test(reliability): bound PR queue Git metadata lookup

[seonghobae]

Reliability defect

Protected main aa5e84963e428aaa8c2900138bb36b07b8d649a7 bounds git rev-parse HEAD in several release/evidence builders through #704, but scripts/build_pr_queue_governance.py::_source_commit still calls subprocess.run(...) with no timeout and converts every exception to the string unknown. Because this governance builder is itself invoked by the commercial release evidence flow, a hung Git child can still hold the release/control-plane lane indefinitely.

Intentional RED

Exact test-only head: 76168c4cf7bba78b7681d4bd78bc7504c3247be0, directly based on the protected head above.

tests/test_pr_queue_governance_git_timeout.py replaces the Git subprocess with a deterministic timeout and requires two production-boundary facts:

• _source_commit passes one package-owned positive deadline to subprocess.run; and
• an actual subprocess.TimeoutExpired fails closed as bounded RuntimeError("source commit lookup timed out") instead of being silently converted to unknown.

Current production code has no GIT_METADATA_TIMEOUT_SECONDS and supplies no timeout=, so this test is expected RED. Setup/import/fixture/changelog failure is not valid RED.

Minimum GREEN after RED proof

• add the same short, named Git metadata deadline already used by sibling evidence builders;
• pass it to this exact git rev-parse HEAD call;
• catch subprocess.TimeoutExpired before the generic fallback and raise the stable non-reflective timeout error;
• preserve the existing unknown fallback for ordinary non-timeout Git unavailability unless current tests prove a stronger contract;
• add only meaningful edge coverage/docstring/changelog material required by repository policy;
• run focused PR-queue governance tests, then full applicable CI/Security/SAST on one unchanged head.

No PR classification semantics, GitHub API retry policy, numerical code, dependency/workflow/version/release, or canonical #604/#621 documentation changes belong in this slice.

Summary by CodeRabbit

• Bug Fixes

  • Added a five-second limit for Git metadata lookups in the PR queue.
  • Git metadata retrieval now fails clearly and consistently when the lookup times out, instead of hanging or silently reporting an unknown revision.

• Tests

  • Added coverage to verify timeout handling and the configured lookup limit.

• Documentation

  • Updated the changelog with the new timeout and fail-closed behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a8dbc77-ad49-4dfa-a77a-f6695f4246d9

📥 Commits

Reviewing files that changed from the base of the PR and between 56967de and 91c9af3.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/changelog.d/707-pr-queue-git-metadata-timeout.md
• scripts/build_pr_queue_governance.py
• tests/test_pr_queue_governance_git_timeout.py

---

📝 Walkthrough

Walkthrough

The PR bounds git rev-parse HEAD to five seconds. Timeout failures now raise a stable RuntimeError. Tests verify the timeout argument and failure behavior. Changelogs document this and related fail-closed changes.

Changes

PR queue Git metadata timeout

Layer / File(s)	Summary
Bounded source commit lookup scripts/build_pr_queue_governance.py	The script applies a five-second timeout to git rev-parse HEAD and raises RuntimeError("source commit lookup timed out") when the command times out.
Timeout validation and release documentation tests/test_pr_queue_governance_git_timeout.py, docs/changelog.d/707-pr-queue-git-metadata-timeout.md, CHANGELOG.md	Tests verify timeout propagation and failure behavior. Changelogs record the timeout and related fail-closed backend, bundle export, and item-model validation changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/fast-mlsirm#645: Documents a related fail-closed behavior, while this PR changes Git metadata timeout handling.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pr-queue-git-metadata-timeout-20260811

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Fresh current-main reconciliation handoff for Draft #707. Immediately refetch source head, live protected main, changed paths, comments and writer evidence; proceed only if #707 is still e2815b41ab692de9e14c0179613ae1d2125b8e12 and main is still compatible with 56967deceafeb7ecd0ff08a98f196282a6ec81a3. Abort if another writer appears or either ref moves.

Fresh compare is diverged, ahead 4 / behind 10, merge base f54e430bd6e899d8c36103dd30bbcf1d48bb56f6. Preserve only the unique bounded slice: GIT_METADATA_TIMEOUT_SECONDS = 5, timeout= on _source_commit()'s git rev-parse HEAD, explicit subprocess.TimeoutExpired -> RuntimeError("source commit lookup timed out"), generic non-timeout Git failure -> existing unknown, focused regression, authoritative changelog fragment. Reconcile protected main non-destructively so current accepted backend/serving/mixed/CAT/support/changelog changes are not replayed as branch-owned work. Regenerate managed CHANGELOG.md only via the repository renderer after reconciliation.

Run focused PR-queue governance timeout tests and existing governance tests, renderer check, git diff --check, then all applicable same-head CI/Security/SAST. Keep Draft until the exact final head has current review evidence and zero valid unresolved findings. Do not change PR classification semantics, GitHub API retry policy, numerical code, dependencies/workflows, release/version, or canonical #604 docs.