integrations / integrations/terraform-provider-github

[BUG]: Provider stalls for hours on unauthenticated refresh instead of failing fast

Open
#3,562 3 comments 2 reactions 0 assignees View on GitHub
Status: Triage Type: Bug
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Expected Behavior

When the provider has no token and is talking to `api.github.com`, an operation that can't
succeed anonymously should fail fast with a clear "authentication required" error.

### Actual Behavior

With an empty token the provider silently enters anonymous mode and proceeds. On a plan/refresh
over an org with many repositories it can stall for hours before failing.

I believe this is due to the anonymous primary rate limit (60 requests/hour/IP) combined with
`RateLimitTransport`'s sleep-until-reset behavior https://github.com/integrations/terraform-provider-github/blob/add2157906efe6ce657d6fda681635bf84336021/github/transport.go#L105-L111:

Reported by a user of the downstream Pulumi provider in https://github.com/pulumi/pulumi-github/issues/1242.

### Terraform Version

Provider v6.14.0

### GitHub Installation Type

- [x] GitHub.com (Free, Pro, or Team)
- [ ] GitHub Enterprise Server (on-premises)
- [ ] GitHub Enterprise Cloud with Personal Accounts (github.com)
- [ ] GitHub Enterprise Cloud with Managed Users/EMU (github.com)
- [ ] GitHub Enterprise Cloud with Data Residency (*.ghe.com)
- [ ] I don't know

### Affected Resource(s)

- `github_repository`
- `github_repository_vulnerability_alerts`
- Any anonymous read that trips the 60/hour anonymous rate limit

### Terraform Configuration Files

```hcl
provider "github" {} # no token in the environment

resource "github_repository" "example" {
name = "example"
}
```

### Steps to Reproduce

1. Manage several `github_repository` resources.
2. Run `terraform plan` with no `GITHUB_TOKEN`/`token` set.
3. Observe the run sleep for ~1 hour at a time and take hours to fail, rather than erroring
immediately on the unauthenticated response.

### Debug Output

```shell

```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Research direction

Inspect github/transport.go around the RateLimitTransport sleep-until-reset behavior, then reproduce with an unset GITHUB_TOKEN using the repository configuration described in the issue. Trace the unauthenticated response and define completion as a fast, clear authentication-required failure instead of hour-long stalls during plan or refresh.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.