fix(ci): authenticate uvr's GitHub resolution in the index workflows #204

Merged

pat-s merged 1 commit from fix/github-pat-for-uvr-resolution into main

2026-09-05 15:59:17 +00:00

pat-s commented

2026-09-05 13:59:49 +00:00

Owner

Why

The post-backfill re-index (12257) reported failure. Five slots could not write their indexes:

WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden);
     falling back to registry resolution
! Attempt 1/3 to update PACKAGES failed (unused argument (built = built)). Retrying in 5s...
Error: Failed to update PACKAGES after 3 attempts.
       Last error: unused argument (built = built)

uvr resolves bincraft's dependencies through the GitHub API, including the pat-s/cranlike@s3 fork. Unauthenticated, that is rate limited. uvr does not fail on the 403 — it warns and falls back to the registry copy of cranlike, which has no built parameter, so update_PACKAGES(built = ...) dies three retries later.

Affected: alpine323, rhel8, rhel9, rhel10, noble. The remaining 13 slots resolved the fork fine and indexed correctly, which is what makes this insidious: the same pipeline passes or fails on identical input depending on the rate-limit window.

build-all-versions.yaml and rebuild-abi-gap.yaml already pass GITHUB_PAT, which is why they were never affected.

What changed

Adds the GITHUB_PAT secret to reindex.yaml, weekly-rebuild-reindex.yaml and backfill-flat-safety.yaml, with a comment recording why its absence is quiet rather than loud.

crow lint passes on all three.

Context

The re-index itself did what it was meant to. Drops per per-minor index fell from ~1800-2200 to:

4.4: avg 129    4.5: avg 172    4.6: avg 145

so the per-object safety verdicts recovered roughly 93% of the coverage while still dropping every object that genuinely cannot load. This PR is about the five slots that never got to apply it.

## Why The post-backfill re-index (12257) reported failure. Five slots could not write their indexes: ``` WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden); falling back to registry resolution ! Attempt 1/3 to update PACKAGES failed (unused argument (built = built)). Retrying in 5s... Error: Failed to update PACKAGES after 3 attempts. Last error: unused argument (built = built) ``` uvr resolves bincraft's dependencies through the GitHub API, including the `pat-s/cranlike@s3` fork. Unauthenticated, that is rate limited. uvr does not fail on the 403 — it **warns and falls back to the registry copy of cranlike**, which has no `built` parameter, so `update_PACKAGES(built = ...)` dies three retries later. Affected: alpine323, rhel8, rhel9, rhel10, noble. The remaining 13 slots resolved the fork fine and indexed correctly, which is what makes this insidious: the same pipeline passes or fails on identical input depending on the rate-limit window. `build-all-versions.yaml` and `rebuild-abi-gap.yaml` already pass `GITHUB_PAT`, which is why they were never affected. ## What changed Adds the `GITHUB_PAT` secret to `reindex.yaml`, `weekly-rebuild-reindex.yaml` and `backfill-flat-safety.yaml`, with a comment recording why its absence is quiet rather than loud. `crow lint` passes on all three. ## Context The re-index itself did what it was meant to. Drops per per-minor index fell from ~1800-2200 to: ``` 4.4: avg 129 4.5: avg 172 4.6: avg 145 ``` so the per-object safety verdicts recovered roughly 93% of the coverage while still dropping every object that genuinely cannot load. This PR is about the five slots that never got to apply it.

pat-s added 1 commit

2026-09-05 13:59:49 +00:00

fix(ci): authenticate uvr's GitHub resolution in the index workflows 1cf473acf8

uvr resolves bincraft's dependencies through the GitHub API, among them the
pat-s/cranlike@s3 fork. Unauthenticated that is rate limited, and the failure is
quiet:

  WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden);
       falling back to registry resolution
  Error: Failed to update PACKAGES after 3 attempts.
         Last error: unused argument (built = built)

uvr warns, falls back to the registry copy of cranlike, and the index write then
dies because upstream cranlike has no `built` parameter. Five slots failed to
re-index that way -- alpine323, rhel8, rhel9, rhel10 and noble -- while the rest
of the run reported success.

It is intermittent by nature, since it depends on the rate-limit window, so the
same pipeline can pass and fail on identical input.

build-all-versions.yaml and rebuild-abi-gap.yaml already pass GITHUB_PAT, which
is why they resolve the fork reliably and these did not.

pat-s merged commit f3984f337d into main

2026-09-05 15:59:17 +00:00

pat-s deleted branch fix/github-pat-for-uvr-resolution

2026-09-05 15:59:17 +00:00

pat-s referenced this pull request from a commit

2026-09-05 15:59:18 +00:00

fix(ci): authenticate uvr's GitHub resolution in the index workflows (#204)