From 24b5dae032622eb451616c4f34670664862411b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?=
 <eric.meadows.jonsson@gmail.com>
Date: Thu, 15 Oct 2026 21:07:42 +0200
Subject: [PATCH] Test each commit once and time out CI jobs

A pull request from a branch in this repository ran CI for the commit its
branch push had already tested, 7 times from 2026-09-20 to 2026-10-14. The
test job now runs for pushes and for pull requests from forks.

Jobs take under two minutes and stop after 10 instead of GitHub's
360-minute default.
---
 .github/workflows/codeql.yml | 2 ++
 .github/workflows/main.yml   | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 349132b..76a4b26 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,6 +15,7 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: "ubuntu-latest"
+    timeout-minutes: 10
     permissions:
       security-events: write
     strategy:
@@ -41,6 +42,7 @@ jobs:
   zizmor:
     name: Zizmor
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       security-events: write
     steps:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ad3f399..247ba7a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -8,7 +8,11 @@ permissions:
 jobs:
   test:
     name: Test
+    # A pull request from a branch in this repository tests the same commit
+    # as the branch's push, so only pull requests from forks run here.
+    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix: