ci: cap every workflow job at 10 minutes

.github/workflows/ci.yaml

@@ -13,6 +13,7 @@ jobs:
   ci:
     name: CI
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/codeql.yaml

@@ -12,6 +12,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       security-events: write
       packages: read

.github/workflows/dependabot-auto-merge.yaml

@@ -18,6 +18,7 @@ jobs:
     # Only act on PRs opened by Dependabot.
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       # Parses the PR to expose update metadata (ecosystem, dependency names,
       # update-type, etc.) as step outputs we can gate on below.

.github/workflows/dependency-review.yaml

@@ -15,6 +15,7 @@ jobs:
   dependency-review:
     name: Dependency Review
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/pr-title.yaml

@@ -11,6 +11,7 @@ jobs:
   lint:
     name: Validate conventional commit format
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:

.github/workflows/release.yaml

@@ -13,6 +13,7 @@ jobs:
   release:
     name: Semantic Release
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with: