fix(ci): bound docs-sync publish repo git clone

wanyongstar · wanyongstar · commit 45171e9dfd40 · 2026-07-17T00:03:53.000+08:00
## Summary - Problem: The `git clone` of `openclaw/docs.git` in `docs-sync-publish.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in #108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git clone` command. - What changed: Wrapped the `git clone` command with timeout, matching the bounded pattern from #108940. - What did NOT change: All retry logic, publish sync steps, and non-network operations remain unchanged. ## Real behavior proof - **Behavior addressed:** CI docs-sync-publish workflow could hang indefinitely during git clone of external docs repo. - **Real environment tested:** Pattern analysis and cross-reference with already-merged Crabbox fix (#108940 / 16c2bbb). - **Exact change:** `if timeout --signal=TERM --kill-after=10s 120s git clone \` replaces `if git clone \`. - **Evidence after fix:** Same `timeout --signal=TERM --kill-after=10s 120s` wrapper applied to Crabbox source retrieval. - **What was not tested:** Live CI run. ## Root Cause - The git clone was added before the timeout-bounding pattern was standardized across CI workflows. Missing automated check for unbounded external git operations.
diff --git a/.github/workflows/docs-sync-publish.yml b/.github/workflows/docs-sync-publish.yml
@@ -56,7 +56,7 @@ jobs:
           set -euo pipefail
           for attempt in 1 2 3 4 5; do
             rm -rf publish
-            if git clone \
+            if timeout --signal=TERM --kill-after=10s 120s git clone \
               "https://x-access-token:${OPENCLAW_DOCS_SYNC_TOKEN}@github.com/openclaw/docs.git" \
               publish; then
               exit 0
