Enhance GitHub GraphQL Rate Limit Handling and Token Security by pisum-sativum · Pull Request #8273 · JhaSourav07/commitpulse

pisum-sativum · 2026-07-22T17:24:07Z

Description

Fixes #6239

This PR resolves critical issues related to GitHub GraphQL rate limit exhaustion and token exposure vulnerabilities.

Specific changes include:

Request Deduplication: Fixed a bug in lib/github.ts where request deduplication was bypassed for requests providing an options.signal. The background cache-populating fetch is now properly decoupled from individual request abort signals, preventing duplicate GraphQL calls for concurrent same-user requests.
Token Security & Log Sanitization: Safely caught network-level fetch errors (TypeError) and converted them into generic errors. This guarantees that Request objects, which contain the Authorization header with the Personal Access Token (PAT), are stripped and never logged to serverless dashboards or exposed to clients.

Pillar

🎨 Pillar 1 — New Theme Design
📐 Pillar 2 — Geometric SVG Improvement
🕐 Pillar 3 — Timezone Logic Optimization
🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

No visual changes. This PR strictly improves backend API resilience, rate limit handling, and token security.

Checklist before requesting a review:

I have read the CONTRIBUTING.md file.
I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
I have updated README.md if I added a new theme or URL parameter.
I have started the repo.
I have made sure that i have only one commit to merge in this PR.
The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
(Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

…nt timeout on large repos

…cial[]

…haSourav07#6239)

vercel · 2026-07-22T17:24:11Z

@pisum-sativum is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

retenta-bot · 2026-07-22T17:24:13Z

This pull request effectively resolves critical issues related to GitHub GraphQL rate limits and enhances token security. The changes made, such as request deduplication and error handling, are crucial for maintaining the integrity of our API interactions. It's worth noting that similar past decisions focused on improving user experience through visually themed error responses, which highlights our commitment to both functionality and user experience. Thank you for your contributions, and I look forward to your feedback!

pisum-sativum · 2026-07-22T17:26:53Z

@JhaSourav07 I have done the necessary changes kindly check and merge with appropriate labels.

Copilot

Pull request overview

Improves GitHub API resiliency by adjusting retry/abort behavior and contribution-request coalescing to reduce duplicated calls and avoid leaking sensitive request details, while also tweaking CI analytics paging and reordering the socials registry.

Changes:

Updates fetchWithRetry error/abort handling and adjusts contribution-fetch coalescing so abort signals don’t bypass deduplication.
Reduces CI Actions pagination depth for CI analytics fetches.
Sorts the socials registry alphabetically at module initialization.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
services/github/ci-analytics.ts	Reduces Actions pagination (likely to lower API usage).
lib/github.ts	Changes abort/error behavior in retry logic and contribution request coalescing for better dedup + safer error surfaces.
app/generator/data/socials.ts	Sorts socials registry by display name (user-visible ordering change).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  if (didThrow) {
-    if (options.signal?.aborted) throw fetchError;
+    if (options.signal?.aborted) throw new Error('AbortError');


+    return new Promise<ExtendedContributionData>((resolve, reject) => {
+      if (options.signal?.aborted) return reject(new Error('AbortError'));
+
+      const onAbort = () => reject(new Error('AbortError'));
+      options.signal?.addEventListener('abort', onAbort, { once: true });
+


+      placeholder: 'e.g. https://huggingface.co/yourname',
+    },
+  ] as Social[]
+).sort((a, b) => a.name.localeCompare(b.name));


github-actions · 2026-07-22T17:41:42Z

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category	PR Size	Base Size	Difference
Total JS	3984.87 KB	3984.83 KB	+0.04 KB (+0.00%)
Total CSS	331.41 KB	331.41 KB	0 B

Aamod007

This is a solid improvement to our GraphQL rate limit handling and request cancellation logic! The way you're handling \AbortError\ and coalescing requests is very robust.

However, similar to PR #8274, it looks like this branch contains unrelated changes that were accidentally committed. Specifically, the changes to \�pp/generator/data/socials.ts\ and \services/github/ci-analytics.ts\ do not belong in this PR.

To fix this, please revert the changes to those files using \git restore\ or \git checkout\ so that this PR is focused entirely on the GitHub API rate limit and token handling.

Looking forward to getting this merged once the branch is cleaned up!

Label Justification:

\level:advanced: Implementing complex request coalescing, abort controller logic, and rate-limit backoff across the API layer is an advanced task.
\ ype:bug\ & \ ype:security: Prevents token exhaustion and handles API edge cases securely.
\mentor:Aamod007: Assigned as required.

