integrations / integrations/terraform-provider-github
[BUG]: Provider stalls for hours on unauthenticated refresh instead of failing fast
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 8
Description
### Expected Behavior
When the provider has no token and is talking to `api.github.com`, an operation that can't
succeed anonymously should fail fast with a clear "authentication required" error.
### Actual Behavior
With an empty token the provider silently enters anonymous mode and proceeds. On a plan/refresh
over an org with many repositories it can stall for hours before failing.
I believe this is due to the anonymous primary rate limit (60 requests/hour/IP) combined with
`RateLimitTransport`'s sleep-until-reset behavior https://github.com/integrations/terraform-provider-github/blob/add2157906efe6ce657d6fda681635bf84336021/github/transport.go#L105-L111:
Reported by a user of the downstream Pulumi provider in https://github.com/pulumi/pulumi-github/issues/1242.
### Terraform Version
Provider v6.14.0
### GitHub Installation Type
- [x] GitHub.com (Free, Pro, or Team)
- [ ] GitHub Enterprise Server (on-premises)
- [ ] GitHub Enterprise Cloud with Personal Accounts (github.com)
- [ ] GitHub Enterprise Cloud with Managed Users/EMU (github.com)
- [ ] GitHub Enterprise Cloud with Data Residency (*.ghe.com)
- [ ] I don't know
### Affected Resource(s)
- `github_repository`
- `github_repository_vulnerability_alerts`
- Any anonymous read that trips the 60/hour anonymous rate limit
### Terraform Configuration Files
```hcl
provider "github" {} # no token in the environment
resource "github_repository" "example" {
name = "example"
}
```
### Steps to Reproduce
1. Manage several `github_repository` resources.
2. Run `terraform plan` with no `GITHUB_TOKEN`/`token` set.
3. Observe the run sleep for ~1 hour at a time and take hours to fail, rather than erroring
immediately on the unauthenticated response.
### Debug Output
```shell
```
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Research direction
Inspect github/transport.go around the RateLimitTransport sleep-until-reset behavior, then reproduce with an unset GITHUB_TOKEN using the repository configuration described in the issue. Trace the unauthenticated response and define completion as a fast, clear authentication-required failure instead of hour-long stalls during plan or refresh.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100