ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-28 13:26:04 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): bound release-checks git fetch operations with timeout (#110028)

Browse Source 
* fix(ci): bound release-checks git fetch operations with timeout

* fix(ci): bound release fetches across auth modes

Co-authored-by: wanyongstar <wan.yong@xydigit.com>

* style(ci): format release timeout guard

Co-authored-by: wanyongstar <wan.yong@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
This commit is contained in:
wanyongstar
2026-07-18 13:32:19 +08:00
committed by GitHub
parent 700a089d3b
commit c1e5c1d4fa
2 changed files with 34 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/openclaw-release-checks.yml
+12 -12
View File
@@ -228,13 +228,13 @@ jobs:
set -euo pipefail
SELECTED_SHA="$(git rev-parse HEAD)"
git_fetch_with_checkout_auth() {
if git config --get-all http.https://github.com/.extraheader >/dev/null; then
git fetch "$@"
return
local -a git_args=(git)
if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
fi
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
}
git_fetch_with_checkout_auth --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
git_fetch_with_checkout_auth --tags origin '+refs/tags/*:refs/tags/*'
@@ -289,13 +289,13 @@ jobs:
fi
alpha_branch="${WORKFLOW_REF#refs/heads/}"
git_fetch_with_checkout_auth() {
if git config --get-all http.https://github.com/.extraheader >/dev/null; then
git fetch "$@"
return
local -a git_args=(git)
if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
fi
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
}
git_fetch_with_checkout_auth --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
if ! git merge-base --is-ancestor "${SELECTED_SHA}" "refs/remotes/origin/${alpha_branch}"; then
test/scripts/ci-workflow-guards.test.ts
+22
View File
@@ -2946,6 +2946,28 @@ describe("ci workflow guards", () => {
}
});
it("bounds release ref validation fetches across checkout auth modes", () => {
const resolveTargetSteps = readReleaseChecksWorkflow().jobs.resolve_target.steps;
for (const stepName of [
"Validate selected ref belongs to this repository",
"Validate Tideclaw alpha target matches workflow branch",
]) {
const step = resolveTargetSteps.find(
(candidate: WorkflowStep) => candidate.name === stepName,
);
expect(step?.run, stepName).toContain("local -a git_args=(git)");
expect(step?.run, stepName).toContain(
'git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")',
);
expect(step?.run, stepName).toContain(
'timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"',
);
expect(step?.run, stepName).not.toContain('git -c "http.https://github.com/.extraheader');
}
});
it("bounds shared base commit fetches", () => {
const action = readFileSync(".github/actions/ensure-base-commit/action.yml", "utf8");
const exactFetch = action.indexOf('fetch_base_ref --no-tags --depth=1 origin "$BASE_SHA"');