Repository navigation
fix(artifact-delivery): fall back where GitHub denies the read App - #498
Merged
Merged
Conversation
…ies the App neondatabase/agent-skills is public and a personal token reads it, but GitHub answers the read App 403. Every run of its Skills failed SOURCE_ACCESS_DENIED after builds moved to the App. A read the App was denied now repeats once with ARTIFACT_GITHUB_TOKEN or GITHUB_TOKEN, and the denial is reported as an artifact-github-credential event.
harlan-zw
added
the
harlan-agent-review
harlan-github-agent
Bot
added
harlan-agent-review-required
Contributor
🤖 MERGED
GitHub merged this pull request.
Review completed. No finding above 80/100. Selected findings run after merge and open separate pull requests. |
harlan-github-agent
Bot
added
harlan-agent-running
1 of 6 tasks
harlan-github-agent
Bot
added
harlan-agent-running
harlan-github-agent
Bot
added
harlan-agent-running
harlan-github-agent
Bot
added
harlan-agent-blocked
![harlan-github-agent[bot]](https://avatars.githubusercontent.com/in/4579275?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Harlan Agent Kit posted this automated review. AI open source policy.
Automated Review: BLOCKED.
harlan-github-agent
Bot
added
harlan-agent-running
GitHub can answer a secondary rate limit with 403, quota left, and no Retry-After. Only the message names the limit. That answer read as a denial, so a limited read App fell back to GITHUB_TOKEN, a personal token the registry sync also spends, and reported app-denied for a Repository that never denied it. A 403 whose message names a rate limit is now RATE_LIMITED, which never reaches the fallback token.
harlan-github-agent
Bot
removed
the
harlan-agent-running
harlan-github-agent
Bot
added
the
harlan-agent-running
harlan-github-agent
Bot
removed
the
harlan-agent-running
1 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 Linked issue
Related to #491
❓ Type of change
📚 Description
Since #491, public builds read GitHub as the
skilld-dev-registry-readsApp. GitHub denies that App onneondatabase/agent-skills, a public Repository that a personal token reads. The repository read answers 403, so every run of its Skills failsSOURCE_ACCESS_DENIED, which nobody retries. The sweep check and a run after the deploy on 2026-10-06 both failed this way.A read the App was denied now repeats once with the next credential,
ARTIFACT_GITHUB_TOKENorGITHUB_TOKEN. The denial emits anartifact-github-credentialevent with the outcomeapp-deniedand the Repository name, so the count of affected Repositories shows in the logs. A denial with no token after the App staysSOURCE_ACCESS_DENIED.