ci: scope Smoke timeouts to trufflehog runs, not the build

The `zombies` job had a job-level `timeout-minutes: 5` that covered a full
binary compile as well as the two scans it is meant to bound. On PRs that
change `go.sum` the Go cache is cold, the compile takes ~2m30s instead of
~29s, and the job exceeds 5 minutes even though the zombie check itself
passes. PR #5280 hit this on both attempts; #5273 passed with 19s to spare.

Build to `$RUNNER_TEMP` in a separate step and move `timeout-minutes` onto
the run step, so the 5-minute budget now measures only the scans (~1m42s)
and no longer depends on build speed. A step-level timeout also fails the
job rather than cancelling it, which is a clearer signal.

`smoke` had no timeout at all and inherited the 360-minute default despite
doing under a minute of work, so a hang in its live-verification scans
burned six hours of runner time. Both jobs now cap at 15 minutes to catch
build and infrastructure hangs.

Also set `cache: false` on setup-go in `checksecretparts`. That job is
stdlib-only and finishes in ~23s, so it wins the race to write the
`go.sum`-keyed cache and saves ~10MB with no module cache at all. Cache
keys are write-once, so every later job on the branch restores the empty
entry and cannot replace it.

Co-authored-by: Cursor <[email protected]>

.github/workflows/lint.yml

@@ -60,5 +60,10 @@ jobs:
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.27"
+          # hack/checksecretparts only needs the standard library, so this job
+          # finishes before any other and would otherwise claim the shared
+          # go.sum-keyed cache with an empty module cache. Cache keys are
+          # write-once, so that starves every later job on the branch.
+          cache: false
       - name: Run checksecretparts
         run: go run ./hack/checksecretparts -fail ./pkg/detectors

.github/workflows/smoke.yml

@@ -3,9 +3,13 @@ name: Smoke
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   smoke:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -13,14 +17,17 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.27"
+      - name: Build
+        run: go build -o "$RUNNER_TEMP/trufflehog" .
       - name: Smoke
+        timeout-minutes: 10
         run: |
           set -e
-          go run . git https://github.com/dustin-decker/secretsandstuff.git > /dev/null
-          go run . github --repo https://github.com/dustin-decker/secretsandstuff.git > /dev/null
+          "$RUNNER_TEMP/trufflehog" git https://github.com/dustin-decker/secretsandstuff.git > /dev/null
+          "$RUNNER_TEMP/trufflehog" github --repo https://github.com/dustin-decker/secretsandstuff.git > /dev/null
   zombies:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -28,12 +35,17 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.27"
+      - name: Build
+        run: go build -o "$RUNNER_TEMP/trufflehog" .
+      # The timeout covers only the scans, not the build, so a cold Go cache
+      # cannot eat into the budget that detects the #3379 deadlock.
       - name: Run trufflehog
+        timeout-minutes: 5
         run: |
           set -e
-          go run . git --no-verification file://. > /dev/null
+          "$RUNNER_TEMP/trufflehog" git --no-verification file://. > /dev/null
           # This case previously had a deadlock issue and left zombies after trufflehog exited #3379
-          go run . git --no-verification https://github.com/git-test-fixtures/binary.git > /dev/null
+          "$RUNNER_TEMP/trufflehog" git --no-verification https://github.com/git-test-fixtures/binary.git > /dev/null
       - name: Check for running git processes and zombies
         run: |
           if pgrep -x "git" > /dev/null