From f565fac5b60b3d557c41af3533923319e92248b2 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Wed, 4 Nov 2026 01:41:52 -0500 Subject: [PATCH] ci(generate): hand the shards a GitHub token for the agent they scaffold Each cmd/generate fixture runs `codefly add service --agent go-grpc` with no version, so core's agent manager asks api.github.com for the latest service-go-grpc release and downloads it, four unauthenticated calls per scaffold, eight scaffolds per run, from a runner IP whose 60 requests/hour are shared behind the hosted NAT. When that 403s the manager Debug-logs it and falls back to the test's fresh CODEFLY_HOME, whose agents directory does not exist, and the CLI prints the innermost cause: "no such file or directory". Three of today's thirteen runs failed that way (two of them the v0.1.235 release pull requests #1297 and #1298), as did runs on 10-30 and 11-02; the same tree passes on re-run. core reads GITHUB_TOKEN or GH_TOKEN for exactly this lookup (agents/manager/manager.go newGitHubReleaseClient), and container-recovery-native.yml already passes github.token to its steps, so the test step gets the same. The workflow's read permission is enough for public releases. Follow-ups, not this change: the resolver should return both causes instead of Debug-logging the GitHub one, and actionableRoot should keep the path of an fs.PathError, so the next occurrence names itself. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/generate-qualification.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/generate-qualification.yml b/.github/workflows/generate-qualification.yml index 5feae773..c9cdc65e 100644 --- a/.github/workflows/generate-qualification.yml +++ b/.github/workflows/generate-qualification.yml @@ -101,6 +101,13 @@ jobs: "$RUNNER_TEMP/generate-bin/buf" --version echo "$RUNNER_TEMP/generate-bin" >> "$GITHUB_PATH" - name: Run tagged and qualification tests in isolated processes + # The scaffolded fixtures resolve and download the go-grpc agent at + # "latest" through api.github.com; core reads GITHUB_TOKEN/GH_TOKEN for + # that call and nothing else, and without one the lookup shares the + # runner NAT's 60 requests/hour, 403s, and falls back to an empty + # per-test CODEFLY_HOME ("no such file or directory"). + env: + GITHUB_TOKEN: ${{ github.token }} run: ./scripts/test-generate-isolated.sh "${{ matrix.shard }}" "${{ strategy.job-total }}" - name: Retain test output, timings and conformance receipts if: always()