fix: Use shared contract-tests action to avoid GitHub API rate limiting#94
fix: Use shared contract-tests action to avoid GitHub API rate limiting#94devin-ai-integration[bot] wants to merge 7 commits intomainfrom
Conversation
The contract test downloader script resolves partial version strings (like 'v2') by calling the GitHub API without authentication, which is subject to a 60 req/hour rate limit per IP. GitHub Actions shared runners frequently exhaust this limit, causing the version resolution to fail with 'Unable to find a release matching v2'. Using the full version string 'v2.31.0' makes the downloader skip the API call entirely since it recognizes a complete version string. Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
When GITHUB_TOKEN is available (e.g. in CI), use it to authenticate the GitHub API call that resolves the contract test version. This avoids rate limiting on shared GitHub Actions runner IPs. The version is resolved before invoking the downloader script, so the script receives a full version string and skips its own unauthenticated API call. Falls back to the existing behavior (VERSION=v2) when no token is available. Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
…download Replace the inline 'make contract-tests' call with the shared launchdarkly/gh-actions/actions/contract-tests action, which handles authenticated GitHub API calls to avoid rate limiting on shared CI runner IPs. The Makefile is reverted to its original state for local dev use. Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
devin-ai-integration
Bot
changed the title
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
| run: make start-contract-test-service-bg | ||
|
|
||
| - name: Run contract tests | ||
| uses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.3.0 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
To resolve this comment:
✨ Commit Assistant fix suggestion
| uses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.3.0 | |
| uses: launchdarkly/gh-actions/actions/contract-tests@31bfa9142fd9d497eac1b1b9e179b2b1fda0d8d9 # contract-tests-v1.3.0 |
View step-by-step instructions
- Change the value after
@inuses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.3.0to the full commit SHA for thecontract-tests-v1.3.0release, such as@a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0(use the actual 40-character SHA from the release/tag). - Optionally, add a comment after the SHA indicating which version it corresponds to, for example:
# contract-tests-v1.3.0.
Pinning to a commit SHA ensures that your workflow uses exactly the same code every time and protects against malicious changes in third-party GitHub actions.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
We own these github actions so I don't think this is a big concern.
There was a problem hiding this comment.
Agreed — since it's an internal action, pinning to the tag should be fine. I'll leave it as-is.
The shared contract-tests action defaults branch to 'v2', which works for sdk-test-harness but not sse-contract-tests (which uses 'main'). Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
| with: | ||
| repo: sse-contract-tests | ||
| branch: main | ||
| branch: main |
There was a problem hiding this comment.
Duplicate YAML key branch in action config
Medium Severity
The branch key appears twice (lines 88 and 89) in the with block for the contract tests step. Duplicate keys in YAML have undefined behavior per the YAML spec — most parsers silently use the last value, but some may error. This was acknowledged in the PR discussion as a duplication that needs to be fixed; one of the two branch: main entries needs to be removed.
There was a problem hiding this comment.
This was already fixed in commit b63cae1 — the duplicate branch key was a transient issue from the previous commit that has been resolved. The latest commit has only one branch: main entry.
GitHub's merge commit was duplicating the 'branch' key due to incremental commits modifying the same lines. Reordering the inputs ensures a clean merge diff. Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
Co-Authored-By: rlamb@launchdarkly.com <rlamb@launchdarkly.com>
1 participant
Requirements
Related issues
Fixes intermittent CI failure in the
macos-buildjob: https://github.com/launchdarkly/swift-eventsource/actions/runs/22674124370/job/66058304181Describe the solution you've provided
The contract test step was failing with
Unable to find a release matching 'v2'. The root cause is that the downloader script resolves partial version strings (likev2) by calling the GitHub releases API without authentication, which is subject to a 60 req/hour rate limit per IP. GitHub Actions shared runners frequently exhaust this limit.This PR replaces the
make contract-testscall in the CI action with the sharedlaunchdarkly/gh-actions/actions/contract-testsaction (@contract-tests-v1.3.0), which handles authenticated API calls via thetokeninput. The contract test step is split into three separate steps:make build-contract-tests)make start-contract-test-service-bg)token: ${{ inputs.token }}The Makefile is left unchanged for local development use.
enable_persistence_testsdefaults totrue— verify this is acceptable for SSE contract tests (the originalmakeinvocation did not pass this flag)contract-tests-v1.3.0is the appropriate version to pin toDescribe alternatives you've considered
v2.31.0): Simpler but requires manual updates whenever a new contract test version is released.Additional context
Note
Low Risk
Low risk since changes are confined to CI wiring, but contract-test execution may break if the new shared action inputs/flags differ from the prior
make contract-testsbehavior or if the background service startup timing is off.Overview
Switches the CI composite action from a single
make contract-testsinvocation to a 3-step flow: build the contract test service, start it in the background, then run the harness vialaunchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.3.0using the providedtokenfor authenticated GitHub API calls.Also passes explicit action parameters (repo/branch/port, debug logging, and skipped test patterns) to standardize contract-test runs in CI.
Written by Cursor Bugbot for commit 9240504. This will update automatically on new commits. Configure here.