fix(ci): bound the regression image's bun install so a hang cannot stall it (#4204)

* fix(ci): bound the regression image's bun install so a hang cannot eat an hour

bun install printed a tarball error then hung instead of exiting (run 35468046055).

Timeout+retry the install and cap the whole build step at 20 min.

* fix(ci): correct the build step's stated normal duration

Review measured 18 real samples at 2m28s-3m40s (median ~3m), not 5-8m.

Also: neither hang hit the 60-min timeout; both were manually cancelled.

.github/workflows/regression.yml

@@ -101,6 +101,10 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build test Docker image (cached)
+        # Normal duration is ~3 min; a bun install that errors and hangs
+        # instead of exiting (run 35468046055) otherwise runs unbounded until
+        # someone notices and cancels it. Fail fast so a shard fails, not stalls.
+        timeout-minutes: 20
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .

Dockerfile.test

@@ -88,7 +88,11 @@ COPY packages/aws-lambda/package.json packages/aws-lambda/package.json
 COPY packages/gcp-cloud-run/package.json packages/gcp-cloud-run/package.json
 COPY packages/sdk/package.json packages/sdk/package.json
 COPY packages/sdk-playground/package.json packages/sdk-playground/package.json
-RUN bun install --frozen-lockfile
+# A corrupt tarball extraction (e.g. run 35468046055: "Fail extracting tarball
+# for aws-cdk-lib") can print an error and then hang instead of exiting, once
+# eating a full 60-minute job timeout. Bound each attempt and retry once.
+RUN timeout 300 bun install --frozen-lockfile \
+    || timeout 300 bun install --frozen-lockfile
 
 # Copy source in dependency order, running each build as soon as its own
 # inputs are present.