mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
rcourtman
5434868bd0
The retry hardening added in #1885 bounded attempts but not time. npm's own fetch-timeout defaults to five minutes and it retries internally, so three "attempts" against a hanging advisory endpoint ran for 10m56s on job 100986651307, and a second audit step added 3m36s. The Frontend job was cancelled 31s into type-check with all 1183 test files already passing, and a cancelled job reports as a failed required check, so a green run blocked every pull request. #1888 raised the job timeout to 40 minutes to unblock delivery; this decides the policy instead. Each attempt now runs under a hard wall-clock bound and the sequence stops at a total deadline (60s and 240s by default). npm's internal retry loop is disabled in favour of this one, since it was the hidden multiplier. The bound is enforced by a watchdog subshell rather than timeout(1), which is not present on every developer machine. What happens when the endpoint stays unreachable is unchanged, because that split was already right: the run fails when the change touches the dependency graph and the answer is genuinely unknown, and warns without failing when it does not, because the graph is then identical to a base commit that already produced a passing answer. Any advisory at any severity still fails. Also drops the production-only audit from the per-pull-request path. It audits a subset of the same packages, so it reports a subset of the same advisories, and because the complete audit fails the job on any finding, the production step could only ever execute in the cases where it was already guaranteed clean. The dev-versus-production split still runs for every npm workspace in the scheduled security-scan job, where it informs rather than blocks delivery, and Dependabot security updates remain the route for advisories published against unchanged dependencies. With the audit bounded to 4 minutes against an ~11 minute baseline, the job timeout returns to 30: a stalled endpoint should surface as a warning, not be absorbed by a budget large enough to hide it.