ci: integrate nextest with early checks and runtime limits

.github/workflows/ci.yml

@@ -39,6 +39,7 @@ jobs:
   # platform: the app shell, UI, text and fonts, GPU, pen input, build scripts or the lockfile.
   # macOS is tested only by release.yml.
   platforms:
+    timeout-minutes: 10
     name: select platforms
     runs-on: ubuntu-latest
     outputs:
@@ -77,6 +78,7 @@ jobs:
           fi
 
   test:
+    timeout-minutes: 100
     name: test (${{ matrix.os }})
     needs: platforms
     runs-on: ${{ matrix.os }}
@@ -111,10 +113,24 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
           cache-on-failure: true
 
+      # The cheap checks run first: a format, lint, layering or stale-scorecard failure is red
+      # after a few minutes instead of after the test passes (#6119). Clippy restores main's cache.
       - name: Format
         if: runner.os == 'Linux'
         run: cargo fmt --all -- --check
 
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings
+
+      - name: Dependency layering
+        run: cargo xtask layers
+
+      # docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
+      # prefs audit). Static: it reads committed files only, no benchmarks run here.
+      - name: Scorecard up to date
+        if: runner.os == 'Linux'
+        run: cargo xtask scorecard --check
+
       # cargo-nextest runs the test binaries in parallel (`cargo test` runs them one at a time) and
       # its `ci` profile (.config/nextest.toml) stops at the first failure and fails hung tests.
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
@@ -154,19 +170,8 @@ jobs:
           CRAFT_FONTS_REQUIRED: "1"
         run: cargo nextest run --workspace --locked --features heif --profile ci
 
-      - name: Clippy
-        run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings
-
-      - name: Dependency layering
-        run: cargo xtask layers
-
-      # docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
-      # prefs audit). Static: it reads committed files only, no benchmarks run here.
-      - name: Scorecard up to date
-        if: runner.os == 'Linux'
-        run: cargo xtask scorecard --check
-
   corpus:
+    timeout-minutes: 30
     # Real-file corpus tests (cargo feature `corpus`), on every PR and on main. The corpora are
     # pinned in xtask/src/corpus_pins.rs and sha256-verified (xtask/*.sha256) after both a cache
     # restore and a download; a missing corpus fails the tests. The cache key changes only when a
@@ -199,6 +204,7 @@ jobs:
         run: cargo xtask test-corpus
 
   wasm:
+    timeout-minutes: 30
     name: wasm32 check
     runs-on: ubuntu-latest
     steps:
@@ -215,6 +221,7 @@ jobs:
         run: cargo xtask wasm
 
   web:
+    timeout-minutes: 60
     name: web build and wasm size gate
     # PRs run it only when web-relevant files change (see `platforms`); main always does.
     needs: platforms
@@ -262,6 +269,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
   fuzz:
+    timeout-minutes: 60
     name: fuzz (${{ matrix.target.crate }}/${{ matrix.target.name }})
     # Placeholder: manual trigger only until a nightly schedule is enabled.
     if: github.event_name == 'workflow_dispatch' && inputs.fuzz

.github/workflows/docs.yml

@@ -27,6 +27,7 @@ concurrency:
 
 jobs:
   build:
+    timeout-minutes: 15
     name: mdBook build
     runs-on: ubuntu-latest
     steps:

.github/workflows/packaging-lint.yml

@@ -23,6 +23,7 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
 
   verified-appimage-inputs:
+    timeout-minutes: 10
     name: Verified AppImage inputs
     runs-on: ubuntu-latest
     steps: