Authenticate the "latest" lookup - #5
Merged
Merged
Conversation
The install script can now use a token for the API call that resolves "latest" (aviorstudio/gdam#4). It is not in the environment by default in Actions, so it has to be handed over -- this does that, defaulting to the workflow's own token so no consumer has to change anything. The unauthenticated API allows 60 requests an hour PER IP ADDRESS, and runners share addresses. macOS runners share them heavily enough that the lookup returned 403 several times an hour, which failed installs intermittently across all sixteen repositories using this action and blocked this repo's own release three times. Authenticated, the limit is scoped to the token: 1000/hour per repository, against one lookup per run. Passed as GDAM_GITHUB_TOKEN rather than GITHUB_TOKEN so the script gets exactly what the caller chose, instead of quietly inheriting whatever the job happened to have in GITHUB_TOKEN. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The other half of aviorstudio/gdam#4, now merged.
That PR taught the install script to use a token.
GITHUB_TOKENis not in the environment by default in Actions, so it has to be handed over — this does that.The default is the point
Consumers get authentication from the version bump alone and change nothing. The alternative — requiring each of the 16 repositories to pass a token — turns 16 one-line PRs into 16 two-place PRs for no benefit.
The pattern is already proven in these orgs:
gdam-beandcastledropboth use${{ github.token }}inside composite actions, andprizmthreads agithub-tokeninput the same way.Why
The unauthenticated GitHub API allows 60 requests an hour per IP address, and runners share addresses. macOS runners share them heavily enough that resolving
latestreturned 403 several times an hour:That failed installs intermittently across all 16 consumers, and blocked this repo's own release three times in a row.
Authenticated, the limit is scoped to the token: 1,000/hour per repository, against exactly one lookup per workflow run.
One detail
It's passed as
GDAM_GITHUB_TOKEN, notGITHUB_TOKEN. The script checksGDAM_GITHUB_TOKEN→GITHUB_TOKEN→GH_TOKEN, so using the specific name means the script gets exactly what the caller chose for this action, rather than quietly inheriting whatever the surrounding job happened to have set.Verification
CI is the test: the
install (macos-latest)job is the one that has been failing on this, and it exercisesversion: lateston the first step. If it passes here it passes for the reason this PR exists — though a single green run isn't proof against an intermittent fault, so I'll watch the release run that follows.