From c00884e9543bb56335231a43f43f49346faa2700 Mon Sep 17 00:00:00 2001 From: Yogthos Date: Mon, 7 Sep 2026 11:16:09 -0400 Subject: [PATCH] CI: resolve the jolt release tag with the job token The install script finds "latest" through an unauthenticated api.github.com call. That quota is shared by every Actions runner on the same IP, so on a busy hour it answers 403 and the job dies before jolt is installed; the v0.0.9 tag run failed that way and passed on re-run. gh makes the same call with the job's token, and the tag goes to the script as --version, which skips its own lookup. The script still owns asset naming and the checksum. Claude-Session: https://claude.ai/code/session_01BaSQBjbdQX9z2pHmvb1nuU --- .github/workflows/tests.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 03249db..698f8cc 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -6,6 +6,8 @@ jobs: steps: - uses: actions/checkout@v4 - name: Install jolt + env: + GH_TOKEN: ${{ github.token }} run: | set -euo pipefail sudo apt-get update @@ -20,8 +22,14 @@ jobs: # release asset here: it owns the archive and binary naming (which # changed in v0.5.0, when the CLI was renamed from joltc to jolt) and # verifies the checksum. Hardcoding either broke this workflow once. + # The one thing resolved here is the release tag: left to the script, + # "latest" is an unauthenticated api.github.com call, and the quota + # for that is shared across every Actions runner on the same IP, so + # it answers 403 on a busy hour (the v0.0.9 tag run failed that way). + # gh makes the same call with the job's token. + tag="$(gh api repos/jolt-lang/jolt/releases/latest -q .tag_name)" curl -fsSL https://raw.githubusercontent.com/jolt-lang/jolt/main/install \ - | bash -s -- --dir "$HOME/.jolt" + | bash -s -- --dir "$HOME/.jolt" --version "$tag" echo "$HOME/.jolt" >> "$GITHUB_PATH" - name: Test run: JOLT_PWD="$PWD" jolt -M:test