Skip to content

Address github rate limitting when releasing - #441

Open
divolgin wants to merge 1 commit into
mainfrom
divolgin/fix-github-error
Open

Address github rate limitting when releasing#441
divolgin wants to merge 1 commit into
mainfrom
divolgin/fix-github-error

Conversation

@divolgin

Copy link
Copy Markdown
Member

What does this PR do?

Release workflow can fail due to Github rate limiting. Changes below address this issue.

Securebuild FIPS Image Build Failure - Fix Summary

Problem

The replicated-sdk-fips matrix job in publish-securebuild.yml failed with ./securebuild: line 1: Not: command not found (exit code 127). The replicated-sdk job in the same run succeeded.

Root Cause

Both matrix jobs run in parallel and each makes an unauthenticated GitHub API call to fetch the latest securebuild release tag. With multiple jobs hitting the API simultaneously, one job got rate-limited (unauthenticated calls are capped at ~60 req/hr per IP), causing jq -r .tag_name to return null. The resulting download URL pointed to a non-existent asset, and curl -sL (without the -f flag) silently saved the "Not Found" error page as the securebuild binary. chmod +x succeeded on the text file, but execution failed on the first word ("Not").

Fix

Updated both "Install securebuild CLI" steps in .github/workflows/publish-securebuild.yml:

  1. Authenticated API calls — use the workflow's GITHUB_TOKEN as a Bearer token, raising the rate limit to 5,000 req/hr
  2. curl -f flag — fail on HTTP errors instead of silently saving error responses
  3. Tag validation — exit with error if LATEST_TAG is empty or null
  4. Binary validation — verify the download is an ELF binary with file before proceeding, printing contents on failure for debugging

Does this PR introduce a user-facing change?

NONE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant