Skip to content

Make claudecode-timeout actually bound the analysis - #138

Closed
CedricConday wants to merge 1 commit into
anthropics:mainfrom
CedricConday:fix/claudecode-timeout-not-enforced
Closed

CedricConday wants to merge 1 commit into
anthropics:mainfrom
CedricConday:fix/claudecode-timeout-not-enforced

Conversation

@CedricConday

Copy link
Copy Markdown

Two separate problems keep claudecode-timeout from bounding anything.

The action documents the input in minutes and exports it as CLAUDE_TIMEOUT, but nothing ever read that variable: the runner was constructed as SimpleClaudeRunner() with no argument, so it always used the built-in 20 minute SUBPROCESS_TIMEOUT. Setting the input to 10 changed nothing.

The timeout was also applied per subprocess attempt while the audit retries up to three times, so even the default could run for an hour of wall clock. That is how the stalled scan in #124 ran for about 27 minutes against a 20 minute default and a 10 minute input.

This reads CLAUDE_TIMEOUT when building the runner, ignoring values that are not positive integers, and treats the timeout as a budget for the whole audit by passing each attempt only the time remaining.

Two regression tests cover it; both fail on main. The full suite is 182 passing.

Closes #124

The action documents a `claudecode-timeout` input in minutes and exports it
as CLAUDE_TIMEOUT, but nothing ever read that variable: the runner was
constructed as SimpleClaudeRunner() with no argument, so it always used the
built-in 20 minute SUBPROCESS_TIMEOUT. Setting the input to 10 changed
nothing.

The timeout was also applied per subprocess attempt while the audit retries
up to three times, so even the default could run for an hour of wall clock.
That is how a stalled scan reported in anthropicsgh-124 ran for about 27 minutes
against a 20 minute default and a 10 minute input.

Read CLAUDE_TIMEOUT when building the runner, ignoring values that are not
positive integers, and treat the timeout as a budget for the whole audit by
passing each attempt only the time remaining.

Closes anthropics#124
@CedricConday
CedricConday deleted the fix/claudecode-timeout-not-enforced branch September 13, 2026 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

claudecode-timeout input is not enforced — action runs past the configured limit on a stalled scan

1 participant