From 2d24e82c613b7a46748bb30f067f56300acddc3e Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:36:46 -0300
Subject: [PATCH] fix(ci): allow test-masking to finish in release preflight

---
 ...se-v3850-validator-test-masking-timeout.md |  1 +
 scripts/quality/validate-release-green.mjs    | 19 +++++++++++++++++--
 tests/unit/validate-release-green.test.ts     | 12 ++++++++++++
 3 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/fixes/release-v3850-validator-test-masking-timeout.md

diff --git a/changelog.d/fixes/release-v3850-validator-test-masking-timeout.md b/changelog.d/fixes/release-v3850-validator-test-masking-timeout.md
new file mode 100644
index 0000000000..4b7c777092
--- /dev/null
+++ b/changelog.d/fixes/release-v3850-validator-test-masking-timeout.md
@@ -0,0 +1 @@
+- Let the release-green validator finish the test-masking gate on loaded runners while preserving the existing timeout for every other full-CI gate, and report Node.js `ETIMEDOUT` errors as explicit timeout failures.
diff --git a/scripts/quality/validate-release-green.mjs b/scripts/quality/validate-release-green.mjs
index 05690e1eac..aa1082fef5 100644
--- a/scripts/quality/validate-release-green.mjs
+++ b/scripts/quality/validate-release-green.mjs
@@ -221,6 +221,17 @@ export const FULL_CI_SKIP = new Set(["check:pr-evidence", "check:codeql-ratchet"
 // Gates that need a specific env to behave like CI (else they compare against the wrong base).
 export const FULL_CI_ENV = { "check:test-masking": { GITHUB_BASE_REF: "main" } };
 
+const FULL_CI_DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+const FULL_CI_TIMEOUT_OVERRIDES_MS = {
+  // Measured at 19m38s on the loaded release-v3.8.50 devbox. The former generic
+  // 10m ceiling killed a green scan before it could report its result.
+  "check:test-masking": 30 * 60 * 1000,
+};
+
+export function fullCiTimeoutFor(gateId) {
+  return FULL_CI_TIMEOUT_OVERRIDES_MS[gateId] ?? FULL_CI_DEFAULT_TIMEOUT_MS;
+}
+
 /**
  * Parse a ci.yml text and return the ordered, de-duplicated list of gate commands to run.
  * Each entry: { id, job, args:["run", <script>, ...("--" + args)], env }.
@@ -272,7 +283,8 @@ export function extractCiGates(
  * never an infinite block that the release captain mistakes for a hang and kills the pre-flight.
  */
 export function classifyRunError(err, timeoutMs) {
-  if (err && err.killed && timeoutMs) {
+  const timedOut = err?.killed === true || err?.code === "ETIMEDOUT";
+  if (timedOut && timeoutMs) {
     return {
       code: 124,
       out: `gate exceeded its ${Math.round(timeoutMs / 1000)}s ceiling and was killed — treat as a hung/failed gate (e.g. an unreleased DB handle in the unit suite); does NOT pass`,
@@ -696,7 +708,10 @@ async function main() {
     for (const g of gates) {
       // Skip a gate the curated pass already ran with the same id (avoid double-running lint).
       if (already.has(g.id)) continue;
-      const { code, out } = run(npmCmd, g.args, { env: g.env, timeout: 10 * 60 * 1000 });
+      const { code, out } = run(npmCmd, g.args, {
+        env: g.env,
+        timeout: fullCiTimeoutFor(g.id),
+      });
       saveGateLog(`fullci-${g.id.replace(/[^a-z0-9]+/gi, "-")}`, out);
       record({
         id: g.id,
diff --git a/tests/unit/validate-release-green.test.ts b/tests/unit/validate-release-green.test.ts
index 5b5b20a60a..ccdd473820 100644
--- a/tests/unit/validate-release-green.test.ts
+++ b/tests/unit/validate-release-green.test.ts
@@ -14,6 +14,7 @@ const {
   classifyRunError,
   extractCiGates,
   FULL_CI_SKIP,
+  fullCiTimeoutFor,
 } = mod;
 
 const extract = extractCiGates as (
@@ -146,6 +147,17 @@ test("classifyRunError: a killed gate under a timeout surfaces as a visible non-
   assert.match(r.out, /hung\/failed gate/);
 });
 
+test("classifyRunError: Node's ETIMEDOUT shape is reported as a timeout", () => {
+  const r = classifyRunError({ code: "ETIMEDOUT", signal: "SIGTERM" }, 10 * 60 * 1000);
+  assert.equal(r.code, 124);
+  assert.match(r.out, /600s ceiling/);
+});
+
+test("fullCiTimeoutFor gives test-masking enough time without weakening other gates", () => {
+  assert.equal(fullCiTimeoutFor("check:test-masking"), 30 * 60 * 1000);
+  assert.equal(fullCiTimeoutFor("check:file-size"), 10 * 60 * 1000);
+});
+
 test("classifyRunError: a normal non-zero exit keeps its status + combined output", () => {
   const r = classifyRunError({ status: 1, stdout: "boom-out", stderr: "boom-err" }, undefined);
   assert.equal(r.code, 1);