ci(workflows): whole-tree sub-repo timeout-minutes + fix malformed boj-build.yml

Builds on #360 (which added timeouts to the top-level workflows) by extending coverage to the embedded sub-project workflows and fixing one malformed file #360 left untouched:

- Add timeout-minutes to every runs-on job across all 355 embedded sub-repo workflows (660 jobs / 312 files). Reusable-workflow-call jobs excluded (invalid there).

- boj-build.yml: two steps (K9-SVC Validation, Contractile Check) were outdented to sequence items under jobs:, making it invalid YAML. Removed them (redundant with governance/hypatia; referenced a non-canonical 'lust' contractile) and added timeout-minutes to trigger-boj.

Verified: all 383 workflow files parse; 0 runs-on jobs without a timeout. changelog-reusable.yml left as-is (already fixed by #360).

https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28

Author: claude

.github/workflows/boj-build.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
@@ -46,32 +47,3 @@ jobs:
             -H "Content-Type: application/json" \
             --data "$payload" \
             || echo "BoJ server unreachable - skipping (non-fatal)"
-
-  - name: K9-SVC Validation
-    run: |
-      echo "Running K9-SVC contractile validation..."
-      if [ -f .machine_readable/contractiles/must/Mustfile.a2ml ]; then
-        echo "✅ Mustfile found - running validation"
-        # Placeholder for actual K9 validation
-        echo "K9 validation would run here"
-      else
-        echo "❌ Mustfile not found"
-        exit 1
-      fi
-      
-  - name: Contractile Check
-    run: |
-      echo "Checking contractile completeness..."
-      contractiles=("must" "trust" "dust" "lust" "adjust" "intend")
-      missing=0
-      for c in "${contractiles[@]}"; do
-        if [ ! -f ".machine_readable/contractiles/$c/${c^}file.a2ml" ]; then
-          echo "❌ Missing: $c"
-          missing=$((missing + 1))
-        fi
-      done
-      if [ $missing -gt 0 ]; then
-        echo "❌ $missing contractiles missing"
-        exit 1
-      fi
-      echo "✅ All contractiles present"

0-ai-gatekeeper-protocol/.github/workflows/codeql.yml

@@ -15,6 +15,7 @@ permissions: read-all
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       security-events: write

0-ai-gatekeeper-protocol/.github/workflows/hypatia-scan.yml

@@ -17,6 +17,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository

0-ai-gatekeeper-protocol/.github/workflows/instant-sync.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3

0-ai-gatekeeper-protocol/.github/workflows/jekyll-gh-pages.yml

@@ -26,6 +26,7 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -45,6 +46,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

0-ai-gatekeeper-protocol/.github/workflows/jekyll.yml

@@ -31,6 +31,7 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -59,6 +60,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

0-ai-gatekeeper-protocol/.github/workflows/mirror.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   mirror-gitlab:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.GITLAB_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -30,6 +31,7 @@ jobs:
 
   mirror-bitbucket:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -48,6 +50,7 @@ jobs:
 
   mirror-codeberg:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.CODEBERG_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -66,6 +69,7 @@ jobs:
 
   mirror-sourcehut:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -84,6 +88,7 @@ jobs:
 
   mirror-disroot:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.DISROOT_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -102,6 +107,7 @@ jobs:
 
   mirror-gitea:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.GITEA_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -120,6 +126,7 @@ jobs:
 
   mirror-radicle:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.RADICLE_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

0-ai-gatekeeper-protocol/.github/workflows/scorecard-enforcer.yml

@@ -14,6 +14,7 @@ permissions: read-all
 jobs:
   scorecard:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       security-events: write
       id-token: write  # For OIDC
@@ -52,6 +53,7 @@ jobs:
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
 

0-ai-gatekeeper-protocol/.github/workflows/scorecard.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   analysis:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       security-events: write
       id-token: write

0-ai-gatekeeper-protocol/.github/workflows/secret-scanner.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   trufflehog:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
         with:
@@ -24,6 +25,7 @@ jobs:
 
   gitleaks:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
         with:
@@ -37,6 +39,7 @@ jobs:
   # Rust-specific: Check for hardcoded crypto values
   rust-secrets:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: hashFiles('**/Cargo.toml') != ''
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4