Skip to content

fix: authenticate release app data caching with GitHub #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aplowman merged 1 commit into from
Oct 21, 2026
Merged

fix: authenticate release app data caching with GitHub #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,9 @@ Recovery can be rerun if it fails **before publication**. If either GitHub or Py
already has the version, inspect that publication and finish the remaining work
separately; the preflight will refuse another recovery run. Do not delete a
publication merely to bypass this safeguard.

The app-data caching step authenticates GitHub downloads using
`FSSPEC_GITHUB_USERNAME` and `FSSPEC_GITHUB_TOKEN` with the caller's
`general-token`. This avoids the shared runner IP's unauthenticated API quota.
Using `GH_TOKEN` alone is insufficient for application versions that only read it
while running tests.
2 changes: 2 additions & 0 deletions .github/workflows/release-impl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,6 +438,8 @@ jobs:
poetry run "$EXE_NAME" manage cache-all
env:
EXE_NAME: ${{ inputs.executable_name }}
FSSPEC_GITHUB_USERNAME: x-access-token
FSSPEC_GITHUB_TOKEN: ${{ secrets.general-token }}

- name: Upload all cached app data/programs
id: upload-cached-app-data
Expand Down
8 changes: 8 additions & 0 deletions scripts/test-release-recovery.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,14 @@ set -euo pipefail

root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
workflow="$root/.github/workflows/release-impl.yml"
cache_step=$(awk '
/^ - name: Cache all app data and programs$/ { found = 1; next }
found && /^ - name:/ { exit }
found { print }
' "$workflow")
grep -qF 'FSSPEC_GITHUB_USERNAME: x-access-token' <<< "$cache_step"
grep -qF 'FSSPEC_GITHUB_TOKEN: ${{ secrets.general-token }}' <<< "$cache_step"
printf 'PASS: app data caching configures authenticated fsspec GitHub access\n'
tmp=$(mktemp -d)
trap 'rm -r -- "$tmp"' EXIT

Expand Down
Loading