Skip to content

fix(github): keep a malformed mint answer out of reports - #526

Merged
harlan-zw merged 3 commits into
mainfrom
fix/github-mint-report-leak
Oct 7, 2026
Merged

harlan-zw merged 3 commits into
mainfrom
fix/github-mint-report-leak

Conversation

@harlan-zw

Copy link
Copy Markdown
Collaborator

🔗 Linked issue

Related to #525

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

Review findings on #525, which merged before these commits reached it.

  • A 2xx installation token answer with malformed JSON threw a JSON.parse error that quotes the start of the body, such as "{"token":ghs_SECRET".... That message reached the app-token-unavailable report and its wide event. The mint now throws a fixed message instead.
  • The test "mints once for reads GitHub rejected together" renewed the token on its first read, so its parallel reads never met a 401. The cached token is now revoked after the first read, and three parallel reads share one new mint.
  • The runbook said the sync never paces on the fallback's quota. A failed or misconfigured mint moves every read to the fallback, so its quota paces the sync then. The createArtifactGithubSource comment said nothing else spends the App's bucket; the registry does now.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

A JSON.parse error quotes the start of the body it rejects. For an installation token answer that start holds the token, and the message reached the app-token-unavailable report.
The test renewed the token on its first read, so the parallel reads never met a 401.
A failed or misconfigured mint moves every read to the fallback, so its quota paces the sync then. The runbook said never.
@harlan-zw
harlan-zw merged commit 66f22c7 into main Oct 7, 2026
7 checks passed
@harlan-zw
harlan-zw deleted the fix/github-mint-report-leak branch October 7, 2026 02:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant