fix(ci): bound release-checks git fetch operations with timeout (#110028)

* fix(ci): bound release-checks git fetch operations with timeout

* fix(ci): bound release fetches across auth modes

Co-authored-by: wanyongstar <wan.yong@xydigit.com>

* style(ci): format release timeout guard

Co-authored-by: wanyongstar <wan.yong@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
This commit is contained in:
wanyongstar
2026-07-18 13:32:19 +08:00
committed by GitHub
parent 700a089d3b
commit c1e5c1d4fa
2 changed files with 34 additions and 12 deletions
+12 -12
View File
@@ -228,13 +228,13 @@ jobs:
set -euo pipefail
SELECTED_SHA="$(git rev-parse HEAD)"
git_fetch_with_checkout_auth() {
if git config --get-all http.https://github.com/.extraheader >/dev/null; then
git fetch "$@"
return
local -a git_args=(git)
if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
fi
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
}
git_fetch_with_checkout_auth --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
git_fetch_with_checkout_auth --tags origin '+refs/tags/*:refs/tags/*'
@@ -289,13 +289,13 @@ jobs:
fi
alpha_branch="${WORKFLOW_REF#refs/heads/}"
git_fetch_with_checkout_auth() {
if git config --get-all http.https://github.com/.extraheader >/dev/null; then
git fetch "$@"
return
local -a git_args=(git)
if ! git config --get-all http.https://github.com/.extraheader >/dev/null; then
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git_args+=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}")
fi
local auth_header
auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch "$@"
timeout --signal=TERM --kill-after=10s 120s "${git_args[@]}" fetch "$@"
}
git_fetch_with_checkout_auth --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
if ! git merge-base --is-ancestor "${SELECTED_SHA}" "refs/remotes/origin/${alpha_branch}"; then