  checklist repository.
+- A workflow that other repositories call is changed in `github-action` and
+  released there. A workflow a project copies from `templates/ci/` is changed
+  in the framework; the project updates its copy after the pin moves.
+- A script a workflow needs is a file (`tools/` of `github-action`, or
+  `scripts/` of the framework for the templates), never a long `run:` block
+  (`QC-WF-001` criterion 20).
+- The `framework/` pin here is independent of the one in `sqa-and-qc`; the two
+  may differ, and neither is moved to follow the other without a reason in
+  the pull request.
+
+A change that spans repositories:
+
+1. One pull request per repository, in dependency order: checklists, then
+   framework, then `github-action` and the projects. A pull request names the
+   ones it depends on in its description.
+2. A downstream repository moves a pin only to a merged commit or tag of the
+   upstream, never to an unmerged branch.
+3. Nothing is released or tagged until its dependencies are merged; a release
+   is a separate, deliberate step (the release workflow defaults to a dry run).
+4. A related repository is added to the session as a working directory only
+   when the task needs it. In autonomous mode work in a related repository is
+   inside the accepted plan only if the plan names it; otherwise the run stops
+   and reports.
+
 ## Workflow order
 
 Business Case, Stakeholder Analysis, Project Plan, milestones, tasks synced as

CHANGELOG.md

@@ -32,6 +32,17 @@ Each release lists its changes in these groups, in this order:
   or later (input `dotnet-sdk-version`, default `10.0.401`), with the inputs
   `working-directory`, `project` and `tools-ref`.
 
+### Changed
+
+- Every job has a `timeout-minutes` (5 to 15), so a hung step no longer holds a
+  runner for the host's default limit.
+- `actions/checkout` is referenced by the exact tag `v4.2.2` instead of the
+  moving tag `v4`. No change for callers.
+- The framework pin moves from `v0.5.2` to `v0.6.0`, and the two long `run:`
+  blocks of this repository's own `sync-milestones.yml` call
+  `framework/scripts/ci-publish-milestones.sh`. No change for callers of the
+  shared workflows.
+
 ## [1.1.0] - 2026-10-11
 
 ### Added