Skip to content

fix: add 60-second timeout to git fetch for mutable boilerplates-ref#55

Open
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-git-fetch-no-timeout-001
Open

fix: add 60-second timeout to git fetch for mutable boilerplates-ref#55
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-git-fetch-no-timeout-001

Conversation

@kitsuyui

Copy link
Copy Markdown
Member

Summary

Add a 60-second wall-clock timeout to the git fetch call used when resolving mutable boilerplates-ref values.

Problem

action.yml wraps curl downloads with --connect-timeout 10 --max-time 30, but the git fetch --tags origin on line 299 has no command-level timeout. A TCP hang (GitHub outage, NAT keepalive timeout, slow self-hosted runner) blocks the job until GitHub Actions' global timeout-minutes (default: 360 minutes).

Change

Wrap the git fetch with timeout 60:

timeout 60 git -C "${boilerplates_dir}" fetch --tags origin "${INPUT_BOILERPLATES_REF}"

The 60-second value is 2× the --max-time 30 used for curl to account for git's additional protocol negotiation overhead. timeout(1) is part of GNU coreutils and is available on all GitHub-hosted Linux and macOS runners.

Scope

Only affects the mutable-ref code path (branch name or tag name as boilerplates-ref). Full SHA inputs skip the git fetch entirely and are unaffected.

git fetch has no command-level timeout by default. Wrap the call with
`timeout 60` to mirror the --max-time 30 used for curl downloads.
A TCP hang (GitHub outage, NAT timeout, slow self-hosted runner) would
otherwise block the job until GitHub Actions' global timeout-minutes.

The timeout value is 60 s—2× the curl --max-time 30—to account for
git's additional protocol negotiation overhead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant