ci: bound the release and Dependabot jobs too

.github/workflows/dependabot-auto-approve-and-merge.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # Check the actor, only run for Dependabot PRs, prevent failing on non-Dependabot PRs.
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:

.github/workflows/release.yml

@@ -11,6 +11,7 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     environment:
       name: pypi
     permissions:

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Add `timeout-minutes` to the `release.yml` and Dependabot workflow jobs, which were left unbounded when the CI jobs got theirs.
 - Test on Python 3.15 (release candidate) against Django 6.1 and `main`. The job is
   non-blocking and 3.15 is not yet advertised as supported.
 - Remove the `<7.0` upper bound on the `Django` dependency.

PACKAGING.md

@@ -25,6 +25,12 @@ as a PR in that sibling's own repo — never push straight to `main`.
   `apt-get update` is a known hang risk — it once stalled on an unreachable Ubuntu mirror
   and burned six hours before GitHub's cap; `timeout-minutes` on every job bounds it.
 
+Every job in every workflow carries `timeout-minutes`. Without it a job falls back to
+GitHub's 6 hour default, and a job that hangs rather than fails burns the whole allowance
+before anyone notices. 15 minutes is the default here, 20 where a job builds and publishes
+(`release.yml`). This was once read as "every job in `ci.yml`", which left `release.yml` and
+the Dependabot workflow unbounded in all five repos until 2026-09.
+
 ## Synced with per-package substitution
 
 `pyproject.toml` sections `[build-system]`, `[tool.uv.build-backend]`, `[tool.check-manifest]`,