harden fetch calls with timeouts and try/catch in actions/setup/js

[Copilot]

Several fetch() calls in actions/setup/js were missing abort signals (allowing requests to hang indefinitely) and some in artifact_client.cjs were unguarded against TypeError on network failures.

Timeout signals added (require-fetch-timeout)

File	Timeout	Rationale
apply_samples.cjs	30s	GitHub API call
artifact_client.cjs (Twirp RPC)	30s	Internal API
artifact_client.cjs (list artifacts)	30s	GitHub API call
artifact_client.cjs (redirect fetch)	30s	GitHub API call
artifact_client.cjs (blob upload/download)	300s	Large file transfers
check_version_updates.cjs	10s	Config fetch
send_otlp_span.cjs	10s	OTLP export

try/catch wrapping added (require-fetch-try-catch)

Four await fetch(...) calls in artifact_client.cjs were not guarded against network-level TypeError (DNS failures, connection refused, etc.). Each is now wrapped with a descriptive error re-throw:

// before
const response = await fetch(signedUploadURL, { ... });

// after
let response;
try {
  response = await fetch(signedUploadURL, { ..., signal: AbortSignal.timeout(300_000) });
} catch (err) {
  throw new Error(`artifact blob upload failed: ${getErrorMessage(err)}`, { cause: err });
}

Affected call sites: uploadFileToSignedURL, listArtifacts (loop body), downloadArtifact (redirect + blob).

• Fixes [eslint-monster] actions/setup/js: harden fetch calls with timeouts and try/catch #49668

---

run: https://github.com/github/gh-aw/actions/runs/30743638240

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 5.29 AIC · ⊞ 8.2K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot centralize timeout constants, no magic numbers

[Copilot]

@copilot centralize timeout constants, no magic numbers

Done. Each file now declares a named constant — FETCH_TIMEOUT_MS (30 s for GitHub API calls, 10 s for config/OTLP calls) and FETCH_TRANSFER_TIMEOUT_MS (300 s for blob upload/download in artifact_client.cjs) — and all AbortSignal.timeout(...) calls reference those constants instead of inline literals.

[github-actions]

🔍 Triage Summary

Field	Value
Category	bug
Risk	low
Priority	medium
Score	35/100 (impact 20 + urgency 10 + quality 5)
Recommended action	batch_review
Batch	eslint-monster

Hardens fetch calls with timeouts/try-catch in actions/setup/js. Draft, no CI yet — part of eslint-monster cleanup wave.

Automated triage — see the triage report for full context.

Generated by 🔧 PR Triage Agent · auto · 40.3 AIC · ⌖ 4.01 AIC · ⊞ 8K · ◷

[pelikhan]

@copilot bump timeouts to at least 120 seconds

[Copilot]

🟢 Ready to approve

The scoped changes consistently address the reported network-hardening gaps while preserving existing control flow.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Hardens setup-action network requests against hangs and transport failures.

Changes:

• Adds explicit 10–300 second fetch timeouts.
• Wraps artifact network failures with contextual errors.
• Preserves existing retry and graceful-failure behavior.

File summaries

File	Description
actions/setup/js/apply_samples.cjs	Adds a timeout to PR metadata fetching.
actions/setup/js/artifact_client.cjs	Adds API/transfer timeouts and contextual fetch error handling.
actions/setup/js/check_version_updates.cjs	Adds a timeout to retried configuration fetching.
actions/setup/js/send_otlp_span.cjs	Adds a timeout to OTLP exports.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

@copilot bump timeouts to at least 120 seconds

Done. All FETCH_TIMEOUT_MS constants are now 120_000 (120 s) across apply_samples.cjs, check_version_updates.cjs, send_otlp_span.cjs, and artifact_client.cjs. FETCH_TRANSFER_TIMEOUT_MS remains at 300_000 (300 s) for blob transfers.

[gh-aw-bot]

@copilot quick triage for this PR:

• Recent maintainer follow-up to address on the current head:
  1. centralize timeout constants, no magic numbers
  2. bump timeouts to at least 120 seconds
• Branch refresh was requested for this run.
• Please run the pr-finisher skill before handoff and summarize any remaining maintainer action.

Run details: https://github.com/github/gh-aw/actions/runs/30743638240

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 5.29 AIC · ⊞ 8.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot quick triage for this PR:

• Recent maintainer follow-up to address on the current head:
  1. centralize timeout constants, no magic numbers...

Triage complete on current head 2f189b3:

• Maintainer follow-ups are already satisfied: timeout constants are centralized and standard fetch timeouts are 120_000+ (with 300_000 transfer timeout).
• Branch refresh is in place (main@05c9386 is included in this branch).
• CI run 30743638240 has no failed jobs.

Local validation pass:

• make fmt ✅
• make test-unit ✅ (full suite path ran)
• make test ✅
• make lint ❌ with a pre-existing unrelated lint failure at cmd/gh-aw/format_list_test.go:49 (copyloopvar).

Remaining maintainer action: re-trigger CI on the latest head (agent pushes do not trigger workflows) and proceed once required checks are green.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.3