.gitea/scoped_workflows/publish-wiki.yml

@@ -23,12 +23,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/scoped_workflows/sync-github-metadata.yml

@@ -16,9 +16,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/workflows/quality-checks.yml

@@ -45,6 +45,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       LANGUAGES: ${{ inputs.languages }}
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
@@ -55,10 +56,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/release.yml

@@ -26,9 +26,10 @@ jobs:
     permissions:
       contents: write
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Check and publish the release
         env:

.gitea/workflows/sync-milestones.yml

@@ -45,9 +45,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           token: ${{ secrets.TOKEN_FOR_GITEA }}
 

.gitea/workflows/validate-workflows.yml

@@ -11,9 +11,10 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
 
       - name: Create a virtual environment and install test dependencies
         run: |

CHANGELOG.md

@@ -20,6 +20,13 @@ Each release lists its changes in these groups, in this order:
 
 ## [Unreleased]
 
+### Changed
+
+- Every job has a `timeout-minutes` (5 to 15), so a hung step no longer holds a
+  runner for the host's default limit.
+- `actions/checkout` is referenced by the exact tag `v4.2.2` instead of the
+  moving tag `v4`. No change for callers.
+
 ## [1.1.0] - 2026-10-11
 
 ### Added