feat: add context support to getGitCommitTimestamp

Add context parameter to getGitCommitTimestamp() to support cancellation:
- Use exec.CommandContext instead of exec.Command
- Allows git command to be terminated if build is cancelled
- Prevents orphaned git processes
- Respects build timeouts
- Follows standard Go pattern for cancellable operations

Also add test for context cancellation behavior.

Addresses review feedback from Cornelius on PR #281.

Co-authored-by: Ona <no-reply@ona.com>

Author: leodido

pkg/leeway/sbom.go

@@ -102,8 +102,9 @@ func GetSBOMParallelism(sbomConfig WorkspaceSBOM) int {
 	return runtime.NumCPU()
 }
 
-// getGitCommitTimestamp returns the timestamp of the git commit
-func getGitCommitTimestamp(commit string) (time.Time, error) {
+// getGitCommitTimestamp returns the timestamp of the git commit.
+// The context allows for cancellation of the git command if the build is cancelled.
+func getGitCommitTimestamp(ctx context.Context, commit string) (time.Time, error) {
 	// Try SOURCE_DATE_EPOCH first (for reproducible builds)
 	if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {
 		timestamp, err := strconv.ParseInt(epoch, 10, 64)
@@ -114,8 +115,8 @@ func getGitCommitTimestamp(commit string) (time.Time, error) {
 		log.WithError(err).WithField("SOURCE_DATE_EPOCH", epoch).Warn("Invalid SOURCE_DATE_EPOCH, falling back to git commit timestamp")
 	}
 
-	// Get commit timestamp from git
-	cmd := exec.Command("git", "show", "-s", "--format=%ct", commit)
+	// Get commit timestamp from git with context support for cancellation
+	cmd := exec.CommandContext(ctx, "git", "show", "-s", "--format=%ct", commit)
 	output, err := cmd.Output()
 	if err != nil {
 		return time.Time{}, fmt.Errorf("failed to get commit timestamp: %w", err)
@@ -316,7 +317,7 @@ func writeSBOM(buildctx *buildContext, p *Package, builddir string) (err error)
 	}
 
 	// Normalize SBOMs after generation
-	timestamp, err := getGitCommitTimestamp(p.C.Git().Commit)
+	timestamp, err := getGitCommitTimestamp(context.Background(), p.C.Git().Commit)
 	if err != nil {
 		return fmt.Errorf("failed to get deterministic timestamp for SBOM normalization (commit: %s): %w. "+
 			"Ensure git is available and the repository is not a shallow clone, or set SOURCE_DATE_EPOCH environment variable", 

pkg/leeway/sbom_normalize_test.go

@@ -1,6 +1,7 @@
 package leeway
 
 import (
+	"context"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -110,7 +111,7 @@ func TestGetGitCommitTimestamp_SourceDateEpoch(t *testing.T) {
 			}
 
 			// Use HEAD as commit (should exist in test environment)
-			timestamp, err := getGitCommitTimestamp("HEAD")
+			timestamp, err := getGitCommitTimestamp(context.Background(), "HEAD")
 
 			if tt.wantErr && err == nil {
 				t.Error("expected error, got nil")
@@ -130,7 +131,8 @@ func TestGetGitCommitTimestamp_SourceDateEpoch(t *testing.T) {
 func TestGetGitCommitTimestamp_GitCommit(t *testing.T) {
 	// This test requires being in a git repository
 	// Use HEAD as a known commit
-	timestamp, err := getGitCommitTimestamp("HEAD")
+	ctx := context.Background()
+	timestamp, err := getGitCommitTimestamp(ctx, "HEAD")
 	if err != nil {
 		t.Skipf("skipping test: not in a git repository or git not available: %v", err)
 	}
@@ -146,7 +148,7 @@ func TestGetGitCommitTimestamp_GitCommit(t *testing.T) {
 	}
 
 	// Verify deterministic: calling twice should return same result
-	timestamp2, err := getGitCommitTimestamp("HEAD")
+	timestamp2, err := getGitCommitTimestamp(ctx, "HEAD")
 	if err != nil {
 		t.Fatalf("second call failed: %v", err)
 	}
@@ -155,6 +157,22 @@ func TestGetGitCommitTimestamp_GitCommit(t *testing.T) {
 	}
 }
 
+func TestGetGitCommitTimestamp_ContextCancellation(t *testing.T) {
+	// Create a cancelled context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // Cancel immediately
+
+	_, err := getGitCommitTimestamp(ctx, "HEAD")
+	if err == nil {
+		t.Error("expected error with cancelled context, got nil")
+	}
+
+	// Verify the error is related to context cancellation
+	if !contains(err.Error(), "context canceled") && !contains(err.Error(), "failed to get commit timestamp") {
+		t.Errorf("expected context cancellation error, got: %v", err)
+	}
+}
+
 func TestNormalizeCycloneDX(t *testing.T) {
 	// Create a temporary directory for test files
 	tmpDir := t.TempDir()