Repository navigation
fix(analyze): a spent GitHub quota at preflight skips the forge pass instead of failing the run - #341
Merged
Merged
Conversation
…instead of failing the run When the job token's quota was already spent by other jobs, the preflight repository read got 403 'API rate limit exceeded for installation'. repoAccessError reported that as 'cannot read Vulnetix/cli', and analyze exited without a report. A rate-limit error at preflight is now forge.ErrRateLimited, and analyze.Check skips the forge pass: its metrics are not measured, and the git, file, dependency and trust metrics are still reported. IsRateLimit also matches wrapped errors.
Contributor
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
added a commit
that referenced
this pull request
Nov 13, 2026
… the repository's API quota (#342) On the push that merged #341 the analyze preflight saw 4,913 of 5,000 requests left; by 16:08:18, three and a half minutes later, SCA's own SARIF upload failed with "GitHub API rate limit exhausted", and the forge pass found 0 left. The scan jobs' licence lookups spent it: - 46 of the 72 names a licence pass asked GitHub about cannot be repositories ($/sbom from a workflow's `uses: $/sbom`, a glob, "<your"). - Each name went through about 14 requests through gh, then 12 more with GITHUB_TOKEN as a "PAT fallback", though gh already sends that token. - Six processes per push repeat this: sca (two steps), license, sbom, and the sbom prior steps of the upload and bom-validate extras. The lookups now: - skip names GitHub cannot hold (validOwnerRepo); - run repository, /license, then root listing, ending at a repository 404, with no blind file fetches and no duplicate token pass: 1-4 requests; - spend from internal/ghquota, the forge budget moved to a shared package, seeded from the free /rate_limit, keeping 80% of the limit inside GitHub Actions (above the forge pass's half); - stop on a rate-limit answer, leave unchecked licences UNKNOWN and say how many, and log each batch's request count in Actions. gha init gives no token to a scanner run as an extra's prior step, which publishes nothing; vulnetix.yml is regenerated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
forge.Checknow returnsforge.ErrRateLimitedwhen the/useror repository read fails with a rate-limit error. Before, it was reported throughrepoAccessErroras "the GitHub token ... cannot read /".analyze.ChecktreatsErrRateLimitedlike--no-forge. The forge pass is skipped, its metrics are reported as not measured with that reason, and the run continues.IsRateLimituseserrors.As, so it also recognises wrapped rate-limit errors.analyzehelp text says a spent quota skips GitHub.Why
The first push to main after #340 ran
analyzewith v4.24.30 (run 43453552319). The repository's installation quota was still spent from earlier runs. The preflight repository read got403 API rate limit exceeded for installation, and analyze exited with "the GitHub token from GITHUB_TOKEN is valid (authenticated as repository-scoped token) but cannot read Vulnetix/cli". That is the wrong diagnosis, and it lost the whole report, including the git, file, dependency and trust metrics that do not need GitHub at all. #339 bounds what analyze spends. This PR makes analyze survive when other jobs have already spent the quota.How verified
TestCheck_ExhaustedQuotaIsNotAnAccessError: user token, with and without a repository.TestCheck_RepositoryScopedTokenWithExhaustedQuota: the GITHUB_TOKEN path, where/useris a plain 403 and the repository read hits the limit.TestIsRateLimit_Wrapped.go test ./internal/analyze/... ./cmd/pass.just lint(golangci-lint v2.14.0) reports 0 issues.