fix(install): resolve the latest tag without the rate-limited GitHub API - #4
Merged
Conversation
Found by running the README's own one-liner from a container behind a shared exit IP: it died at its first step with "could not determine the latest release". api.github.com allows 60 unauthenticated requests an hour per IP, and a NAT, a VPN exit or a CI runner has usually spent that budget on someone else's behalf. install.sh now takes the tag from the redirect on /releases/latest, which is not rate limited, keeps the API as a fallback, and accepts BWG_VERSION to pin a version. `bwg update` still uses the API — it needs the asset list — but a 403 carrying x-ratelimit-remaining: 0 now says that the network's budget is spent and where to get the binary meanwhile, instead of "GitHub API returned 403", which reads as a broken install. Verified end to end: the installer fetches v0.2.0, checksums it, and `bwg version` prints 0.2.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by running the README's own install line, which is the point of
running it.
api.github.comallows 60 unauthenticated requests an hour per IP.Behind a NAT, a VPN exit, a corporate proxy or a CI runner, that budget
is routinely spent by someone else, and the front door fails with a
message that blames the release.
install.shnow resolves the tag from the redirect on/releases/latest(not rate limited), falls back to the API, andtakes
BWG_VERSION=v0.2.0to pin a version outright. The failuremessage now names both escape hatches.
bwg updatestill needs the API for the asset list, but a 403 withx-ratelimit-remaining: 0now says the network's budget is spent andpoints at the releases page, instead of "GitHub API returned 403".
Verification
Two tests cover the message: a rate-limited 403 must say so, and a
plain 403 must not claim to be one.
🤖 Generated with Claude Code