fix: bound branch lookup with timeouts and explicit curl exit check

Transient network issues could stall the release workflow indefinitely,
and a curl failure was only distinguishable from an HTTP response via the
status output. Add connect/overall timeouts with a small retry policy,
check curl's exit code explicitly, and cap the job with timeout-minutes.

Signed-off-by: Attila Mészáros <a_meszaros@apple.com>

Author: csviri

.github/workflows/release.yml

@@ -12,6 +12,7 @@ jobs:
 
   prepare-release:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     env:
       tmp_version_branch: ''
     outputs:
@@ -48,14 +49,22 @@ jobs:
           # the 999-SNAPSHOT sentinel version.
           echo "Release tag major.minor: $RELEASE_MAJOR_MINOR"
 
-          # Only 404 means "no such branch". Any other status is a lookup failure
+          # Only 404 means "no such branch". Any other outcome is a lookup failure
           # and must abort: silently falling back to main would release the wrong
-          # stream.
+          # stream. Timeouts are bounded so a network stall fails fast.
+          CURL_EXIT=0
           HTTP_STATUS=$(curl -sS -o /dev/null -w '%{http_code}' \
+            --connect-timeout 10 --max-time 30 \
+            --retry 3 --retry-delay 2 --retry-all-errors \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            "${{ github.api_url }}/repos/${{ github.repository }}/branches/${MAINTENANCE_BRANCH}")
+            "${{ github.api_url }}/repos/${{ github.repository }}/branches/${MAINTENANCE_BRANCH}") || CURL_EXIT=$?
+
+          if [ "$CURL_EXIT" -ne 0 ]; then
+            echo "Branch lookup for ${MAINTENANCE_BRANCH} failed (curl exit ${CURL_EXIT})"
+            exit 1
+          fi
 
           case "$HTTP_STATUS" in
             200)