fix: drop stalled HTTP/2 connections in action clones (#1266)

go-git sends all concurrent action clones from a host over one HTTP/2 connection, and Go sends no health-check pings by default. When that connection stalls, every clone on it hangs until the job timeout and cancellation can't free them, as in https://gitea.com/gitea/runner/actions/runs/1003885/jobs/1361593.

Ping idle connections so a stalled one is dropped after about 45s.

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1266
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/common/git/git.go

@@ -9,11 +9,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	nethttp "net/http"
 	"os"
 	"path"
 	"regexp"
 	"strings"
 	"sync"
+	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/internal/pkg/lock"
@@ -22,6 +24,8 @@ import (
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/storer"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/client"
 	"github.com/go-git/go-git/v5/plumbing/transport/http"
 	"github.com/mattn/go-isatty"
 	log "github.com/sirupsen/logrus"
@@ -38,6 +42,20 @@ var (
 	ErrShortRef = errors.New("short SHA references are not supported")
 )
 
+func init() {
+	httpClient := newHTTPClient(&nethttp.HTTP2Config{SendPingTimeout: 30 * time.Second})
+	client.InstallProtocol("http", httpClient)
+	client.InstallProtocol("https", httpClient)
+}
+
+// newHTTPClient pings idle HTTP/2 connections to drop stalled ones.
+func newHTTPClient(h2 *nethttp.HTTP2Config) transport.Transport {
+	defaultTransport, _ := nethttp.DefaultTransport.(*nethttp.Transport)
+	httpTransport := defaultTransport.Clone()
+	httpTransport.HTTP2 = h2
+	return http.NewClient(&nethttp.Client{Transport: httpTransport})
+}
+
 // AcquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
 // Only concurrent operations targeting the same directory are serialized; clones into different directories run in parallel.
 // Callers reading files inside dir (e.g. tarring a checked-out action into a job container) must hold this lock too,