feat: add git timeout (#14914)

docs/usage/self-hosted-configuration.md

@@ -363,6 +363,12 @@ Before the first commit in a repository, Renovate will:
 The `git` commands are run locally in the cloned repo instead of globally.
 This reduces the chance of unintended consequences with global Git configs on shared systems.
 
+## gitTimeout
+
+To handle the case where the underlying Git processes appear to hang, configure the timeout with the number of milliseconds to wait after last received content on either `stdOut` or `stdErr` streams before sending a `SIGINT` kill message.
+
+The value must be between `2000` and `6000` (milliseconds) inclusive.
+
 ## gitUrl
 
 Override the default resolution for Git remote, e.g. to switch GitLab from HTTPS to SSH-based.

lib/config/global.ts

@@ -22,6 +22,7 @@ export class GlobalConfig {
     'migratePresets',
     'privateKey',
     'privateKeyOld',
+    'gitTimeout',
   ];
 
   private static config: RepoGlobalConfig = {};

lib/config/options/index.ts

@@ -730,6 +730,14 @@ const options: RenovateOptions[] = [
     subType: 'string',
     stage: 'repository',
   },
+  {
+    name: 'gitTimeout',
+    description:
+      'Configure the timeout with a number of milliseconds to wait for a git task',
+    type: 'integer',
+    globalOnly: true,
+    default: 10000,
+  },
   {
     name: 'enabledManagers',
     description:

lib/config/types.ts

@@ -107,6 +107,7 @@ export interface RepoGlobalConfig {
   dockerUser?: string;
   dryRun?: DryRunConfig;
   executionTimeout?: number;
+  gitTimeout?: number;
   exposeAllEnv?: boolean;
   githubTokenWarn?: boolean;
   migratePresets?: Record<string, string>;

lib/config/validation.spec.ts

@@ -739,5 +739,18 @@ describe('config/validation', () => {
         },
       ]);
     });
+
+    it.each([
+      [
+        'invalid value',
+        {
+          gitTimeout: 'string',
+        },
+      ],
+      ['out of range', { gitTimeout: 1000 }],
+    ])('checks invalid git timeout values', async (_case, config) => {
+      const { errors } = await configValidation.validateConfig(config);
+      expect(errors).toHaveLength(1);
+    });
   });
 });

lib/config/validation.ts

@@ -128,6 +128,19 @@ export async function validateConfig(
       });
       continue;
     }
+    if (key === 'gitTimeout') {
+      if (!is.number(val)) {
+        errors.push({
+          topic: 'Config Error',
+          message: `GitTimeout must be set to an integer value`,
+        });
+      } else if (!(val >= 2000 && val <= 60000)) {
+        errors.push({
+          topic: 'Config Error',
+          message: `GitTimeout value must be within 2 to 60 seconds`,
+        });
+      }
+    }
     if (parentPath && topLevelObjects.includes(key)) {
       errors.push({
         topic: 'Configuration Error',

lib/modules/manager/git-submodules/extract.ts

@@ -36,7 +36,11 @@ async function getUrl(
 const headRefRe = regEx(/ref: refs\/heads\/(?<branch>\w+)\s/);
 
 async function getDefaultBranch(subModuleUrl: string): Promise<string> {
-  const val = await Git().listRemote(['--symref', subModuleUrl, 'HEAD']);
+  const val = await Git(simpleGitConfig()).listRemote([
+    '--symref',
+    subModuleUrl,
+    'HEAD',
+  ]);
   return headRefRe.exec(val)?.groups?.branch ?? 'master';
 }
 
@@ -46,7 +50,7 @@ async function getBranch(
   subModuleUrl: string
 ): Promise<string> {
   return (
-    (await Git().raw([
+    (await Git(simpleGitConfig()).raw([
       'config',
       '--file',
       gitModulesPath,
@@ -91,7 +95,7 @@ export default async function extractPackageFile(
   config: ExtractConfig
 ): Promise<PackageFile | null> {
   const { localDir } = GlobalConfig.get();
-  const git = Git(localDir);
+  const git = Git(localDir, simpleGitConfig());
   const gitModulesPath = upath.join(localDir, fileName);
 
   const depNames = await getModules(git, gitModulesPath);

lib/util/git/config.spec.ts

@@ -1,9 +1,27 @@
+import { GlobalConfig } from '../../config/global';
 import { simpleGitConfig } from './config';
 
 describe('util/git/config', () => {
+  beforeEach(() => {
+    GlobalConfig.reset();
+  });
+
   it('uses "close" events, ignores "exit" events from child processes', () => {
     expect(simpleGitConfig()).toEqual({
       completion: { onClose: true, onExit: false },
+      timeout: {
+        block: 10000,
+      },
+    });
+  });
+
+  it('uses timeout value from GlobalConfig', () => {
+    GlobalConfig.set({ gitTimeout: 50000 });
+    expect(simpleGitConfig()).toEqual({
+      completion: { onClose: true, onExit: false },
+      timeout: {
+        block: 50000,
+      },
     });
   });
 });

lib/util/git/config.ts

@@ -1,5 +1,6 @@
 import is from '@sindresorhus/is';
 import type { SimpleGitOptions } from 'simple-git';
+import { GlobalConfig } from '../../config/global';
 import type { GitNoVerifyOption } from './types';
 
 let noVerify: GitNoVerifyOption[] = ['push', 'commit'];
@@ -22,5 +23,8 @@ export function simpleGitConfig(): Partial<SimpleGitOptions> {
       onClose: true,
       onExit: false,
     },
+    timeout: {
+      block: GlobalConfig.get('gitTimeout') ?? 10000,
+    },
   };
 }