Uh oh!
There was an error while loading. Please reload this page.
ci: fix GitHub API 403 rate-limit by writing access-tokens to system nix.conf - #2884
Merged
Conversation
…nix.conf Nix resolves `github:` flake refs (e.g. the latest commit of nixpkgs-unstable) via the GitHub API. Anonymous requests are capped at 60/hr and were quickly exhausted by the parallel test suite, surfacing as `unable to download '.../commits/nixpkgs-unstable': HTTP error 403` and cascading test failures. The token was only provided via NIX_CONFIG and the user-level ~/.config/nix/nix.conf. Nix only honors `access-tokens` from those sources when the invoking user is trusted, and the daemon does not read user config at all. On Linux the system-wide /etc/nix/nix.conf never received the token, so GitHub calls went out unauthenticated. - test job: write access-tokens to /etc/nix/nix.conf on every platform (always trusted, read by client and daemon) and restart the daemon (systemctl on Linux, launchctl on macOS). - test-nix-versions job: pass access-tokens through the nix-installer extra-conf, which lands in /etc/nix/nix.conf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the CI workflow to reduce GitHub API 403s caused by anonymous rate limiting when Nix resolves github: flake references, by ensuring an authenticated token is available to both the Nix client and (where applicable) the Nix daemon.
Changes:
- Write
access-tokens = github.com=...to the system-wide/etc/nix/nix.conf(and restart the daemon) during the main CLI test job so daemon-backed fetches authenticate. - Add
access-tokensto theDeterminateSystems/nix-installer-actionextra-confin the Nix version matrix job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
- Redirect `sudo tee -a` to /dev/null so the access-tokens line isn't echoed into the Actions log. - On Linux, only restart nix-daemon when the unit exists and let a real restart failure fail the job instead of hiding it behind `|| true`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out from
mikeland73/fix-flaky-cicd-tests(4/5).Writes
access-tokens = github.com=...to the system-wide/etc/nix/nix.confon every platform (not just macOS) so that both the Nix client and the daemon authenticate to GitHub when resolvinggithub:flake refs. The system config is always trusted and read by both, whereas the user's~/.config/nix/nix.confis only honored for trusted users and is ignored by the daemon. Also addsaccess-tokensto thenix-installer-actionextra-conf.Avoids the anonymous 60-req/hr API limit surfacing as
HTTP error 403under the parallel test suite.🤖 Generated with Claude Code