Unexpected HTTP response: 403 with v2

[gruebel]

we are getting permission denied errors on macos-latest runner when using the new v2 version.

Download action repository 'azure/setup-helm@v2.0' (SHA:a517f2ff6560563a369e16ca7c7d136b6164423f)

Run azure/setup-helm@v2.0
  with:
    version: latest
  env:
    pythonLocation: /Users/runner/hostedtoolcache/Python/3.8.12/x64
Error: Error: Unexpected HTTP response: 403

a failed run can be seen here https://github.com/bridgecrewio/checkov/runs/5008556832

[qpetraroia]

Hey @gruebel,

we are looking into it

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[gruebel]

@qpetraroia any update so far?

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[hairmare]

Has this been fixed in v2.1?

[OliverMKing]

This seems to be working in v2.1. I'm unsure why this error occurred because there's no clear difference between v2.0 and v2.1 that would impact this issue. I've tested on the GitHub runner.

Can you please provide steps to reproduce.

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[gruebel]

@OliverMKing sadly it still fails https://github.com/bridgecrewio/checkov/runs/6496731470?check_suite_focus=true

Current workflow steps

  integration-tests:
    strategy:
      fail-fast: true
      matrix:
        python: ["3.7", "3.8", "3.9", "3.10"]
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v3
        with:
          python-version: ${{ matrix.python }}
      - uses: actions/setup-node@v3
      - uses: azure/setup-helm@217bf70cbd2e930ba2e81ba7e1de2f7faecc42ba  # v2

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[OliverMKing]

@gruebel I attempted to reproduce it with your exact workflow. It still seems to be working correctly. Do you have any other information that we are missing?

https://github.com/OliverMKing/AKS-GitHub-Actions-Demo/actions/runs/2571044535

[gruebel]

hey @OliverMKing I don't what you did with v3, but now it works 😄

[gruebel]

It looked like it worked, but it doesn't work consistently. Sometimes yes and quite often no.

[OliverMKing]

The difference between v3 and v2 is just a Node16 upgrade. Are you using a self hosted runner maybe?

I'll attempt to reproduce on my repo by running a few times.

[OliverMKing]

Ideas:

• Add a retry

Really need to figure out exactly what is throwing the 403 though.

[gruebel]

@OliverMKing so I had an idea and enabled the debug logs to maybe give us some better idea, what could be wrong and it looks like there is a rate limit issue 😄

##[debug]Evaluating condition for step: 'Run azure/setup-helm@v3'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Run azure/setup-helm@v3
##[debug]Loading inputs
##[debug]Loading env
Run azure/setup-helm@v3
##[debug]Downloading https://api.github.com/repos/helm/helm/releases
##[debug]Downloading /Users/runner/work/_temp/3dce280f-d28a-40ae-b2dd-35924239ab12
##[debug]Failed to download from "https://api.github.com/repos/helm/helm/releases". Code(403) Message(rate limit exceeded)
Error: Error: Unexpected HTTP response: 403
##[debug]Node Action run completed with exit code 1
##[debug]Finishing: Run azure/setup-helm@v3

these are not self hosted ones, because we don't have our own macos runner.

[OliverMKing]

That is the exact issue. Not sure there's any great ways for getting around the github api rate limit. We can provide a clearer error message instead of throwing the 403.

To temporarily avoid this you can use a specific helm version instead of latest.

[gruebel]

makes sense, but why does it work with v1 better compared to v2/v3? And why is only the mac runner failing and not the others?

[OliverMKing]

v1 has a fallback to a "stable" version if it can't fetch the latest. Not sure that's the ideal situation but we could add an input with a fallback.

Unsure why only the mac runner would be failing. The GitHub API should be platform-agnostic.

[OliverMKing]

setup-helm/src/run.ts

Line 53 in 6e32762

const helmJSONPath: string = await toolCache.downloadTool(helmAllReleasesUrl)

The bug is here. We need to move this to inside the try catch.

[OliverMKing]

Second improvement is to swap from using the REST api to the GraphQL one. The GraphQL limit with this query is 5,000 per hour

{
  repository(name: "helm", owner: "helm") {
    releases(last: 100) {
      nodes {
        tagName
      }
    }
  }
}

versus only 1,000 per hour with the current REST.

[OliverMKing]

Created a release. v3.1 (and v3) will fix this issue.

Appreciate the help!

[gruebel]

@OliverMKing thanks for effort and fix 🥇 works as reliable as before.