fix(ci): bound macos-release git fetch with timeout#109174
Merged
Patrick-Erichsen merged 1 commit intoJul 18, 2026
Merged
Conversation
## Summary - Problem: The `git fetch` in `macos-release.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in openclaw#108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git fetch` command. - What changed: Wrapped the `git fetch --no-tags origin` command with timeout. - What did NOT change: All release logic remains unchanged. ## Real behavior proof - **Behavior addressed:** CI macos-release could hang during git fetch. - **Evidence:** Same timeout pattern as merged Crabbox fix (openclaw#108940 / 16c2bbb). - **Change:** `timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags origin` replaces `git fetch --no-tags origin`. ## Root Cause - The git fetch was added before the timeout-bounding pattern was standardized across CI workflows.
clawsweeper
Bot
added
rating: 🧂 unranked krab
Contributor
|
Codex review: needs maintainer review before merge. Reviewed July 17, 2026, 5:16 AM ET / 09:16 UTC. Summary PR surface: Config 0. Total 0 across 1 file. Reproducibility: yes. at the source-command level: an extracted copy of the production step with a deliberately stalled Git transport terminates on the scaled deadline and returns 124. The evidence does not require reproducing an actual multi-hour GitHub transport outage. Review metrics: none identified. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land the bounded fetch after routine release-owner review, retaining the existing ref and release-check logic while treating the 120-second cutoff as the intentional operational limit. Do we have a high-confidence way to reproduce the issue? Yes at the source-command level: an extracted copy of the production step with a deliberately stalled Git transport terminates on the scaled deadline and returns 124. The evidence does not require reproducing an actual multi-hour GitHub transport outage. Is this the best way to solve the issue? Yes. Applying the already-merged bounded-process pattern directly to the only unbounded network fetch is narrower and more maintainable than adding new workflow machinery or retry policy. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against bd7b0ad85f57. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Config 0. Total 0 across 1 file. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
clawsweeper
Bot
added
proof: sufficient
This was referenced Jul 18, 2026
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Jul 18, 2026
## Summary - Problem: The `git fetch` in `macos-release.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in openclaw#108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git fetch` command. - What changed: Wrapped the `git fetch --no-tags origin` command with timeout. - What did NOT change: All release logic remains unchanged. ## Real behavior proof - **Behavior addressed:** CI macos-release could hang during git fetch. - **Evidence:** Same timeout pattern as merged Crabbox fix (openclaw#108940 / 05fa39e). - **Change:** `timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags origin` replaces `git fetch --no-tags origin`. ## Root Cause - The git fetch was added before the timeout-bounding pattern was standardized across CI workflows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
Fixes an issue where the
macos-releaseworkflow could remain stuck in thegit fetchstep until the job timeout when the Git transport stalls. This blocks the macOS release pipeline and wastes runner time.Why This Change Was Made
The
git fetchcommand now runs through the repository's bounded process pattern: a 120-second deadline, followed by a 10-second termination grace period. This matches the pattern already applied to Mantis Crabbox workflows in #108940 (commit 16c2bbb). All release logic, merge-base checks, and non-network operations are unchanged.User Impact
Maintainers get a prompt, actionable fetch failure instead of losing a macOS release runner for the full job timeout before the release begins.
Evidence
Regression:
node scripts/run-vitest.mjs test/scripts/package-acceptance-workflow.test.ts --run --testNamePattern="bounds macos-release git fetch"??1 passed.Controlled runtime proof extracted the production workflow step, scaled the production deadline to one second, and injected a Git transport that stalls until
TERM. The step returned 124 in about 1.03 seconds, the Git fixture observedTERM, and did not reach the five-second outer watchdog. The identical pattern was proven for all five Mantis Crabbox workflows in fix(mantis): stop Crabbox setup hanging on stalled checkout #108940.pnpm exec oxfmt --checkpassed for the changed file;git diff --checkpassed.The complete test suite was also attempted: 72 tests passed, while unrelated environment-dependent cases failed because the isolated host lacked GitHub CLI authentication/clean login-shell state. The affected focused regression is green.