Skip to content

fix(strix): bound scanner runtime to 900 seconds #1889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 1 commit into from
Sep 5, 2026
+9 −10
Merged

fix(strix): bound scanner runtime to 900 seconds #1889

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions .github/workflows/strix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,12 +342,10 @@ jobs:
strix:
needs: [changed-scope, admit-current-head]
if: needs.changed-scope.outputs.code == 'true' && needs.admit-current-head.outputs.admitted == 'true'
# Large, actively-growing repositories (e.g. contextual-orchestrator) can
# legitimately require well over two hours to scan -- this org's own
# standing operating directive accepts that central OpenCode/Strix/Noema
# scans may take more than two hours per model (docs/product-goal-directive.md).
# Inference has no wall-clock deadline; cancellation is reserved for an
# explicit operator action or a superseded head.
# Leave enough time for trusted setup, a 900-second scan, and fail-closed
# report collection without allowing one wedged model call to retain a
# shared runner indefinitely.
timeout-minutes: 30
runs-on: ubuntu-24.04
# Least-privilege token scoped to this job (Scorecard alert #43): the scan
# exchanges an OIDC token (id-token) and publishes same-repo status evidence
Expand Down Expand Up @@ -942,8 +940,8 @@ jobs:
run: |
export LLM_TIMEOUT=0
export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0
export STRIX_PROCESS_TIMEOUT_SECONDS=0
export STRIX_TOTAL_TIMEOUT_SECONDS=0
export STRIX_PROCESS_TIMEOUT_SECONDS=900
export STRIX_TOTAL_TIMEOUT_SECONDS=900

# Recognized signals that the LLM backend was unavailable / starved.
# Defined before the gate loop so the bounded retry decision below
Expand Down
5 changes: 3 additions & 2 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,10 +301,11 @@ assert_strix_workflow_pr_trigger_hardened() {
assert_file_contains "$workflow_file" "CONTEXTUAL_ORCHESTRATOR_TOKEN" "strix workflow uses the sidecar token"
assert_file_not_contains "$workflow_file" "timeout-minutes: 200" "strix workflow job must not cap model inference"
assert_file_not_contains "$workflow_file" "timeout-minutes: 170" "strix scan step must not cap model inference"
assert_file_contains "$workflow_file" "timeout-minutes: 30" "strix job leaves bounded setup and report-collection time around the scan"
assert_file_contains "$workflow_file" 'export LLM_TIMEOUT=0' "strix disables the model client inference timeout"
assert_file_contains "$workflow_file" 'export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0' "strix disables the memory-compressor inference timeout"
assert_file_contains "$workflow_file" 'export STRIX_PROCESS_TIMEOUT_SECONDS=0' "strix disables the scanner process timeout"
assert_file_contains "$workflow_file" 'export STRIX_TOTAL_TIMEOUT_SECONDS=0' "strix disables the total scanner timeout"
assert_file_contains "$workflow_file" 'export STRIX_PROCESS_TIMEOUT_SECONDS=900' "strix bounds one scanner process to 900 seconds"
assert_file_contains "$workflow_file" 'export STRIX_TOTAL_TIMEOUT_SECONDS=900' "strix bounds the complete scanner attempt to 900 seconds"
assert_file_contains "$workflow_file" 'Error code:[[:space:]]*500[^[:cntrl:]]*internal_error' "strix workflow retries contextual-orchestrator internal provider failures"
assert_file_contains "$workflow_file" 'strix_gate_console.log" "$GITHUB_WORKSPACE/strix_runs/gate-console.log' "strix workflow preserves partial console output after failures and timeouts"
assert_file_contains "$REPO_ROOT/scripts/ci/strix_quick_gate.sh" "gate-last-attempt.log" "strix gate preserves the last partial attempt before runtime cleanup"
Expand Down
Loading