From a7560c1f84eaf97b8fd75c597c1fbacf65304c67 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 27 Jul 2026 14:58:12 -0700 Subject: [PATCH] Bound how long Upload Assets can hang MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A full sync of all 128 graphics takes ~3 minutes, but nothing capped the job. Today a Configure AWS credentials step stalled on connect ETIMEDOUT to sts.us-east-2.amazonaws.com; it ran 19 minutes before being cancelled by hand, with hours of headroom left under GitHub's 6-hour default. Two bounds, because they fail differently: timeout-minutes: 15 on the job — a backstop for a hang in any step, not just this one. Five times the observed full-sync duration. action-timeout-s: 120 on the credentials step — the action defaults to no timeout and 12 retries, and a TCP connect timeout costs ~6m45s per attempt, so the default budget is ~81 minutes. Retries are kept, just lowered to 3: transient STS errors are real and worth retrying, but the OIDC token expires partway through a long retry loop, so later attempts cannot succeed anyway. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/upload-assets.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/upload-assets.yml b/.github/workflows/upload-assets.yml index 8336e920..d8ed39f1 100644 --- a/.github/workflows/upload-assets.yml +++ b/.github/workflows/upload-assets.yml @@ -40,6 +40,10 @@ env: jobs: upload: runs-on: ubuntu-latest + # A full sync of all 128 graphics takes ~3 minutes. Without this the job + # inherits GitHub's 6-hour default, which is how a stuck credentials step + # sat for 19 minutes with hours of headroom left. + timeout-minutes: 15 steps: - uses: actions/checkout@v5 with: @@ -97,6 +101,12 @@ jobs: with: role-to-assume: ${{ vars.AWS_ASSETS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} + # The action defaults to no timeout and 12 retries. A TCP connect + # timeout to STS takes ~6m45s per attempt, so the default can spend + # ~81 minutes on a failure that cannot succeed — the OIDC token + # expires partway through. Cap the whole step instead. + action-timeout-s: 120 + retry-max-attempts: 3 - name: Upload to S3 if: steps.plan.outputs.count != '0' && inputs.dry_run != true