From 4bd6dd77ef6a88716e46d62c9185e04a2d1930e9 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 29 Apr 2026 15:12:06 +0100
Subject: [PATCH] ci: bound release package tarball checks

---
 scripts/package-openclaw-for-docker.mjs       | 24 ++++++++++++++++-
 .../resolve-openclaw-package-candidate.mjs    | 26 ++++++++++++++++++-
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/scripts/package-openclaw-for-docker.mjs b/scripts/package-openclaw-for-docker.mjs
index eda29144940..bdb90b2bb44 100644
--- a/scripts/package-openclaw-for-docker.mjs
+++ b/scripts/package-openclaw-for-docker.mjs
@@ -39,16 +39,33 @@ function parseArgs(argv) {
   return options;
 }
 
-function run(command, args, cwd) {
+function run(command, args, cwd, options = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
     });
+    let timedOut = false;
+    const timeout =
+      options.timeoutMs === undefined
+        ? undefined
+        : setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref?.();
+          }, options.timeoutMs);
+    timeout?.unref?.();
     child.stdout.pipe(process.stderr, { end: false });
     child.stderr.pipe(process.stderr, { end: false });
     child.on("error", reject);
     child.on("close", (status, signal) => {
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      if (timedOut) {
+        reject(new Error(`${command} ${args.join(" ")} timed out after ${options.timeoutMs}ms`));
+        return;
+      }
       if (status === 0) {
         resolve();
         return;
@@ -150,10 +167,15 @@ async function main() {
   }
 
   console.error("==> Checking OpenClaw package tarball");
+  const checkStartedAt = Date.now();
   await run(
     "node",
     [path.join(ROOT_DIR, "scripts/check-openclaw-package-tarball.mjs"), tarball],
     sourceDir,
+    { timeoutMs: 5 * 60 * 1000 },
+  );
+  console.error(
+    `==> OpenClaw package tarball check finished in ${Math.round((Date.now() - checkStartedAt) / 1000)}s`,
   );
 
   process.stdout.write(`${tarball}\n`);
diff --git a/scripts/resolve-openclaw-package-candidate.mjs b/scripts/resolve-openclaw-package-candidate.mjs
index beecc19c617..e0440301999 100644
--- a/scripts/resolve-openclaw-package-candidate.mjs
+++ b/scripts/resolve-openclaw-package-candidate.mjs
@@ -93,6 +93,16 @@ function run(command, args, options = {}) {
       cwd: options.cwd ?? ROOT_DIR,
       stdio: options.capture ? ["ignore", "pipe", "pipe"] : ["ignore", "inherit", "inherit"],
     });
+    let timedOut = false;
+    const timeout =
+      options.timeoutMs === undefined
+        ? undefined
+        : setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref?.();
+          }, options.timeoutMs);
+    timeout?.unref?.();
     let stdout = "";
     let stderr = "";
     if (options.capture) {
@@ -105,6 +115,13 @@ function run(command, args, options = {}) {
     }
     child.on("error", reject);
     child.on("close", (status, signal) => {
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      if (timedOut) {
+        reject(new Error(`${command} ${args.join(" ")} timed out after ${options.timeoutMs}ms`));
+        return;
+      }
       if (status === 0) {
         resolve(stdout);
         return;
@@ -406,7 +423,14 @@ async function resolveCandidate(options) {
   }
 
   const digest = await assertExpectedSha256(target, options.packageSha256);
-  await run("node", ["scripts/check-openclaw-package-tarball.mjs", target]);
+  console.error(`Checking OpenClaw package tarball: ${target}`);
+  const checkStartedAt = Date.now();
+  await run("node", ["scripts/check-openclaw-package-tarball.mjs", target], {
+    timeoutMs: 5 * 60 * 1000,
+  });
+  console.error(
+    `OpenClaw package tarball check finished in ${Math.round((Date.now() - checkStartedAt) / 1000)}s`,
+  );
   const pkg = await readPackageJson(target);
   const metadata = {
     name: pkg.name,