aws-amplify / aws-amplify/amplify-hosting

Make Amplify GitHub app more robust with the current usage of installation access tokens

Open
#4,080 7 comments 32 reactions 0 assignees View on GitHub
feature-request
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Before opening, please confirm:

- [x] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [x] I have removed any sensitive information from my code snippets and submission.

### Amplify Hosting feature

Git providers, Access control

### Is your feature request related to a problem? Please describe:

We are experiencing intermittent authentication failures when AWS Amplify attempts to clone our repository using the AWS Amplify GitHub App. The builds fail with: remote: Repository not found. CustomerError: Unable to clone repository due to user error code: 128

This issue is transient; a failed build is often followed by a successful build minutes later with no configuration changes.

**After opening an AWS support case the conclusion was:**
Token Generation: Amplify successfully generates a new installation access token from the GitHub App for every build. [docs](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app)

**After opening a GitHub support case the conclusion was:**
When you create a token, this needs to be replicated to all of our edge cache sites to be usable on them. As we've been expanding our network of edge caches to improve performance and support more users, we've seen more traffic served from edge caches than previously, which would explain why this is a new error. Our engineering teams are investigating options to return the current replication delay when creating a token, but this isn't generally available yet and I can't promise if or when it will be.

### Describe how you'd like this feature to work

GitHub's support recommendation:
I recommend waiting a few seconds after creating a new token, then implementing retry logic so if you receive an error, you retry once or twice after an increasing timeframe (I've seen three seconds initially, then retrying after ten work well for some customers – an additional retry at 30 seconds would catch the very rare case where the token wasn't yet replicated at ten seconds).

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files, tests, or entry points. Start by locating the Amplify GitHub App installation-token generation and repository-cloning flow, then trace how clone failures are handled. Done means transient token-replication failures are retried with increasing delays after token creation, as described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, github
Domain
authentication, ci-cd, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.