Bound every CI job with a timeout, and install the audit tools

.github/workflows/deploy-shell.yml

@@ -39,6 +39,7 @@ jobs:
   # A matrix over a hand-written list would be one more copy to forget.
   locales:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       list: ${{ steps.read.outputs.list }}
     steps:
@@ -57,6 +58,7 @@ jobs:
     if: github.event_name != 'pull_request'
     needs: locales
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       # One build per locale. Astro's base changes the URLs a build emits, and
       # a build carries exactly one, so a locale is a separate build rather
@@ -216,6 +218,7 @@ jobs:
     needs: [locales, build]
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       # Serially, not in parallel: every leg writes the bucket-root files
       # (robots.txt) and creates an invalidation, and two legs racing there

.github/workflows/pr-preview-cleanup.yml

@@ -32,6 +32,7 @@ concurrency:
 jobs:
   cleanup:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment: docs-preview-cleanup
     steps:
       - uses: aws-actions/configure-aws-credentials@v6

.github/workflows/reusable-deploy.yml

@@ -138,6 +138,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment: ${{ inputs.environment }}
     steps:
       # All eight port slugs plus the bucket-root reservations, even though

.github/workflows/test.yml

@@ -32,6 +32,7 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6

scripts/build-site.sh

@@ -1092,12 +1092,15 @@ while IFS='|' read -r slug name versioned renderer generator checkout ecosystem_
     ref_status="${result%%$'\t'*}"
     ref_reason="${result#*$'\t'}"
 
+    mkdir -p "$port_out/api"
     if [ "$ref_status" = "built" ]; then
-      mkdir -p "$port_out/api"
       cp -a "$ref_outdir/." "$port_out/api/"
       node "$script_dir/normalize-native-shell.mjs" "$port_out/api" "$LIBTMUX_DOCS_PORT_ROOT"
-    elif [ "$ref_status" = "skipped" ]; then
-      mkdir -p "$port_out/api"
+    else
+      # Anything other than a build leaves nothing to publish, but the port
+      # index links here regardless. Fall back to the same redirect the other
+      # seven ports get, so the link resolves instead of 404ing. `else` rather
+      # than `skipped` alone: a sphinx-build that fails dangles the same link.
       write_reference_redirect "$slug" "$port_out/api/index.html"
     fi