Pin gdam-actions to v0.1.2 - #2
Merged
Merged
Conversation
gdam-actions has stopped force-moving a single v0 tag -- releases are immutable v0.1.x now -- so @v0 is frozen at the commit before that change and will never see another fix. The fix that matters here is in install: resolving "latest" called the GitHub API unauthenticated, which is capped at 60 requests an hour per IP address, and CI runners share addresses. macOS runners share them heavily enough that the call returned 403 several times an hour and failed the install. As of v0.1.2 it authenticates with the workflow own token by default, scoping the limit per repository against one lookup per run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps this repo onto gdam-actions v0.1.2.
Why now
gdam-actionsused to force-move a singlev0tag. It has stopped: releases are now immutablev0.1.x, andv0is frozen at the commit before that change. Staying on@v0means never receiving another fix, silently.What this actually fixes
installresolveslatestthrough the GitHub API, and that call was unauthenticated — capped at 60 requests an hour per IP address, which CI runners share. macOS runners share them heavily enough that it returned 403 several times an hour:That failed installs intermittently here and in every other repo using the action. As of
v0.1.2the call is authenticated with the workflow's own token by default, so the limit is scoped per repository (1,000/hour) against exactly one lookup per run. No token needs to be passed — the action defaults to${{ github.token }}.Scope
Ref-only: the
uses:line and nothing else.