Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Private repos require you to set process.env.GH_ADMIN_TOKEN to fetch the latest SHA #73

Closed
lucasgonze opened this issue May 10, 2022 · 6 comments · Fixed by #75
Closed

Private repos require you to set process.env.GH_ADMIN_TOKEN to fetch the latest SHA #73

lucasgonze opened this issue May 10, 2022 · 6 comments · Fixed by #75

Comments

@lucasgonze
Copy link
Contributor

Hellos @mheap. Thanks for this excellent tool.

I am running it against build files in a public repo and getting an unexpected error:

Unable to find SHA for actions/checkout@v2
Private repos require you to set process.env.GH_ADMIN_TOKEN to fetch the latest SHA

These are the specific actions triggering the issue:

Unable to find SHA for actions/checkout@v2
Unable to find SHA for actions/github-script@v3
Unable to find SHA for actions/github-script@v3.1.0
Unable to find SHA for dorny/paths-filter@v2
Unable to find SHA for hmarr/debug-action@v2

My understanding is that these are not private repos and shouldn't require a token. uses: actions/checkout@main is an example in your own home page.

I can work around the issue for now, but it does complicate my team's usage of the tool so it's worth asking about.
@mheap
Copy link
Owner

mheap commented May 10, 2022

Hey @lucasgonze! Thanks for the report. I've just run a test locally with actions/checkout@v2 and it seems to have worked fine.

Could you clone the repo, uncomment lines 41 and 55 in findRefOnGithub.js and run ./bin.js /path/to/workflow.yml?

(As an aside, I need to add an easier way to get debug logs)

@lucasgonze
Copy link
Contributor Author

Done. sample.txt shows a complete log of one failed request matching the above pattern. I think the key is this bit:

RequestError [HttpError]: API rate limit exceeded for 50.242.118.169. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)

@mheap
Copy link
Owner

mheap commented May 11, 2022

Yep! That'd do it. I'll add some additional handling that makes it clearer what's going on when you get rate limited.

In this case, you'll need to configure the GitHub token to increase your rate limit

@lucasgonze
Copy link
Contributor Author

That makes total sense. I agree that a better error message would get the job done.

@mheap mheap mentioned this issue May 14, 2022
Merged
@mheap mheap closed this as completed in #75 May 14, 2022
@mheap mheap mentioned this issue May 14, 2022
Merged
@mheap
Copy link
Owner

mheap commented May 14, 2022

v1.6.0 just went out with a fix for the error message and better logging. Thanks for the report

@lucasgonze
Copy link
Contributor Author

🙏 LGTM

l0b0 added a commit to linz/emergency-management-tools that referenced this issue Nov 15, 2023
@l0b0
feat: Pin actions to hashes
619558d 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 15, 2023
Merged
l0b0 added a commit to linz/imagery that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
90734f7 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/emergency-management-tools that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
f7bb889 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/hydro-aws-infrastructure that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
0679e0c 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/python-linz-logger that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
a985b22 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/stac-extension-template that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
c2aade7 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/template-javascript-hello-world that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
665b231 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/topo-imagery that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
0a0394c 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/topo-workflows that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
32b996a 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/template-python-hello-world that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
4bb04cf 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.y*ml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/template-python-hello-world that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
963f3eb 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.y*ml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
@l0b0 l0b0 mentioned this issue Nov 16, 2023
Merged
l0b0 added a commit to linz/hydro-aws-infrastructure that referenced this issue Nov 16, 2023
@l0b0
feat: Pin actions to hashes
fe5b868 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/template-python-hello-world that referenced this issue Nov 20, 2023
@l0b0
feat: Pin actions to hashes
d17322b 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.y*ml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.

# Conflicts:
#	.github/workflows/codeql-analysis.yml
github-merge-queue bot pushed a commit to linz/topo-imagery that referenced this issue Nov 20, 2023
@l0b0
feat: Pin actions to hashes (#729)
e2343d5 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/emergency-management-tools that referenced this issue Nov 23, 2023
@l0b0
feat: Pin actions to hashes
62c48be 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/emergency-management-tools that referenced this issue Nov 23, 2023
@l0b0
feat: Pin actions to hashes
22fb8a3 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action --comment=' {ref}' .github/workflows/*.y*ml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
kodiakhq bot pushed a commit to linz/python-linz-logger that referenced this issue Nov 27, 2023
@l0b0
feat: Pin actions to hashes (#239)
baa078d 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
l0b0 added a commit to linz/emergency-management-tools that referenced this issue Nov 27, 2023
@l0b0
feat: Pin actions to hashes
a9f9221 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action --comment=' {ref}' .github/workflows/*.y*ml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained personal
access tokens with no extra access to work around rate limiting *and* to be
able to work in private repos
<mheap/pin-github-action#73>.
github-merge-queue bot pushed a commit to linz/imagery that referenced this issue Nov 27, 2023
@l0b0
feat: Pin actions to hashes TDE-934 (#332)
d9451ea 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained
personal access tokens with no extra access to work around rate limiting
*and* to be able to work in private repos
<mheap/pin-github-action#73>.
github-merge-queue bot pushed a commit to linz/template-javascript-hello-world that referenced this issue Dec 15, 2023
@l0b0
feat: Pin actions to hashes TDE-934 (#89)
6c15b9e 
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`.

Dependabot should support updating in the same fashion
<dependabot/dependabot-core#8277 (comment)>.

Had to `export GH_ADMIN_TOKEN=github_pat_…` using a fine-grained
personal access tokens with no extra access to work around rate limiting
*and* to be able to work in private repos
<mheap/pin-github-action#73>.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add error handling for rate limits mheap/pin-github-action
2 participants
@mheap @lucasgonze