[Bug]: pr-size-label fails when the runner proxy drops the GitHub API TLS connection

[gouhongshen]

Is there an existing issue for the same bug?

• I searched open and closed matrixorigin/matrixone issues for pr-size-label, the exact TLS error, the GitHub API endpoint, and the self-hosted runner proxy; no matching issue was found. [Subtask]: add pr-size-labeler #4117 is the closed implementation subtask, not this runtime failure.

Branch Name

agent/issue-27042-95f434d9 (PR #27070 against main)

Commit ID

• PR head: 1b76b5b
• PR base: bdbd613

Other Environment Information

• Workflow: MatrixOne ALL CI
• Event: pull_request_target
• Run: https://github.com/matrixorigin/matrixone/actions/runs/31703445493
• Failed job: https://github.com/matrixorigin/matrixone/actions/runs/31703445493/job/94458009359
• Run attempt: 1
• Runner: arm64-mo-shanghai-4c8g-jj2z7-runner-4mlsk
• Proxy: http://proxy-service.proxy.svc.cluster.local:8001
• Shared action: matrixorigin/CI/actions/label-size-action@main, workflow revision 2f8b38b47335613a44dd8043d2c305fcec5adc72

Actual Behavior

The pr-size-label job failed before it could read or classify PR #27070. Runner setup first failed to resolve the shared action download metadata, retried, and eventually loaded the action. The action then attempted to fetch the PR from GitHub's API and its TLS connection was dropped before establishment:

Failed to resolve action download info. Error: An error occurred while sending the request.
Retrying in 21.357 seconds
...
The PR number of this job is: 27070
request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27070 failed, reason: Client network socket disconnected before secure TLS connection was established

The job ended immediately after that network exception. No diff-size calculation or label mutation ran.

Expected Behavior

A transient proxy/GitHub API connection failure should be retried with bounded backoff, or the runner/proxy path should reliably establish TLS. The PR size check should not fail permanently before evaluating the PR.

Steps to Reproduce

1. Trigger MatrixOne ALL CI through a pull_request_target event on a MatrixOne PR.
2. Schedule Matrixone Utils CI / pr-size-label on the Shanghai self-hosted ARM64 runner behind proxy-service.proxy.svc.cluster.local:8001.
3. During action setup or the action's GET /repos/matrixorigin/matrixone/pulls/ call, reproduce a transient proxy/TLS disconnect.
4. Observe the action terminate without retrying the PR API request and the job conclude failure.

Additional information

This failure is unrelated to PR #27070:

• the action never obtained the PR response and therefore never inspected the changed files or line count;
• the previous workflow for the same head completed pr-size-label successfully;
• the PR changes temporary-table clone handling and tests, not the shared label action, workflow, runner, proxy, or network stack;
• the same failed job log records an earlier action-download network error, independently corroborating runner/proxy instability.

The root-cause fix belongs in the runner/proxy reliability path or the shared label action's bounded retry behavior. This PR should not be changed to mask the infrastructure failure.

[gouhongshen]

Automated AI triage

This issue requires human involvement and cannot currently be completed independently by the
automated fix loop.

Reason

Human CI/infra intervention is required: the failure occurs in an external shared action and self-hosted runner proxy before MatrixOne logic runs. A CI owner should fix or add retry handling in matrixorigin/CI/actions/label-size-action or the runner/proxy, then rerun the workflow.

Evidence

The report names matrixorigin/CI/actions/label-size-action@main, a self-hosted proxy, and a GitHub API TLS disconnect; no diff-size calculation or label mutation executed.

Please use this analysis to provide the missing decision, environment, evidence, or ownership
needed before the issue is returned to the AI candidate pool.

[iamlinjunhong]

Additional occurrence (2026-08-21):

• Source PR: fix(mongodb): support prepared external scans #27437 at head 194cc7cbcfbaeeee40af573a8432371ced322c9b
• Failed check: Matrixone Utils CI / pr-size-label
• Workflow run/job: https://github.com/matrixorigin/matrixone/actions/runs/32456045388/job/96693499831 (attempt 1)
• Runner: arm64-mo-shanghai-4c8g-jj2z7-runner-vtdnk, behind http://proxy-service.proxy.svc.cluster.local:8001
• Shared action: matrixorigin/CI/actions/label-size-action@main

The job reached the shared size-label action but failed before receiving any PR data:

request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27437 failed, reason: Client network socket disconnected before secure TLS connection was established

This is direct runner/proxy network evidence: no size calculation or label mutation executed, and the PR code was not inspected. The reported PR modifies MongoDB prepared external-scan planning and tests, not the shared action, runner, proxy, or GitHub API transport. The failed run will be rerun once for the failed jobs.

