fix: address upstream monitor review

Author: intel352

docs/plans/2026-07-02-upstream-release-monitor.md

@@ -1,6 +1,5 @@
 # GitHub Upstream Release Monitor Plan
 
-**Status:** Locked 2026-07-02T21:56:54Z
 **Date:** 2026-07-02
 **Design:** docs/plans/2026-07-02-upstream-release-monitor-design.md
 
@@ -21,7 +20,7 @@
 |------|-------|-------|--------|
 | 1 | Add upstream release monitor step | Task 1, Task 2, Task 3, Task 4 | feat/upstream-release-monitor |
 
-**Status:** Draft
+**Status:** Locked 2026-07-02T21:56:54Z
 
 ### Task 1: Record Boundary
 

docs/plans/2026-07-02-upstream-release-monitor.md.scope-lock

@@ -1 +1 @@
-de155f0cc3a5e9387586eb759425075e12bb50bf06c18614ee5d5aa7b05e8f67
+e1ce0cd7375029d9cd689119fbce94210e632829de2c024a1876b19012a2875f

internal/step_upstream_release_monitor.go

@@ -109,7 +109,10 @@ func (githubUpstreamReleaseClient) LatestRelease(ctx context.Context, owner, rep
 		client = client.WithAuthToken(token)
 	}
 
-	release, _, err := client.Repositories.GetLatestRelease(ctx, owner, repo)
+	requestCtx, cancel := githubReleaseLookupContext(ctx)
+	defer cancel()
+
+	release, _, err := client.Repositories.GetLatestRelease(requestCtx, owner, repo)
 	if err != nil {
 		return upstreamReleaseInfo{}, err
 	}
@@ -128,3 +131,10 @@ func (githubUpstreamReleaseClient) LatestRelease(ctx context.Context, owner, rep
 		PublishedAt: publishedAt,
 	}, nil
 }
+
+func githubReleaseLookupContext(ctx context.Context) (context.Context, context.CancelFunc) {
+	if _, ok := ctx.Deadline(); ok {
+		return ctx, func() {}
+	}
+	return context.WithTimeout(ctx, 30*time.Second)
+}

internal/step_upstream_release_monitor_test.go

@@ -193,3 +193,34 @@ func TestGitHubPluginCreateStep_UpstreamReleaseMonitor(t *testing.T) {
 		t.Fatalf("CreateStep returned %T, want *upstreamReleaseMonitorStep", step)
 	}
 }
+
+func TestGitHubReleaseLookupContextAddsDefaultTimeout(t *testing.T) {
+	ctx, cancel := githubReleaseLookupContext(context.Background())
+	defer cancel()
+
+	deadline, ok := ctx.Deadline()
+	if !ok {
+		t.Fatal("expected deadline")
+	}
+	remaining := time.Until(deadline)
+	if remaining <= 0 || remaining > 30*time.Second {
+		t.Fatalf("deadline remaining = %s, want within 30s", remaining)
+	}
+}
+
+func TestGitHubReleaseLookupContextPreservesCallerDeadline(t *testing.T) {
+	callerDeadline := time.Now().Add(5 * time.Second)
+	parent, parentCancel := context.WithDeadline(context.Background(), callerDeadline)
+	defer parentCancel()
+
+	ctx, cancel := githubReleaseLookupContext(parent)
+	defer cancel()
+
+	deadline, ok := ctx.Deadline()
+	if !ok {
+		t.Fatal("expected deadline")
+	}
+	if !deadline.Equal(callerDeadline) {
+		t.Fatalf("deadline = %s, want caller deadline %s", deadline, callerDeadline)
+	}
+}