jfrog / jfrog/jfrog-cli

Update check at Github is rate limited

Open
#3,364 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
595
Forks
307
Avg merge
4d 17h
Merged PRs (30d)
17

Description

Describe the bug

During builds, the plugin apparently executes code over and over to check for the latest version. That may be fine for smaller installations, but in our case, we're hit by Github's rate limit as the plugin apparently does this check in an un-authenticated way?

A typical error message:

10:59:18 [Warn] failed while trying to check latest JFrog CLI version: received HTTP status Forbidden from Github, there is no GitHub token, please set github token to avoid anonymous calls rate limits: {"message":"API rate limit exceeded for X.X.X.X. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)","documentation_url":"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"}

I don't see a way to specify credentials - and anyway it would be pretty complicated for our setup: We run Github Enterprise and need to authenticate as a Github app. Tokens as a mean of validation are disabled in our setup.

Current behavior

See the above error log.

Reproduction steps

Run a build job using the plugin behind an IP that exceeds the Github rate limit.

Expected behavior

For this to work, the plugin needs to run this check as authenticated to Github - or at least provide authentication as an option.

JFrog CLI version

2.92.0

Operating system type and version

Various variants of Linux and Windows

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files, tests, or entry points; start by locating the build-time latest-version check and the GitHub request it makes. Determine how authentication is expected to work with GitHub Enterprise and GitHub Apps, then verify that builds no longer fail or repeatedly hit anonymous rate limits.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, go
Domain
authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.