Add a 30-second timeout guard to script/test and script/lint #16

New Issue

2026-08-09T03:44:27+02:00

clawbot commented

2026-08-09 03:44:27 +02:00

Problem

REPO_POLICIES.md: "make test must complete in under 20 seconds. Add a
30-second timeout in the Makefile." EXISTING_REPO_CHECKLIST.md restates it as
"make test has a 30-second timeout".

Neither script/test nor script/lint has any timeout. Both are bare hugo --minify invocations. The build currently takes about 16 ms, so the 20-second
budget is met with five orders of magnitude to spare — but there is no guard,
so a hang (a pathological template loop, a wedged filesystem, a future remote
Hugo module fetch) blocks the gate and CI indefinitely instead of failing.

Fix

Wrap the build in timeout 30 in both scripts. The timeout binary is in
coreutils and is present in the alpine build image; confirm it is available in
script/bootstrap's install set on all four supported package managers, or
guard its use if it is not universally present.

Keep the guard in the scripts rather than the Makefile. The policy text says
"in the Makefile", but in this repo the Makefile targets are thin shims by
design and every implementation lives in script/ — putting logic in the
Makefile would break the scripts-to-rule-them-all pattern the policy mandates
elsewhere. The scripts are also what the Dockerfile and pre-commit hook
actually invoke, so a Makefile-level guard would not cover those paths. Note
this reasoning in the PR body.

Definition of done

script/test and script/lint both bound their Hugo invocation to 30
seconds.
A timeout exits non-zero with a message that makes the cause obvious — a
bare 124 exit code is not good enough.
timeout availability is verified in the Docker build environment; if
script/bootstrap needs to install coreutils on any of the four supported
package managers, it does so.
make test, make lint, and make check all still pass and still complete
in well under 20 seconds.
script/cibuild succeeds.
TODO.md updated in the same commit.

No sensible Hugo equivalent — explicitly not applicable

go test -timeout 30s -race -cover ./... — the canonical Makefile
snippet for this rule is Go-specific. -timeout is a go test flag,
-race needs a compiled binary with race instrumentation, and -cover needs
Go source. Only the wall-clock bound transfers, via timeout(1).
The conditional verbose rerun pattern (<cmd> || { echo "--- Rerunning with -v ---"; <cmd> -v; exit 1; }) — do not implement this here. It
presupposes a test runner with a quiet/verbose pair. hugo --minify has no
such pair; the nearest analogue is re-running with --logLevel debug, which
would double the build on every failure for marginal extra signal, and Hugo
already prints the failing template and line on error. Adding it would be
cargo-culting the Go pattern into a place it does not fit.

Ref: REPO_POLICIES.md — "Docker builds must complete in under 5 minutes",
"make test must complete in under 20 seconds. Add a 30-second timeout".

## Problem `REPO_POLICIES.md`: "`make test` must complete in under 20 seconds. Add a 30-second timeout in the Makefile." `EXISTING_REPO_CHECKLIST.md` restates it as "`make test` has a 30-second timeout". Neither `script/test` nor `script/lint` has any timeout. Both are bare `hugo --minify` invocations. The build currently takes about 16 ms, so the 20-second budget is met with five orders of magnitude to spare — but there is no guard, so a hang (a pathological template loop, a wedged filesystem, a future remote Hugo module fetch) blocks the gate and CI indefinitely instead of failing. ## Fix Wrap the build in `timeout 30` in both scripts. The `timeout` binary is in coreutils and is present in the alpine build image; confirm it is available in `script/bootstrap`'s install set on all four supported package managers, or guard its use if it is not universally present. Keep the guard in the scripts rather than the `Makefile`. The policy text says "in the Makefile", but in this repo the Makefile targets are thin shims by design and every implementation lives in `script/` — putting logic in the Makefile would break the scripts-to-rule-them-all pattern the policy mandates elsewhere. The scripts are also what the `Dockerfile` and pre-commit hook actually invoke, so a Makefile-level guard would not cover those paths. Note this reasoning in the PR body. ## Definition of done 1. `script/test` and `script/lint` both bound their Hugo invocation to 30 seconds. 2. A timeout exits non-zero with a message that makes the cause obvious — a bare `124` exit code is not good enough. 3. `timeout` availability is verified in the Docker build environment; if `script/bootstrap` needs to install coreutils on any of the four supported package managers, it does so. 4. `make test`, `make lint`, and `make check` all still pass and still complete in well under 20 seconds. 5. `script/cibuild` succeeds. 6. `TODO.md` updated in the same commit. ## No sensible Hugo equivalent — explicitly not applicable - **`go test -timeout 30s -race -cover ./...`** — the canonical Makefile snippet for this rule is Go-specific. `-timeout` is a `go test` flag, `-race` needs a compiled binary with race instrumentation, and `-cover` needs Go source. Only the wall-clock bound transfers, via `timeout(1)`. - **The conditional verbose rerun pattern** (`<cmd> || { echo "--- Rerunning with -v ---"; <cmd> -v; exit 1; }`) — do **not** implement this here. It presupposes a test runner with a quiet/verbose pair. `hugo --minify` has no such pair; the nearest analogue is re-running with `--logLevel debug`, which would double the build on every failure for marginal extra signal, and Hugo already prints the failing template and line on error. Adding it would be cargo-culting the Go pattern into a place it does not fit. Ref: `REPO_POLICIES.md` — "Docker builds must complete in under 5 minutes", "`make test` must complete in under 20 seconds. Add a 30-second timeout".

clawbot referenced this issue

2026-08-09 03:45:01 +02:00

Hash-pin every external reference in .gitea/workflows/deploy.yml #7

clawbot referenced this issue

2026-08-09 11:57:01 +02:00

script/check does not run script/lint, so lint is ungated in CI #9

clawbot referenced this issue

2026-08-09 11:59:13 +02:00

Run script/lint from script/check (closes #9) #24

clawbot referenced this issue

2026-08-09 11:59:36 +02:00

Run script/lint from script/check (closes #9) #24