Repository navigation
Anonymous GitHub release lookups exhaust a shared 60/hour and fail builds #62
Description
Activity
Went through this one call site at a time before changing anything, and most of it is already done.
All 14 Ansible call sites carry
hyperi_github_headers-- counts match 1:1 per file (utilities 3/3, k8s 7/7, cloud 2/2, and ten singles). Nothing to do there.The one real gap was
hyperi-rust-setup, which does its own sccache release lookup and had no token handling at all. It runs during the converge, so it burned anonymous quota on the shared egress address every time.Worth recording why the fix is two halves, because the script change alone does nothing on a fleet box: an exported token survives
becometo the SAME user, but is stripped becoming a DIFFERENT one. Measured it --token=[]becoming root, the value intact becoming yourself. hyperi-infra connects asubuntuand becomes the desktop user, so the task has to hand the token over explicitly.hyperi_github_envis the process-environment twin ofhyperi_github_headers, empty when no token is set.STILL OPEN after #70, and why we stopped:
hyperi-update-linux.sh:389,465make the same unauthenticated lookups, buthyperi-update.serviceruns asactual_userwith noEnvironment=. Patching the script changes nothing until we decide where a fleet box gets a token from, and a token in a unit file is not it for a classification 4 repo. That is a decision, not a code change, so it is left here rather than half-fixed.Fix for the converge path is in #70.
- added a commit that references this issue
on Aug 30, 2026 Released in v2.24.13 -- https://github.com/hyperi-io/hyperi-developer/releases/tag/v2.24.13
Every GitHub release lookup in the Ansible roles is anonymous -- 14 files hit
api.github.comand a search forAuthorizationacrossansible/returns nothing. That is fine on a laptop and expensive anywhere the address is shared.The anonymous limit is 60 requests an hour PER IP, and all HyperI on-prem infrastructure leaves through one public address. So an image build, a converge and CI all draw on the same 60, and a single run selecting
infrastructureplus a couple of languages spends a good fraction of it by itself -- k8s.yml, cloud.yml, data_tools.yml, ghostty.yml, colima.yml, go.yml, the rust setup script.It killed our desktop template build at task 90 with
x_ratelimit_remaining: '0'andx_ratelimit_used: '60'. An earlier run the same morning got to task 280, so it is not deterministic -- it depends on what else in the estate has been talking to GitHub in the preceding hour.Two things make it worse than the raw number suggests:
urimodule dumps the 403 response headers rather than saying "rate limited", and the shell call sites that docurl ... | grep tag_nameend up with an empty version and fail later on a 404 or a tar error that names nothing.What would fix it for us: read a token from the environment (
GITHUB_TOKENorGH_TOKEN) and set the Authorization header when one is present, staying anonymous when it is not. Then an unattended build can pass one and a laptop run is unchanged.DONE WHEN an image build can make its release lookups without competing for anonymous quota.