…te-limit # Conflicts: # lib/github.ts

github-actions · 2026-07-23T18:16:17Z

🚨 Hey @pisum-sativum, the CI Pipeline is failing on this PR and it has been marked as status:blocked.

Please fix the issues before this can be reviewed. Here's how:

1. Run checks locally before pushing:

npm run format:check   # Check Prettier formatting
npm run lint           # Run ESLint
npm run typecheck      # TypeScript type check
npm run test           # Run unit tests (Vitest)
npm run build          # Verify production build passes

2. Auto-fix common issues:

npm run format         # Auto-fix formatting with Prettier
npm run lint -- --fix  # Auto-fix lint errors where possible

3. Check the full failure log here:
👉 View CI Run

Once you push a fix and the CI passes, the status:blocked label will be removed automatically. 💪

… achievements) to main state

…pliance

pisum-sativum · 2026-07-24T07:50:02Z

This is a solid improvement to our GraphQL rate limit handling and request cancellation logic! The way you're handling \AbortError\ and coalescing requests is very robust.

However, similar to PR #8274, it looks like this branch contains unrelated changes that were accidentally committed. Specifically, the changes to \�pp/generator/data/socials.ts\ and \services/github/ci-analytics.ts\ do not belong in this PR.

To fix this, please revert the changes to those files using \git restore\ or \git checkout\ so that this PR is focused entirely on the GitHub API rate limit and token handling.

Looking forward to getting this merged once the branch is cleaned up!

Label Justification:

\level:advanced: Implementing complex request coalescing, abort controller logic, and rate-limit backoff across the API layer is an advanced task.

\ ype:bug\ & \ ype:security: Prevents token exhaustion and handles API edge cases securely.

\mentor:Aamod007: Assigned as required.

@Aamod007 I have done the necessary changes required but the CI is failing again and again I tried to fix it but I don't think so I can. Maybe after sometime will try ;(

Aamod007

New commits address some of the previous concerns. The signal/abort refactoring in fetchGitHubContributions looks notably better — properly propagating abort signals through the coalesced promise pattern rather than ignoring them. The error message extraction (fetchError instanceof Error ? fetchError.message : String(fetchError)) is a good improvement too.

CI is still failing though. Please check the logs and fix whatever is causing the failures before we can approve.

Label justification:

level:advanced — the async signal propagation + coalesced promise pattern is non-trivial, spans 4 files including github.ts which has complex retry/abort logic
quality:clean — well-structured changes
type:bug, type:security — rate limit error handling + token security
mentor:Aamod007 — assigned

Aamod007

Re-reviewing: the only CI failure was Vercel authorization (not code-related). All code checks pass. The Vercel deploy auth is a repo-level config issue. Approving.

pisum-sativum · 2026-07-27T14:42:43Z

@Aamod007 @JhaSourav07 Kindly check and merge if possible with correct labels.

pisum-sativum · 2026-07-27T17:06:59Z

New commits address some of the previous concerns. The signal/abort refactoring in fetchGitHubContributions looks notably better — properly propagating abort signals through the coalesced promise pattern rather than ignoring them. The error message extraction (fetchError instanceof Error ? fetchError.message : String(fetchError)) is a good improvement too.

CI is still failing though. Please check the logs and fix whatever is causing the failures before we can approve.

Label justification:

level:advanced — the async signal propagation + coalesced promise pattern is non-trivial, spans 4 files including github.ts which has complex retry/abort logic

quality:clean — well-structured changes

type:bug, type:security — rate limit error handling + token security

mentor:Aamod007 — assigned

@Aamod007 Do I need to make any changes which you stated ?

pisum-sativum · 2026-07-28T07:40:09Z

@Aamod007 @JhaSourav07 Kindly merge this pr so that i can take up new issues since the bots is not allowing me to take up any more new issues .

pisum-sativum · 2026-07-31T07:50:57Z

@Aamod007 @JhaSourav07 If no change is required then kindly check and merge.

pisum-sativum · 2026-08-02T07:45:33Z

@Aamod007 @JhaSourav07 pls check and merge.

github-actions · 2026-08-06T03:13:42Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

Aamod007

Nice improvement! Alphabetically sorting the socials dropdown makes the UI much more intuitive and user-friendly for people trying to find a specific platform. Approved!

pisum-sativum · 2026-08-06T06:51:22Z

@Aamod007 @JhaSourav07 Caan u pls merge this pr asap

pisum-sativum · 2026-08-06T20:29:17Z

@Aamod007 @JhaSourav07 pls merge this pr asap

pisum-sativum · 2026-08-07T14:42:48Z

@JhaSourav07 could you please merge all the PRs I've worked on? I've been requesting this for several days now but they are still pending. I would really appreciate it if you could review and merge them as soon as possible. Thank you!

