From e9b974e18bd23b6d3be4e2d71b8980ceb0769b15 Mon Sep 17 00:00:00 2001
From: tzy-17 <tang.ziyi@xydigit.com>
Date: Fri, 17 Jul 2026 02:38:19 +0800
Subject: [PATCH] fix(ci): bound release evidence dispatch (#108898)

---
 .github/workflows/full-release-validation.yml | 2 ++
 test/scripts/release-no-push-workflow.test.ts | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/full-release-validation.yml b/.github/workflows/full-release-validation.yml
index eea727fdc0d2..945186d9684c 100644
--- a/.github/workflows/full-release-validation.yml
+++ b/.github/workflows/full-release-validation.yml
@@ -1906,6 +1906,8 @@ jobs:
           )"
 
           if ! curl --fail-with-body \
+            --connect-timeout 10 \
+            --max-time 30 \
             -X POST \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${RELEASES_DISPATCH_TOKEN}" \
diff --git a/test/scripts/release-no-push-workflow.test.ts b/test/scripts/release-no-push-workflow.test.ts
index b58098e2814b..87ef4bd06a15 100644
--- a/test/scripts/release-no-push-workflow.test.ts
+++ b/test/scripts/release-no-push-workflow.test.ts
@@ -337,6 +337,9 @@ describe("release validation no-push transport", () => {
     expect(verify.run).toContain('"openclaw-release-checks.yml"');
     expect(dispatch.run).not.toContain('GITHUB_RUN_ID_VALUE="$EVIDENCE_ROOT_RUN_ID"');
     expect(dispatch.run).toContain("reused green product evidence from chain-root run");
+    expect(dispatch.run).toContain("--connect-timeout 10");
+    expect(dispatch.run).toContain("--max-time 30");
+    expect(dispatch.run).toContain("https://api.github.com/repos/openclaw/releases/dispatches");
   });
 
   it("publishes an attempt-qualified canonical manifest plus a temporary legacy alias", () => {