Skip to content

fix: add default 30s request timeout, release workflow, CI action pinning - #5

Merged
Patel230 merged 3 commits into
mainfrom
fix/audit-sweep-2026-08
Aug 16, 2026
Merged

fix: add default 30s request timeout, release workflow, CI action pinning#5
Patel230 merged 3 commits into
mainfrom
fix/audit-sweep-2026-08

Conversation

@Patel230

Copy link
Copy Markdown
Contributor

Summary

  • Default timeouttimeoutMs: 30000 (30s whole-request deadline, bounds retries too). Manual signal combiner for Node 18 compat. Error surfaces as DOMException with name "TimeoutError".
  • Release workflow — release-please + npm publish with provenance (modeled on hawk-sdk-go).
  • CI pinning — floating @v4 action tags resolved to SHAs (checkout v4.4.0, setup-node v4.4.0, gh-release v2.2.2).

Test plan

  • npm run typecheck clean
  • npm test — 54/54 pass (7 new: stalled server, timeout wins, retry deadline, caller signal wins)

Every request now runs under a timeoutMs deadline (default 30000ms) that bounds the whole logical request including all retry attempts and backoff sleeps, so a stuck daemon can no longer hang consumers. The caller-supplied AbortSignal composes with the deadline via a manual signal combiner (AbortSignal.any needs Node 20.3; engines is >=18) and its abort reason propagates unchanged. Deadlines reject with a TimeoutError DOMException; aborts are never retried. timeoutMs: 0 disables the deadline.
Add a release workflow modeled on hawk-sdk-go's tag-triggered release workflow, adapted for npm: setup-node with registry-url, npm publish --provenance with NODE_AUTH_TOKEN, and a softprops/action-gh-release step; permissions include id-token: write for provenance. Pin the floating actions/checkout@v4 and actions/setup-node@v4 tags in ci.yml to their v4.4.0 commit SHAs, resolved and verified via git ls-remote.
Document the actual retry, backoff, jitter, and timeout defaults of the Go, TypeScript, and Python SDKs with file and symbol references, so the drift between them is visible. No code defaults were changed.
@Patel230
Patel230 merged commit a7fc387 into main Aug 16, 2026
2 checks passed
@Patel230
Patel230 deleted the fix/audit-sweep-2026-08 branch August 16, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant