fix(#6196): authenticate lookupAppID with env token when available - #6199
Conversation
lookupAppID always made unauthenticated GET /apps/{slug} requests,
subject to GitHub's shared 60-requests/hour IP-based rate limit.
On GitHub Actions runners that share IP ranges, this limit is
routinely exhausted across concurrent CI jobs, causing the
behaviour test suite's mint deploy PEM bootstrap to fail
intermittently.
Check GH_TOKEN then GITHUB_TOKEN from the environment (matching the
resolution order used elsewhere in the CLI). When a token is
present, attach it as a Bearer header, lifting the limit to
5,000/hour. When no token is set, the request remains
unauthenticated, preserving the local/first-time bootstrap path.
The rate-limit error message is updated to suggest setting a token
when the request was unauthenticated, and to omit that guidance
when a token was already present.
Closes #6196
|
🤖 Finished Review · ✅ Success · Started 6:06 PM UTC · Completed 6:19 PM UTC Commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ReviewFindingsLow
Labels: PR modifies internal/cli/mint.go — the mint CLI component |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note: The following inline comments could not be posted on the diff (GitHub returned 422) and are included here instead:
internal/cli/mint.go:191: [low] edge-case
When a token is present, HTTP 403 is assumed to mean rate limiting, but GitHub also returns 403 for abuse-detection triggers, IP blocks, or insufficient token scopes. The pre-existing code had the same ambiguity; this PR improves the situation by differentiating error messages.
Suggested fix: Consider inspecting the X-RateLimit-Remaining response header to distinguish rate-limit 403 from other 403 causes.
internal/cli/mint_test.go(file-level): Line 2305 · [low] test-adequacy
TestLookupAppID_EscapesSlug, TestLookupAppID_NotFound, and TestLookupAppID_ServerError do not clear GH_TOKEN/GITHUB_TOKEN via t.Setenv, unlike the other lookupAppID tests updated in this PR.
Suggested fix: Add t.Setenv("GH_TOKEN", "") and t.Setenv("GITHUB_TOKEN", "") to these three tests for consistency.
internal/cli/mint.go:171: [low] code-reuse
The token-resolution pattern is inlined rather than shared with resolveToken() in admin.go, but resolveToken() has different semantics (requires a token, includes gh-auth fallback). With only two true duplicates, a shared helper would be premature.
fullsend-ai-review
Bot
added
ready-for-merge
|
🤖 Finished Retro · ✅ Success · Started 10:19 PM UTC · Completed 10:35 PM UTC Commit: |
Retro: PR #6199 — authenticate lookupAppID with env tokenWorkflow quality: Excellent. This was a clean end-to-end agent workflow with zero rework cycles. Issue #6196 (flaky behaviour tests hitting GitHub's unauthenticated 60/hr rate limit) was filed at 17:46 UTC. The triage agent classified it in 4 minutes, the code agent produced a correct single-commit fix with 86.7% patch coverage in 15 minutes, the review agent approved with 3 low-severity findings in 14 minutes, and the human reviewer (ralphbean) approved without comments ~3 hours later. The PR merged at 22:17 UTC. One issue delayed merge by ~48 minutes: the first merge queue attempt was ejected when the Existing issues with new supporting evidence
Autonomy readinessThe review agent's findings fully covered the human review — ralphbean approved without additional comments. This adds another data point to the 81 existing autonomy-readiness tracking issues (nearest precedents: #5353, #3021). For this class of change (small, well-scoped Go bug fix with comprehensive tests, single package, bot-authored), the review agent's approval was sufficient. No new tracking issue needed — the evidence base is well-established. Proposals filed
|
1 participant
Summary
lookupAppIDininternal/cli/mint.goalways made unauthenticatedGET /apps/{slug}requests, sharing GitHub's 60-requests/hour IP-based rate limit with all other unauthenticated calls from the same runner IP. In CI, where Actions runners share IP ranges, this limit is routinely exhausted across concurrent jobs, causing intermittent failures in the behaviour test suite'smint deploy --pem-dirbootstrap step.This PR makes
lookupAppIDcheck forGH_TOKENthenGITHUB_TOKENin the environment (matching the resolution order used byresolveToken()and other CLI commands). When a token is present, the request is authenticated at 5,000 requests/hour. When no token is set, the request remains unauthenticated, preserving the local/first-time bootstrap experience.Changes
lookupAppIDto readGH_TOKEN/GITHUB_TOKENfrom the environment and set anAuthorization: Bearerheader when availableTesting
TestLookupAppID_*tests passgo vetpassesTestStartFetchService_*andTestPostScriptEnv_*confirmed onmain— not caused by this changeCloses #6196
Post-script verification
agent/6196-mint-lookup-auth-token)7cf869c963af69d3edd39dff53600155cb2e5244..HEAD)