test(reliability): bound commercial-release Git metadata lookup

[seonghobae]

Reliability gap

Advances #555 with the previously uncovered build_commercial_release.py local-Git metadata subprocess slice from exact protected main a7be9eb8ca0b807364173f8471fc300e3cf9350f.

scripts/build_commercial_release.py::_source_commit() invokes git rev-parse HEAD without a per-operation timeout and catches every exception into "unknown". A hung local Git child can therefore consume runner capacity until an outer job timeout, while subprocess.TimeoutExpired is silently converted into apparently usable provenance.

Intentional fail-first contract

Exact test-only head: 550ee1f6d1fc4191f2e708a8217304be0d4ec1ab, directly based on protected main.

tests/test_commercial_release_git_metadata_timeout.py requires:

• one package-owned positive local-Git deadline no greater than 30 seconds;
• that deadline to be passed to the existing subprocess.run(["git", "rev-parse", "HEAD"], ...) call;
• TimeoutExpired to fail closed as exact stable RuntimeError("source commit lookup timed out") without reflecting command/stdout/stderr/repo-path content;
• successful lookup to preserve stripped commit output; and
• ordinary non-timeout Git failures to preserve the historical "unknown" fallback.

Current protected-main code is expected to fail at the actual _source_commit() production boundary because it passes no timeout and broadly swallows timeout. Setup/import/fixture/changelog failure is not valid RED.

Minimum GREEN after exact RED proof

1. Add a clearly named package-owned local Git metadata deadline in scripts/build_commercial_release.py and pass it through subprocess.run(timeout=...).
2. Catch subprocess.TimeoutExpired explicitly before the ordinary fallback and raise RuntimeError("source commit lookup timed out") from None; never echo child-controlled details.
3. Preserve success and the existing "unknown" fallback for ordinary non-timeout Git/OS failure.
4. Keep this slice limited to source-commit lookup. _run_command() executes heterogeneous release stages and requires operation-specific deadlines rather than a blanket value; do not silently fold it into this PR.
5. After product GREEN add concise reliability: add operation-specific subprocess deadlines and timeout evidence #555 reliability doctoring grounded in current Python subprocess/GitHub Actions primary docs plus an authoritative changelog fragment, render/check managed CHANGELOG.md, and require exact changed-production statement/branch coverage.
6. Require one unchanged final head with focused/full Python, Rust/PyO3, package/reinstall/release acceptance, GPU/fuzz, Security/SAST, current-head review and repository governance.

This slice is disjoint from active #666/#667/#669/#670/#578/#657 and replaces no canonical #604/#621 documentation. No psychometric/numerical formula, dependency/workflow, package version/release, acquisition-value semantics, hosted state or reviewer authority change belongs here.

Keep Draft until RED→GREEN history and final gates are complete.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 44c9a6ba-cc6a-44b5-a1d0-3df5132a8d8d

📥 Commits

Reviewing files that changed from the base of the PR and between 384516b and f440063.

📒 Files selected for processing (2)

• scripts/build_commercial_release.py
• tests/test_commercial_release_git_metadata_timeout.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Exact bounded GREEN implementation for issue #555 / Draft #675. Immediately before any write, refetch exact source head 550ee1f6d1fc4191f2e708a8217304be0d4ec1ab, independently resolve protected main (currently a7be9eb8ca0b807364173f8471fc300e3cf9350f), inspect current comments/reviews, and refetch scripts/build_commercial_release.py plus the fail-first test. Proceed only if the source head/base remain compatible and no other source writer targets this branch/path; abort rather than race.

Exact fail-first production-boundary evidence is now valid. CI run 31432161655, Python job 93597914170, synthetic merge 1e897e5d08e4c0a355d577d5eb2df98e27b30aca completed 2 failed, 2949 passed, 2 skipped. The ONLY failures are the two intended tests/test_commercial_release_git_metadata_timeout.py contracts: _source_commit() swallows TimeoutExpired instead of raising the stable package error, and successful lookup receives no bounded timeout=. The ordinary non-timeout fallback test is GREEN. Package/build/reinstall/release-acceptance/enterprise-readiness and GPU-smoke are GREEN; Security Scan 31432161670 and SAST 31432161772 are GREEN. The known _log_sigmoid RuntimeWarning is unrelated #583/#564 and must not be touched.

Implement only the root-cause fix:

1. Add one documented package-owned local Git metadata deadline in (0, 30] seconds (reuse a clearly named constant) and pass it as timeout= to the existing subprocess.run(["git", "rev-parse", "HEAD"], ...) call.
2. Catch subprocess.TimeoutExpired before the ordinary fallback and raise exactly RuntimeError("source commit lookup timed out") from None. Do not echo command/stdout/stderr/repo path or other caller-controlled content.
3. Preserve successful stripped SHA behavior and preserve the current "unknown" fallback for ordinary non-timeout Git/OS failures. Do not catch KeyboardInterrupt, SystemExit, or GeneratorExit beyond current Python semantics.
4. Keep _run_command() out of this slice: it launches heterogeneous build/release/benchmark/procurement stages whose deadlines must be operation-specific under reliability: add operation-specific subprocess deadlines and timeout evidence #555; do not add a blanket timeout there.
5. Strengthen focused tests only if needed for non-reflection or exact deadline forwarding. After product GREEN, add concise reliability: add operation-specific subprocess deadlines and timeout evidence #555 reliability doctoring grounded in current Python 3.14 subprocess.run(..., timeout=...) and GitHub Actions timeout documentation, add an authoritative docs/changelog.d fragment, render/check managed CHANGELOG.md, run focused tests and git diff --check, then the full applicable suite.
6. Require meaningful changed-production statement/branch coverage and complete docs. Keep Draft; after the coherent verified update stop source writes so current-head CI/Security/SAST/review/Ready/merge returns to the maintainer loop.

Do not change acquisition-value/readiness semantics, numerical code, dependencies/workflows, package version/release, canonical #604/#621 docs, hosted state, or reviewer authority.

[github-actions]

자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요.

[seonghobae]

Superseded by unified Git metadata timeout fix PR (see fix/git-metadata-timeouts-unified).