Repository navigation
feat(artifact-delivery): read GitHub as the read App for builds - #491
Merged
Merged
Conversation
harlan-zw
added this pull request to stack #492
October 6, 2026 15:04
harlan-zw
added
the
harlan-agent-review
harlan-github-agent
Bot
added
harlan-agent-running
Contributor
🤖 MERGED
GitHub merged this pull request. No material findings were recorded. The pull request closed. |
harlan-zw
added
harlan-agent-running
harlan-github-agent
Bot
removed
the
harlan-agent-running
GitHub counts a personal token's quota per account. GITHUB_TOKEN is a personal token, so the registry sync, page views and the account owner's other tools spend the same bucket that builds need, and runs failed RATE_LIMITED in the minutes before each hourly reset. An App installation has its own bucket. Builds now mint an installation token for the read App and fall back to ARTIFACT_GITHUB_TOKEN, then GITHUB_TOKEN, with a reported reason when the App gives none.
harlan-zw
force-pushed
the
fix/github-read-app
branch
from
October 6, 2026 15:10
efe9902 to
67785e7
Compare
This was referenced Oct 6, 2026
harlan-github-agent
Bot
removed
the
harlan-agent-review-required
1 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #484.
🔗 Linked issue
Related to #484
❓ Type of change
📚 Description
Public Artifact builds read GitHub with
GITHUB_TOKEN. That is a personal token of theharlan-zwaccount: its rate limit reset matched that account's reset to the second. GitHub counts a personal token's quota per account, so the hourly sync,/ghpage views, Harlan's own tools and the CI runners all spend one bucket of 5,000 requests an hour. In the 48 hours before 2026-10-06 15:00 UTC, 45 runs failedRATE_LIMITED, each in the last minutes before the hourly reset. #484 addsARTIFACT_GITHUB_TOKEN, which still needs a second GitHub account.Builds now read GitHub as the
skilld-dev-registry-readsApp. Its installation has a bucket of its own, which nothing else spends.metadata: read. It keeps the token until 5 minutes before it expires. Builds that start together share one exchange.ARTIFACT_GITHUB_TOKEN, thenGITHUB_TOKEN. If the App key does not parse, or GitHub refuses the token, the build reads with that fallback and emits anartifact-github-credentialevent with the reason. No event carries a token or the key.github-app.ts. The read App has its ownSKILLD_READ_APP_*names, because theGITHUB_APP_*names belong to private delivery.GITHUB_TOKEN.📝 Migration
Set
SKILLD_READ_APP_ID,SKILLD_READ_APP_INSTALLATION_IDandSKILLD_READ_APP_PRIVATE_KEY_PKCS8on the Worker. The key is a PKCS #8 PEM; convert a GitHub download withopenssl pkcs8 -topk8 -nocrypt. Without the three secrets, builds keep the token chain above.