fix: bound every CI job with a timeout and stop masking install failures

.github/workflows/ci.yml

@@ -23,6 +23,7 @@ jobs:
   # instead of the "skipped" state it can't distinguish from "never ran".
   gate:
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     outputs:
       is_release_please: ${{ steps.check.outputs.result }}
     steps:

.github/workflows/codeql.yml

@@ -29,6 +29,7 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     if: ${{ !startsWith(github.head_ref, 'release-please--') }}
     strategy:
       fail-fast: false

.github/workflows/phpcs.yml

@@ -9,6 +9,7 @@ permissions:
 jobs:
   phpcs:
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/phpstan.yml

@@ -9,6 +9,7 @@ permissions:
 jobs:
   phpstan:
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/phpunit.yml

@@ -17,6 +17,10 @@ jobs:
   phpunit:
     name: PHP ${{ matrix.php }}
     runs-on: ubuntu-24.04
+    # Caps the unbounded network work here (Gutenberg clone, npm install,
+    # wp-env image builds), which would otherwise run to GitHub's 360-minute
+    # default -- a stalled mirror has hung this job before.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.github/workflows/playwright.yml

@@ -10,7 +10,9 @@ jobs:
   playwright:
     name: Playwright Tests
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    # The browser install is separately bounded at 10 minutes worst case, so
+    # this only needs headroom for the Gutenberg build and the test run.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/plugin-check.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   plugin-check:
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ !inputs.skip }}

build-gutenberg.sh

@@ -30,7 +30,16 @@ echo "🏗️  Building Gutenberg (this takes ~2 minutes)..."
 cd "$GUTENBERG_DIR"
 
 echo "📦 Installing dependencies..."
-npm install --legacy-peer-deps 2>&1 | grep -E "added|removed|changed|^npm" || true
+# grep exits 1 when it matches nothing, so read npm's own status from
+# PIPESTATUS rather than a trailing `|| true` that would swallow both.
+set +e
+npm install --legacy-peer-deps 2>&1 | grep -E "added|removed|changed|^npm"
+npm_status=${PIPESTATUS[0]}
+set -e
+if [ "$npm_status" -ne 0 ]; then
+    echo "❌ npm install failed for Gutenberg trunk (exit $npm_status)" >&2
+    exit "$npm_status"
+fi
 
 echo "🔧 Running build..."
 npm run build 2>&1 | tail -10