Repository navigation
ci(generate): hand the shards a GitHub token for the agent they scaffold - #1302
Merged
antoinetoussaint-byte merged 1 commit intoNov 4, 2026
Merged
Conversation
Each cmd/generate fixture runs `codefly add service --agent go-grpc` with no version, so core's agent manager asks api.github.com for the latest service-go-grpc release and downloads it, four unauthenticated calls per scaffold, eight scaffolds per run, from a runner IP whose 60 requests/hour are shared behind the hosted NAT. When that 403s the manager Debug-logs it and falls back to the test's fresh CODEFLY_HOME, whose agents directory does not exist, and the CLI prints the innermost cause: "no such file or directory". Three of today's thirteen runs failed that way (two of them the v0.1.235 release pull requests #1297 and #1298), as did runs on 10-30 and 11-02; the same tree passes on re-run. core reads GITHUB_TOKEN or GH_TOKEN for exactly this lookup (agents/manager/manager.go newGitHubReleaseClient), and container-recovery-native.yml already passes github.token to its steps, so the test step gets the same. The workflow's read permission is enough for public releases. Follow-ups, not this change: the resolver should return both causes instead of Debug-logging the GitHub one, and actionableRoot should keep the path of an fs.PathError, so the next occurrence names itself. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Each cmd/generate fixture runs
codefly add service --agent go-grpcwith noversion, so core's agent manager asks api.github.com for the latest
service-go-grpc release and downloads it, four unauthenticated calls per
scaffold, eight scaffolds per run, from a runner IP whose 60 requests/hour
are shared behind the hosted NAT. When that 403s the manager Debug-logs it
and falls back to the test's fresh CODEFLY_HOME, whose agents directory does
not exist, and the CLI prints the innermost cause: "no such file or
directory". Three of today's thirteen runs failed that way (two of them the
v0.1.235 release pull requests #1297 and #1298), as did runs on 10-30 and
11-02; the same tree passes on re-run.
core reads GITHUB_TOKEN or GH_TOKEN for exactly this lookup
(agents/manager/manager.go newGitHubReleaseClient), and
container-recovery-native.yml already passes github.token to its steps, so
the test step gets the same. The workflow's read permission is enough for
public releases.
Follow-ups, not this change: the resolver should return both causes instead
of Debug-logging the GitHub one, and actionableRoot should keep the path of
an fs.PathError, so the next occurrence names itself.
Classification
Fix at the owner: the credential is the one core's agent manager defines as the only input it reads for this lookup; nothing is retried, skipped or pinned to make the gate quiet. Reused: the same
github.tokenhand-offcontainer-recovery-native.ymlalready makes.Tests
None can be added here: the failure is an unauthenticated rate limit on hosted runners. Evidence is in the two failed shard logs (runs 41785300107 job 126425995637 and 41785991159) and the code path above. The workflow runs on this pull request; a green run is consistent with, not proof of, the fix.
Not verified
The GitHub error text itself (403 vs transient) — the per-test log that holds it is deleted by
scripts/test-generate-isolated.sh's trap and not retained in the evidence artifact.🤖 Generated with Claude Code