Repository navigation
fix(analyze): bound the forge pass to half the token quota and a short window in CI - #339
Merged
Merged
Conversation
…t window in CI The vulnetix.yml analyze job read a year of pull requests, issues and commit reviews on every push to main, and kept spending the job token until 100 requests were left. That token's hourly quota belongs to the whole repository, so CodeQL's SARIF upload and the auto-version release dispatch failed with 'API rate limit exceeded for installation'. - forge budget: stop at max(100, half the hourly limit) instead of a fixed 100. - analyze: --forge-window-days bounds the GitHub pass apart from the git history window; the commit-review pass only asks about commits inside it. - gha init: on a push or a release the analyze job passes --forge-window-days=7; only a manual run reads the full window. Pull requests still pass --no-forge. - Regenerate .github/workflows/vulnetix.yml and docs/command-manifest.json.
0x73746F66
force-pushed
the
fix/analyze-forge-quota
branch
from
November 13, 2026 14:01
2c72a7a to
952cdeb
Compare
Contributor
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
Contributor
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
added a commit
that referenced
this pull request
Nov 13, 2026
v4.24.30 carries the bounded forge pass (#339). The workflow already passes --forge-window-days, which the v4.24.3 CLI does not know.
0x73746F66
added a commit
that referenced
this pull request
Nov 13, 2026
v4.24.30 carries the bounded forge pass (#339). The workflow already passes --forge-window-days, which the v4.24.3 CLI does not know.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
internal/analyze/forge/budget.go): the collector now stops when the remaining quota reachesmax(100, limit/2). It used to stop at a fixed 100. The truncation reason reports how many requests were left out of the limit, and points at--forge-window-days.analyze --forge-window-days(default 0, meaning the same as--window-days): sets how far back the GitHub pass reads pull requests, issues and commit reviews, separately from the git history window. The commit-review pass now only asks about non-merge commits inside that window (commitsToReview).vulnetix gha init: the analyze job'sextra-argsis now${{ github.event_name == 'pull_request' && '--no-forge' || github.event_name != 'workflow_dispatch' && '--forge-window-days=7' || '' }}.A pull request still skips the forge pass, as in ci(gha init): stop pull-request scans spending the repository's API quota #336. A push or a release reads the last 7 days. Only a manual run reads the full window.
.github/workflows/vulnetix.ymlwith the new generator (gha init --ref v4.24.3;--checkreports current) anddocs/command-manifest.json. Documented the behaviour indocs/github-actions.mdand theanalyzehelp text.Why
CodeQL and Auto Version were failing on main with
API rate limit exceeded for installation. On every push to main, theanalyzejob read a year of pull requests, issues and commit reviews withGITHUB_TOKEN: several calls per pull request plus up to 300 commit lookups. It kept going until only 100 requests were left. That quota (1,000 an hour) belongs to the whole repository, so CodeQL's SARIF upload and the release dispatch on the same push ran out. Releases are published on almost every merge here, so thereleaseevent repeated the same spend.With this change, a single run can never take more than half the hourly limit. The routine push and release runs read only a week of activity, which costs a small fraction of the requests.
Notes
Vulnetix/cli/*@v4.24.3, and that CLI does not know--forge-window-days. Until the pin moves to the release that contains this change, the push run's analyze step exits non-zero, andfail-on-findings: falsekeeps the job green. No forge requests are made in that time. A follow-up bumps the pin.How verified
go test ./internal/analyze/... ./internal/ghainit/... ./cmd/pass. New tests:TestBudget_KeepsHalfTheLimitForOtherJobsTestBudget_UnknownLimitTestCommitsToReview_StaysInsideTheForgeWindowTestForgeWindowDays_FollowsTheHistoryWindowUnlessSetTestAnalyzeBoundsTheForgePass(updated render test)just lint(golangci-lint v2.14.0, as CI pins it): 0 issues.actionlint .github/workflows/vulnetix.ymlpasses.vulnetix gha init --check --ref v4.24.3reports the workflow is current.