From 1db1c46b32f9a98dcdddf2d08c4b2f70e2f9bcef Mon Sep 17 00:00:00 2001 From: kjh2064 Date: Sun, 12 Jul 2026 01:14:17 +0900 Subject: [PATCH] fix: Add explicit connect/max-time timeouts to curl and ssh calls Run #2005's Health Check job hung for 18+ minutes (well past its own timeout-minutes: 10) instead of failing within seconds. Killed the zombie container manually via 'docker kill' on the runner host. Root cause: the pre-fix curl calls to the unreachable $DEPLOY_HOST:5000 had no --connect-timeout/--max-time, so each of the 20 retry attempts could hang on the OS's default TCP timeout instead of failing fast; the job-level timeout-minutes didn't reliably cut it off either (act_runner enforcement gap, not something we control from the workflow file). This is now largely moot after the previous commit (health checks run against 127.0.0.1 on the server itself, where curl returns near-instantly), but added explicit timeouts everywhere as a second line of defense against the same failure mode recurring: - Gitea API curl calls (release fetch, artifact download): --connect-timeout 10 --max-time 30/120 - Local 127.0.0.1 health-check curls: --connect-timeout 5 --max-time 10 - All ssh/scp invocations: -o ConnectTimeout=10 No single curl or ssh call in this workflow should now be able to hang indefinitely. --- .gitea/workflows/deploy-prod.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml index 0e9564aa..cfd7c566 100644 --- a/.gitea/workflows/deploy-prod.yml +++ b/.gitea/workflows/deploy-prod.yml @@ -59,7 +59,7 @@ jobs: RELEASE_URL="https://gitea.taxbaik.com/api/v1/repos/$REPO/releases/tags/$RELEASE_INPUT" fi - RELEASE=$(curl -sf -H "Authorization: token $TOKEN" "$RELEASE_URL") + RELEASE=$(curl -sf --connect-timeout 10 --max-time 30 -H "Authorization: token $TOKEN" "$RELEASE_URL") TAG=$(echo "$RELEASE" | jq -r '.tag_name') # NOTE: '.target_commitish' is the branch name the tag was cut from # (e.g. "main"), NOT a commit SHA -- do not use it as a commit hash. @@ -95,7 +95,7 @@ jobs: DOWNLOAD_URL="${{ steps.fetch.outputs.download_url }}" echo "Downloading: $DOWNLOAD_URL" - curl -sfL -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL" + curl -sfL --connect-timeout 10 --max-time 120 -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL" # A 404/error page would still create a small file -- verify it's a # real gzip archive, not an HTML/JSON error body (this is exactly @@ -151,6 +151,7 @@ jobs: scp -i ~/.ssh/deploy_key \ -P ${{ env.DEPLOY_PORT }} \ -o StrictHostKeyChecking=accept-new \ + -o ConnectTimeout=10 \ "$ARTIFACT" ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}:/tmp/ echo "✓ Release artifact uploaded" @@ -174,6 +175,7 @@ jobs: ssh -i ~/.ssh/deploy_key \ -p ${{ env.DEPLOY_PORT }} \ -o StrictHostKeyChecking=accept-new \ + -o ConnectTimeout=10 \ ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \ "ARTIFACT='$ARTIFACT' RELEASE_TAG='$RELEASE_TAG' COMMIT='$COMMIT' SERVICE_NAME='$SERVICE_NAME' bash -s" << 'REMOTE' set -e @@ -271,6 +273,7 @@ jobs: ssh -i ~/.ssh/deploy_key \ -p ${{ env.DEPLOY_PORT }} \ -o StrictHostKeyChecking=accept-new \ + -o ConnectTimeout=10 \ ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s << 'REMOTE' set -e ATTEMPTS=20 @@ -278,18 +281,18 @@ jobs: echo "【 Health Checks (max ${ATTEMPTS} attempts) 】" for i in $(seq 1 $ATTEMPTS); do - HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000") + HTTP_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000") if [ "$HTTP_CODE" = "200" ]; then echo "✓ [1/6] HTTP 200 OK (attempt $i)" - LOGIN_BODY=$(curl -s http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "") + LOGIN_BODY=$(curl -s --connect-timeout 5 --max-time 10 http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "") if echo "$LOGIN_BODY" | grep -q "login\|Login\|로그인"; then echo "✓ [2/6] Login page content verified" else echo "⚠ [2/6] Login page content verification skipped" fi - CSS_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000") + CSS_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000") if [ "$CSS_CODE" = "200" ]; then echo "✓ [3/6] CSS file loaded" else