API rate limit exceeded

[psteinroe]

Bug report

Describe the bug

We get this error pretty regularly:

API rate limit exceeded for xxxx. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)

To Reproduce

run the action a few times in a row

Expected behavior

should always work

Additional context

Found this issue, the go installation seems to be an issue:
actions/setup-go#16

[floitsch]

Could be the call to the Github API: https://github.com/supabase/setup-cli/blob/main/src/utils.ts#L48

I have never seen any API rate limit before I switched to 'latest'. I will switch back to a fixed version.

[TomasHubelbauer]

I think one solution would be to load the GitHub Actions workflow integration token from the action context (I am not sure this is possible to do transparently) or to expose an action input for the consumer to pass their ${{github.token}} explicitly. The GitHub public API rate limit is really low so if the action is going to be making GitHub API calls, this seems like something that would be happening a lot with the public rate limit. The integration PAT rate limit is much higher.

If the team is interested in this as a solution I would be available to take a stab at the implementation.

[sweatybridge]

We do have token authentication implemented https://github.com/supabase/setup-cli/blob/main/src/utils.ts#L37. Could you try passing this env var explicitly to the action?

      - uses: supabase/setup-cli@v1
        with:
          version: latest
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

I will update the readme accordingly if it works.

[TomasHubelbauer]

I'll do that and report back in a week or so, this doesn't always happen for us so we'll need to run a trial and see if the issue comes back with this added or not.

[TomasHubelbauer]

BTW I don't think GitHub Actions publish an environment variable named GH_TOKEN or even publish the integration PAT as an environment variable at all, check this out:
https://docs.github.com/en/actions/learn-github-actions/environment-variables

As far as I can see the only way to get at the integration PAT is to read ${{secrets.GITHUB_TOKEN}} in the workflow or as an action, have it be passed to you:
https://docs.github.com/en/actions/security-guides/automatic-token-authentication

So unless I am mistaken I worry that for the supabase-cli GitHub Actions action to be able to use the GitHub API pretty much all consumers will have to pass the PAT lest they run into rate limit issues.

[sweatybridge]

So unless I am mistaken I worry that for the supabase-cli GitHub Actions action to be able to use the GitHub API pretty much all consumers will have to pass the PAT lest they run into rate limit issues.

I think you are right. Another way to make this work transparently is to rely on github release's url redirect. For example, https://github.com/supabase/cli/releases/latest/download/supabase_1.27.10_checksums.txt redirects to https://github.com/supabase/cli/releases/download/v1.27.10/supabase_1.27.10_checksums.txt

We will need to remove the version string from the published archive name. supabase/cli#755

[TomasHubelbauer]

Just FYI looks like this change completely solved the issue on our end.
I have not seen any problems in the last week's worth of runs.