[iamlinjunhong]

Additional evidence from PR #27437 (head 194cc7cbcfbaeeee40af573a8432371ced322c9b):

• Failed check: Matrixone Utils CI / pr-size-label
• Run/job/attempt: https://github.com/matrixorigin/matrixone/actions/runs/32456045388/job/96693499831 (run 32456045388, job 96693499831, attempt 1)
• Runner: arm64-mo-shanghai-4c8g-jj2z7-runner-vtdnk, behind http://proxy-service.proxy.svc.cluster.local:8001
• Failed step: size-label

The complete job log shows the shared label action failed before it could obtain the PR for classification:

request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27437 failed, reason: Client network socket disconnected before secure TLS connection was established

This is direct runner/proxy network evidence. The action did not calculate the diff size or mutate labels, so the failure is independent of the PR code changes. A failed-jobs rerun will be requested once this still-running workflow is eligible.

[iamlinjunhong]

Additional occurrence on PR #27437 (head 194cc7c).

• Failed check: Matrixone Utils CI / pr-size-label
• Run attempt 1: https://github.com/matrixorigin/matrixone/actions/runs/32456045388
• Failed job: https://github.com/matrixorigin/matrixone/actions/runs/32456045388/job/96693499831
• Runner: arm64-mo-shanghai-4c8g-jj2z7-runner-vtdnk, behind http://proxy-service.proxy.svc.cluster.local:8001
• Failed step: size-label in matrixorigin/CI/actions/label-size-action@main

The job reached the action and printed PR 27437, then failed before receiving the PR API response:

request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27437 failed, reason: Client network socket disconnected before secure TLS connection was established

This is direct runner/proxy TLS evidence: the action could not inspect the PR diff or mutate a label, so the failure is independent of this PR's code. The workflow's build, SCA, and UT-coverage lanes for the same head succeeded.

[iamlinjunhong]

Additional occurrence:

• PR: fix: support MySQL named window clauses #27515
• Exact head: 586f2bdfaeb18cbbfae3fe59beaf4eadc836c737
• Check: Matrixone Utils CI / pr-size-label
• Run: https://github.com/matrixorigin/matrixone/actions/runs/32803252694 (attempt 1)
• Job: https://github.com/matrixorigin/matrixone/actions/runs/32803252694/job/97668254600

The job failed in size-label before it could evaluate PR content. Its log recorded the Shanghai self-hosted ARM64 runner behind proxy-service.proxy.svc.cluster.local:8001, then:

request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27515 failed, reason: Client network socket disconnected before secure TLS connection was established

No size calculation or label action completed, so this is direct runner/proxy-to-GitHub API TLS evidence rather than a PR-content failure. The workflow remains in progress; when it reaches a terminal state, the failed jobs of this run should be rerun once.

[iamlinjunhong]

Additional occurrence on PR #27515 (head 586f2bdfaeb18cbbfae3fe59beaf4eadc836c737): Matrixone Utils CI / pr-size-label failed in MatrixOne ALL CI run 32803252694, job 97668254600, attempt 1.\n\nRun: https://github.com/matrixorigin/matrixone/actions/runs/32803252694\nJob: https://github.com/matrixorigin/matrixone/actions/runs/32803252694/job/97668254600\n\nThe failed size-label step loaded matrixorigin/CI/actions/label-size-action@main and then terminated before it could evaluate the PR:\n\ntext\nrequest to https://api.github.com/repos/matrixorigin/matrixone/pulls/27515 failed, reason: Client network socket disconnected before secure TLS connection was established\n\n\nThe log identifies the self-hosted Shanghai ARM64 runner arm64-mo-shanghai-4c8g-jj2z7-runner-jdhct behind http://proxy-service.proxy.svc.cluster.local:8001. This is direct runner/network evidence, independent of the PR diff. The workflow is still running; after it reaches a terminal state, the failed jobs will be rerun once.

[gouhongshen]

Additional occurrence on PR #27583 (head a33f1c2d9e586195188265fb19a9c02166023f46):

• Failed check: Matrixone Utils CI / pr-size-label
• Run: https://github.com/matrixorigin/matrixone/actions/runs/32965482631 (attempt 1)
• Job: https://github.com/matrixorigin/matrixone/actions/runs/32965482631/job/98167136104
• Failed step: size-label
• Runner: arm64-mo-shanghai-4c8g-jj2z7-runner-mj2c2, behind http://proxy-service.proxy.svc.cluster.local:8001

The shared matrixorigin/CI/actions/label-size-action@main reached PR #27583, then failed before receiving the GitHub API response:

request to https://api.github.com/repos/matrixorigin/matrixone/pulls/27583 failed, reason: Client network socket disconnected before secure TLS connection was established

No size calculation or label mutation ran, so this is runner/proxy-to-GitHub API transport failure and is independent of PR #27583's taskservice cron-registration diff. The failed jobs will be rerun once after this workflow reaches a terminal state.