[11/48] CONFIG: Wrap wizcli auth and wizcli scan with command-level timeout in all four WizCLI cmd blocks

[anota-fernandocosta]

Severity: High in Docker mode (compensating control for Critical #3 root cause tracked in #26)

Evidence

• All scoped variants declare timeOutInSeconds: 600: api/config.yaml:717 (wizcli_iac), api/config.yaml:791 (wizcli_sast), api/config.yaml:828 (wizcli_vulns); wizcli_secrets at api/config.yaml:573 is on the same profile.
• Docker WaitContainer(timeOutInSeconds int) ignores the parameter and waits on ContainerWait(context.Background(), ...) at api/dockers/api.go:100. The K8s path does enforce TimeoutSeconds at api/kubernetes/api.go:198.
• analyzeWizCLI recognizes ERROR_AUTH_WIZCLI and ERROR_RUNNING_WIZCLI_SCAN at api/securitytest/wizcli.go:128.

Impact

In Docker mode, a Wiz auth or cloud-scan hang can hold the scanner goroutine indefinitely and delay final analysis persistence. Until #26 (root fix) lands, there is no upper bound at all.

Recommendation

Wrap each wizcli auth … and wizcli scan dir ./code … invocation with the timeout shell builtin and a per-stage budget (suggested split of the 600 s envelope: ~120 s auth, ~420 s scan, leaving slack for clone + output handling). On timeout, emit the existing ERROR_AUTH_WIZCLI / ERROR_RUNNING_WIZCLI_SCAN sentinels so analyzeWizCLI already routes the failure correctly — no Go-side changes required.

Dependencies

• Mitigates (does not fix) [01/48] Docker WaitContainer timeOutInSeconds parameter is dead (no timeout enforcement) #26 in Docker mode; remove or relax once [01/48] Docker WaitContainer timeOutInSeconds parameter is dead (no timeout enforcement) #26 lands.
• Touches all four WizCLI cmd blocks — keep aligned with [34/48] Sparse-checkout shell logic duplicated across every scanner cmd block in config.yaml #44 (sparse-checkout duplication).

Cross-references

• Assessment: docs/assessments/wizcli-performance-assessment-01.md — Confirmed finding Wiz - 'main' Branch Scan Overview #3, Probable chore: replace CI/CD with OSS-ready pipeline #7 (outage behavior).
• Existing: [01/48] Docker WaitContainer timeOutInSeconds parameter is dead (no timeout enforcement) #26 (Docker WaitContainer timeout dead), [34/48] Sparse-checkout shell logic duplicated across every scanner cmd block in config.yaml #44 (block-duplication risk).

Verifiable by: Static analysis; bash -n on rewritten blocks; injection test that drops Wiz egress (also enables Issue Wiz-06/11).