ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): bound ci.yml git fetch operations with timeout (#110281)

Browse Source 
* fix(ci): bound ci.yml git fetch operations with timeout

* test(ci): scope and guard fetch timeouts

Co-authored-by: wanyongstar <wan.yong@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
wanyongstar
2026-07-18 13:11:13 +08:00
committed by GitHub
parent e8734d837e
commit 6aee64179c
2 changed files with 23 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+7 -7
View File
@@ -1352,7 +1352,7 @@ jobs:
exit 1
fi
if [[ "$mergeable" == "true" ]] &&
git fetch --no-tags --depth=2 origin \
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=2 origin \
"+refs/pull/${PULL_REQUEST_NUMBER}/merge:refs/remotes/origin/ci-max-lines-merge"; then
merge_sha="$(git rev-parse refs/remotes/origin/ci-max-lines-merge)"
read -r merge_base merge_head extra_parent <<<"$(git show -s --format=%P "$merge_sha")"
@@ -1430,11 +1430,11 @@ jobs:
exit 1
fi
merge_base="${merge_parents[0]}"
git fetch --no-tags --depth=1 origin \
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin \
"+${merge_base}:refs/remotes/origin/ci-max-lines-base"
base_ref="refs/remotes/origin/ci-max-lines-base"
elif [[ -n "$base_sha" ]]; then
git fetch --no-tags --depth=1 origin \
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin \
"+${base_sha}:refs/remotes/origin/ci-max-lines-base"
base_ref="refs/remotes/origin/ci-max-lines-base"
elif [[ -n "${RATCHET_MANUAL_TARGET_SHA:-}" ]]; then
@@ -1455,12 +1455,12 @@ jobs:
echo "Could not resolve the manual target merge base for the max-lines ratchet." >&2
exit 1
fi
git fetch --no-tags --depth=1 origin \
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin \
"+${merge_base_sha}:refs/remotes/origin/ci-max-lines-base"
base_ref="refs/remotes/origin/ci-max-lines-base"
else
default_branch="${RATCHET_DEFAULT_BRANCH:-main}"
git fetch --no-tags --depth=1 origin \
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin \
"+refs/heads/${default_branch}:refs/remotes/origin/ci-max-lines-base"
base_ref="refs/remotes/origin/ci-max-lines-base"
fi
@@ -1896,7 +1896,7 @@ jobs:
fi
harness_root="${RUNNER_TEMP}/openclaw-ci-shard-runner"
workflow_remote="https://github.com/${job_workflow_repository}.git"
git fetch --no-tags --depth=1 "$workflow_remote" "$job_workflow_sha"
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 "$workflow_remote" "$job_workflow_sha"
for file in \
scripts/ci-run-node-test-shard.mjs \
scripts/lib/direct-run.mjs \
@@ -2032,7 +2032,7 @@ jobs:
pnpm check:host-env-policy:swift
pnpm dup:check:coverage
if [ -n "$PR_BASE_SHA" ]; then
git fetch --no-tags --depth=1 origin "+${PR_BASE_SHA}:refs/remotes/origin/ci-base"
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin "+${PR_BASE_SHA}:refs/remotes/origin/ci-base"
node scripts/report-test-temp-creations.mjs --base refs/remotes/origin/ci-base --head HEAD --no-merge-base
fi
pnpm deps:patches:check
test/scripts/ci-workflow-guards.test.ts
+16 -8
View File
@@ -3370,13 +3370,15 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
).run;
expect(securityDiffBase).toContain("git rev-list --parents -n 1 HEAD");
expect(securityDiffBase).not.toContain("node scripts/lib/merge-head-diff-base.mjs");
expect(
parsedWorkflow.jobs["check-shard"].steps.find(
(step: WorkflowStep) => step.name === "Run check shard",
).env.PR_BASE_SHA,
).toBe(
const checkShardStep = parsedWorkflow.jobs["check-shard"].steps.find(
(step: WorkflowStep) => step.name === "Run check shard",
);
expect(checkShardStep.env.PR_BASE_SHA).toBe(
"${{ github.event_name == 'pull_request' && needs.preflight.outputs.diff_base_revision || '' }}",
);
expect(checkShardStep.run).toContain(
'timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin "+${PR_BASE_SHA}:refs/remotes/origin/ci-base"',
);
});
it("uses stable deadcode checks for current and frozen checkouts", () => {
@@ -3503,7 +3505,9 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
expect(releaseGateMerge.run).toContain(
'"+refs/pull/${PULL_REQUEST_NUMBER}/merge:refs/remotes/origin/ci-max-lines-merge"',
);
expect(releaseGateMerge.run).toContain("git fetch --no-tags --depth=2 origin \\");
expect(releaseGateMerge.run).toContain(
"timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=2 origin \\",
);
expect(releaseGateMerge.run).toContain(
"release-gate merge tree did not refresh to the current pull request base and head",
);
@@ -3514,7 +3518,11 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
expect(releaseGateMerge.run).toContain(
'echo "RATCHET_RELEASE_MERGE_TREE=true" >> "$GITHUB_ENV"',
);
expect(checksFastRun.run).toContain("git fetch --no-tags --depth=1 origin \\");
expect(
checksFastRun.run.match(
/timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin \\/gu,
),
).toHaveLength(4);
expect(checksFastRun.run).toContain('git ls-remote origin "refs/heads/${default_branch}"');
expect(checksFastRun.run).toContain(
'"repos/${GITHUB_REPOSITORY}/compare/${default_sha}...${RATCHET_MANUAL_TARGET_SHA}"',
@@ -4111,7 +4119,7 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
'if [[ ! -f "$runner" ]]',
"job_workflow_repository=$(jq -r '.workflow_repository // empty' <<<\"$JOB_CONTEXT_JSON\")",
"job_workflow_sha=$(jq -r '.workflow_sha // empty' <<<\"$JOB_CONTEXT_JSON\")",
'git fetch --no-tags --depth=1 "$workflow_remote" "$job_workflow_sha"',
'timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 "$workflow_remote" "$job_workflow_sha"',
'git show "${job_workflow_sha}:${file}" > "${harness_root}/${file}"',
'node "$runner"',
]) {