improve github_token flow

utils/api.ts

@@ -13,7 +13,7 @@ export interface RepoSettings {
   }>;
 }
 
-const DEFAULT_REPO_SETTINGS: RepoSettings = {
+export const DEFAULT_REPO_SETTINGS: RepoSettings = {
   defaultAgent: null,
   webAccessLevel: "full_access",
   webAccessAllowTrusted: false,
@@ -32,6 +32,11 @@ export async function getRepoSettings(
 ): Promise<RepoSettings> {
   const apiUrl = process.env.API_URL || "https://pullfrog.ai";
 
+  // Add timeout to prevent hanging (5 seconds)
+  const timeoutMs = 5000;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+
   try {
     const response = await fetch(
       `${apiUrl}/api/repo/${repoContext.owner}/${repoContext.name}/settings`,
@@ -41,9 +46,12 @@ export async function getRepoSettings(
           Authorization: `Bearer ${token}`,
           "Content-Type": "application/json",
         },
+        signal: controller.signal,
       }
     );
 
+    clearTimeout(timeoutId);
+
     if (!response.ok) {
       // If API returns 404 or other error, fall back to defaults
       return DEFAULT_REPO_SETTINGS;
@@ -58,7 +66,8 @@ export async function getRepoSettings(
 
     return settings;
   } catch {
-    // If fetch fails (network error, etc.), fall back to defaults
+    clearTimeout(timeoutId);
+    // If fetch fails (network error, timeout, etc.), fall back to defaults
     return DEFAULT_REPO_SETTINGS;
   }
 }

utils/github.ts

@@ -294,18 +294,19 @@ function getDefaultGitHubToken(): string | null {
 
 /**
  * Setup GitHub installation token for the action
- * Returns the token and whether it was acquired (needs revocation)
+ * Returns the token, whether it was acquired (needs revocation), and whether we fell back to GITHUB_TOKEN
  * Falls back to GITHUB_TOKEN if app is not installed
  */
 export async function setupGitHubInstallationToken(): Promise<{
   githubInstallationToken: string;
   wasAcquired: boolean;
+  isFallbackToken: boolean;
 }> {
   const existingToken = checkExistingToken();
   if (existingToken) {
     core.setSecret(existingToken);
     log.info("Using provided GitHub installation token");
-    return { githubInstallationToken: existingToken, wasAcquired: false };
+    return { githubInstallationToken: existingToken, wasAcquired: false, isFallbackToken: false };
   }
 
   const acquiredToken = await acquireNewToken();
@@ -322,13 +323,13 @@ export async function setupGitHubInstallationToken(): Promise<{
     log.info("Using GITHUB_TOKEN (app not installed or token exchange failed)");
     core.setSecret(defaultToken);
     process.env.GITHUB_INSTALLATION_TOKEN = defaultToken;
-    return { githubInstallationToken: defaultToken, wasAcquired: false };
+    return { githubInstallationToken: defaultToken, wasAcquired: false, isFallbackToken: true };
   }
 
   core.setSecret(acquiredToken);
   process.env.GITHUB_INSTALLATION_TOKEN = acquiredToken;
 
-  return { githubInstallationToken: acquiredToken, wasAcquired: true };
+  return { githubInstallationToken: acquiredToken, wasAcquired: true, isFallbackToken: false };
 }
 
 /**