github-actions · 2026-08-11T02:06:26Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

pisum-sativum · 2026-08-11T07:29:01Z

@JhaSourav07 pls merge

pisum-sativum · 2026-08-12T15:50:27Z

@JhaSourav07 Any update?

github-actions · 2026-08-16T01:42:15Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

github-actions · 2026-08-20T01:36:38Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

github-actions · 2026-08-23T01:44:28Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

github-actions · 2026-08-27T08:39:03Z

⚠️ Hey @pisum-sativum, this pull request has been inactive for 4 days. It will be automatically closed in 1 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

pisum-sativum added 5 commits July 22, 2026 02:13

fix(ci-analytics): parallelize API requests with Promise.all to preve…

f299da2

…nt timeout on large repos

feat: Automatically sort SOCIALS list alphabetically

5a9ecf1

Merge remote-tracking branch 'origin/main' into fix-socials-sort

e6f1ded

fix: resolve TS2322 type error in SOCIALS sort by casting array as So…

6978cd3

…cial[]

fix: resolve GraphQL request deduplication and sanitize PAT errors (J…

dff1d44

…haSourav07#6239)

Copilot AI review requested due to automatic review settings July 22, 2026 17:24

retenta-bot Bot changed the title ~~Fix GitHub graphql rate limit~~ Enhance GitHub GraphQL Rate Limit Handling and Token Security Jul 22, 2026

Copilot started reviewing on behalf of pisum-sativum July 22, 2026 17:24 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Aamod007 added level:advanced Complex contributions involving architecture, optimization, or significant feature work type:bug Something isn't working as expected type:security Security fixes, dependency updates, or hardening mentor:Aamod007 labels Jul 23, 2026

Aamod007 requested changes Jul 23, 2026

View reviewed changes

pisum-sativum added 2 commits July 23, 2026 23:37

revert: remove unrelated changes to socials.ts and ci-analytics.ts

2131c06

Merge remote-tracking branch 'origin/main' into fix-github-graphql-ra…

0986449

…te-limit # Conflicts: # lib/github.ts

github-actions Bot added the status:blocked This PR is blocked due to a failing CI check. label Jul 23, 2026

pisum-sativum added 4 commits July 23, 2026 23:57

fix(burnout): import missing Image component and format code style

a2e1f13

revert: restore unrelated files (BurnoutRiskTable, InteractiveViewer,…

05bf3d2

… achievements) to main state

style: format InteractiveViewer and achievements for format:check com…

9f7ff1b

…pliance

fix(burnout): import Image component in BurnoutRiskTable

67557d0

Aamod007 requested changes Jul 27, 2026

View reviewed changes

Aamod007 approved these changes Jul 27, 2026

View reviewed changes

Aamod007 added level:beginner Small changes Usually isolated fixes or simple UI/text updates. quality:clean PR follows clean coding practices, proper formatting, documentation, and maintainability standards. type:refactor Code changes that neither fix a bug nor add a feature labels Aug 6, 2026

Aamod007 approved these changes Aug 6, 2026

View reviewed changes

Conversation

pisum-sativum commented Jul 22, 2026

Description

Pillar

Visual Preview

Checklist before requesting a review:

Uh oh!

vercel Bot commented Jul 22, 2026

Uh oh!

retenta-bot Bot commented Jul 22, 2026

Uh oh!

pisum-sativum commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jul 22, 2026

📦 Next.js Bundle Size Report (Gzipped Sizes)

📊 Summary of Totals

Uh oh!

Aamod007 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

pisum-sativum commented Jul 24, 2026

Uh oh!

Aamod007 left a comment

Choose a reason for hiding this comment

Uh oh!

Aamod007 left a comment

Choose a reason for hiding this comment

Uh oh!

pisum-sativum commented Jul 27, 2026

Uh oh!

pisum-sativum commented Jul 27, 2026

Uh oh!

pisum-sativum commented Jul 28, 2026

Uh oh!

pisum-sativum commented Jul 31, 2026

Uh oh!

pisum-sativum commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

Aamod007 left a comment

Choose a reason for hiding this comment

Uh oh!

pisum-sativum commented Aug 6, 2026

Uh oh!

pisum-sativum commented Aug 6, 2026

Uh oh!

pisum-sativum commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

pisum-sativum commented Aug 11, 2026

Uh oh!

pisum-sativum commented Aug 12, 2026

Uh oh!

github-actions Bot commented Aug 16, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants