fix: Add timeouts to outgoing requests

[billyvg]

No outgoing request had a timeout. gunicorn runs with 1 worker, 4 threads and --timeout 0 (see the Dockerfile), so a single hung connection to GitHub or Sentry could tie up a quarter of the app's capacity indefinitely.

Request latency over the last 7 days, from this app's spans:

Call	Count	p99	Max
GET config (.sentry/sentry_config.ini)	2.85M	165 ms	235 s
GET workflow run	1.08M	390 ms	127 s
POST installation access token	2.85M	229 ms	198 s
DELETE installation token	2.85M	308 ms	205 s
POST Sentry envelope	1.06M	70 ms	5.4 s

Changes

• REQUEST_TIMEOUT = (5, 10), i.e. 5 s to connect and 10 s between bytes read, in src/__init__.py. It's passed to all five requests calls in src/.
  • That's over 25× the slowest p99, so normal traffic isn't affected.
  • The multi-minute stalls now fail fast with requests.exceptions.Timeout. That's handled like any other request error: logged, and the webhook gets a 500.
  • GitHub stops waiting for a webhook response after 10 s anyway.
• cli.py is unchanged. It's a local development tool and isn't in the Docker image.
• Only send the installation token to GitHub's API. _fetch_github rejects any URL that isn't under https://api.github.com/, and builds the request on that base.
• Check the org login against GitHub's rules (alphanumerics and hyphens, up to 39 characters) before building the config URL.

#117 has since merged, and main is merged into this branch. The timeout and the login check are in _fetch_dsn, behind #117's DSN cache.

Testing

• New test test_every_request_has_a_timeout drives a full webhook through WebAppHandler in GitHub App mode: mint token, fetch config, fetch run, post envelope, revoke token. It asserts that each request was sent with REQUEST_TIMEOUT.
• _fetch_github refuses another host, http, a lookalike host, a URL with userinfo, and github.com, without making a request.
• A 39-character login is accepted. A 40-character one, a leading hyphen, a path, an empty login, or one ending in a newline is rejected without a request.
• Mutation check: removing the timeout from any one of the five call sites makes the test fail and name that URL. Putting back the 38-character limit, checking the login with match instead of fullmatch, or dropping the api.github.com check makes its test fail too.
• pytest on the merged tree: 35 passed, 1 skipped (already skipped before this change).
• pre-commit run passes on all changed files.

CodeQL

The two py/full-ssrf alerts are fixed by this PR. They're on the GETs whose URLs come from the webhook payload: the config fetch, and _fetch_github.

• The config fetch only runs for a valid GitHub login, which can't change the URL's host or path.
• _fetch_github builds the request on https://api.github.com, so the token can't be sent to another host.

Running CodeQL 2.27.2's default Python suite locally, it reports py/full-ssrf at src/github_sdk.py:60 before this change and nothing after it. Both alerts already exist on main, so merging this should also close #1 there.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 446b3a2. Configure here.}

[sentry]

Bug: The regex validation for the org parameter uses $ which incorrectly matches strings with a trailing newline, potentially causing downstream API requests to fail.
_{Severity: LOW}

Suggested Fix

Replace the $ anchor in the regex pattern with \Z. The \Z anchor ensures that the match must occur at the absolute end of the string, correctly rejecting any input with trailing newlines.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry_config.py#L22

Potential issue: The regex validation for the GitHub organization name uses a `$`
anchor, which allows `re.fullmatch()` to successfully match strings that have a trailing
newline, such as `"myorg\n"`. If the `org` parameter from a webhook payload contained
such a newline, it would pass validation. The subsequent call to `quote(org, safe="")`
would URL-encode the newline to `%0A`, creating an invalid GitHub API URL. This would
cause the API request to fail, likely with a 404 or 422 error, leading to an unhandled
`HTTPError` and a 500 response from the service. While it is unlikely that a GitHub
webhook would contain a trailing newline, the validation logic is incorrect.