ci(apk): cache SDK dl/staging/build trees per target + job timeouts (#370 follow-up)

.github/workflows/build-package.yml

@@ -155,6 +155,7 @@ jobs:
           fi
 
   compile-binaries:
+    timeout-minutes: 30
     needs: [determine-versioning]
     # The publish pipeline (Blossom upload + Nostr publish) needs the NSEC_HEX
     # secret, which GitHub withholds from fork PRs. Skip the whole pipeline for
@@ -273,6 +274,7 @@ jobs:
           echo "All uploads complete: $HASH_JSON"
 
   build-portal:
+    timeout-minutes: 15
     # The publish pipeline (Blossom upload + Nostr publish) needs the NSEC_HEX
     # secret, which GitHub withholds from fork PRs. Skip the whole pipeline for
     # fork PRs so they don't go red on an empty NSEC_HEX; same-repo PRs and
@@ -315,6 +317,7 @@ jobs:
           retention-days: 7
 
   package-ipk:
+    timeout-minutes: 30
     needs: [define-package-matrix, determine-versioning, compile-binaries, build-portal]
     runs-on: ubuntu-latest
     strategy:
@@ -497,6 +500,7 @@ jobs:
           echo "Uploaded $PACKAGE_FILENAME → $PKG_HASH"
 
   package-apk:
+    timeout-minutes: 90
     needs: [define-package-matrix, determine-versioning, compile-binaries, build-portal]
     runs-on: ubuntu-latest
     container:
@@ -560,6 +564,17 @@ jobs:
           name: portal-assets
           path: src-checkout/packaging/files/tollgate-captive-portal-site/
 
+      - name: Restore SDK build cache
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            /builder/dl
+            /builder/staging_dir
+            /builder/build_dir
+          key: apk-sdk-${{ matrix.sdk }}-25.12.0-${{ hashFiles('packaging/**') }}
+          restore-keys: |
+            apk-sdk-${{ matrix.sdk }}-25.12.0-
+
       - name: Stage SDK package tree
         run: |
           set -eu

CHANGELOG.md

@@ -437,14 +437,20 @@ and [Semantic Versioning](https://semver.org/).
   the workflow's 43k runner-minutes YTD waste.
   ([#369](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/369))
 
-- **CI: apk SDK build-tree caching + job timeouts.** `package-apk` gains
-  an `actions/cache` step (SHA-pinned `@v5`) caching `/builder/dl`,
-  `staging_dir`, and `build_dir` keyed per SDK target with
-  `restore-keys` fallback, so subsequent runs skip feed downloads and
-  dependency compiles. `timeout-minutes` added to all heavy jobs
-  (compile 30, portal 15, ipk 30, apk 90, publish 15) replacing the
-  6-hour default.
-  ([#370](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/370))
+- **CI: apk SDK build-tree caching + job timeouts, carried onto `main`
+  by the #370 follow-up.** #370 is marked merged, but its content
+  never reached `main`: its base was the stacked `ci/trigger-hygiene`
+  branch (#369), which landed on `main` as the squash `db8af35` 54
+  seconds before #370 merged into that already-merged branch.
+  `package-apk` gains an `actions/cache` step (SHA-pinned `@v5`)
+  caching `/builder/dl`, `staging_dir`, and `build_dir` keyed per SDK
+  target with `restore-keys` fallback, so subsequent runs skip feed
+  downloads and dependency compiles. `timeout-minutes` is added to
+  the four heavy jobs that ran against the 360-minute default
+  (compile 30, portal 15, ipk 30, apk 90); `publish-metadata` already
+  carried its 15.
+  ([#370](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/370),
+  [#385](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/385))
 
 - **Release version has a single source of truth: `VERSION` at the
   repository root.** Three version literals used to disagree —

RELEASE-NOTES.md

@@ -275,8 +275,11 @@ maintainer runbook — pre-flight gates, the annotated-tag commands on upstream
   build triggers are restricted to `main` + `v*` tags with docs-only paths
   ignored and redundant runs cancelled
   ([#369](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/369));
-  the SDK build tree is cached and every heavy job has a timeout
-  ([#370](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/370));
+  the SDK build tree is cached and every heavy job has a timeout,
+  carried onto `main` by the #370 follow-up after #370's merge landed
+  on the squash-merged `ci/trigger-hygiene` branch
+  ([#370](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/370),
+  [#385](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/385));
   the portal is built once per run instead of per matrix leg, which also
   removed per-leg commit drift
   ([#368](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/368)).