CI - File could not be downloaded (HTTP/2 400) errors

[wiljanslofstra]

🏷️ Discussion Type

Bug

Body

Since this morning we've had the issue that many of our CI tasks fail because of 400 errors from codeload.github.com.
We're using Gitlab CI (so not GitHub Actions), and we're using Composer (PHP) to install packages in CI.

Example error:

Failed to download aws/aws-crt-php from dist: The "https://codeload.github.com/awslabs/aws-crt-php/legacy.zip/d71d9906c7bb63a28295447ba12e74723bd3730e" file could not be downloaded (HTTP/2 400 )
    Source fallback is disabled. Not trying alternative sources.
In CurlDownloader.php line 674:
                                                                               
  The "https://codeload.github.com/awslabs/aws-crt-php/legacy.zip/d71d9906c7b  
  b63a28295447ba12e74723bd3730e" file could not be downloaded (HTTP/2 400 ) 

On every run, it fails on another package, so it's not consistent and/or a deleted version of a package.

For example, when retried, it fails on another package:

Failed to download dompdf/php-font-lib from dist: The "https://codeload.github.com/dompdf/php-font-lib/legacy.zip/a6e9a688a2a80016ac080b97be73d3e10c444c9a" file could not be downloaded (HTTP/2 400 )
    Source fallback is disabled. Not trying alternative sources.
In CurlDownloader.php line 674:
                                                                               
  The "https://codeload.github.com/dompdf/php-font-lib/legacy.zip/a6e9a688a2a  
  80016ac080b97be73d3e10c444c9a" file could not be downloaded (HTTP/2 400 )  

When accessing the URLs directly, they work fine.

Sometimes after retrying a few times everything succeeds.

No issues on Github Status, and I can't find many mentions on social media of the issue. On X, I found one other person having the same issue: https://x.com/BjarnBronsveld/status/2070818383822483820

Is anyone else having this issue, and/or does someone know if there's some issue with the service?

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[wiljanslofstra]

Related issue on the Composer issues board: composer/composer#12958 & http://github.com/composer/composer/issues/12956
Although they're discussing a workaround for something that seems to be broken for a few hours (maybe days?).

[aryanbook]

Adding another data point. Same HTTP/2 400 from codeload.github.com on legacy.zip dist downloads, in AWS CodeBuild (region <us-east-1?>, not in a VPC, so shared NAT egress) building a Dockerfile that runs composer install --no-dev --prefer-dist over ~156 packages (Laravel 11 app). First seen around June 29, 2026, 07:32 AM UTC.

The failure lands on a different random package each run — across attempts I've seen ramsey/uuid, ramsey/collection, and getsentry/sentry-laravel fail independently, never the same one twice. Because Source fallback is disabled. Not trying alternative sources., a single failed dist download aborts the entire install with exit code 100.

I've ruled out the obvious local causes: fetching the exact failing legacy.zip URLs directly with curl returns 200, so the packages and repos are healthy. The error is 400, not 403 with rate-limit headers, so it isn't throttling. The pipeline is unchanged and has built cleanly hundreds of times — this started with no change on our end, which points squarely at the codeload edge.

Representative log:

34/156 [======>---------------------]  21%    Failed to download ramsey/collection from dist: The "https://codeload.github.com/ramsey/collection/legacy.zip/344572933ad0181accbf4ba763e85a0306a8c5e2" file could not be downloaded (HTTP/2 400 )
  Source fallback is disabled. Not trying alternative sources.
125/156 [======================>-----]  80%    Failed to download sentry/sentry-laravel from dist: The "https://codeload.github.com/getsentry/sentry-laravel/legacy.zip/b33b2e487b02db02d92988228f142d7fa2be2bfa" file could not be downloaded (HTTP/2 400 )
  Source fallback is disabled. Not trying alternative sources.

In CurlDownloader.php line 674:
  The "https://codeload.github.com/ramsey/collection/legacy.zip/344572933ad0181accbf4ba763e85a0306a8c5e2" file could not be downloaded (HTTP/2 400 )

PHP <8.2>. Happy to provide more timestamps/regions if it helps narrow the blast radius.

[martnst]

I notice this happening to our CI (GitHub Actions) the first time on Saturday 2026-06-27.

[EcolintDev]

 Failed to download <pkg> from dist: The "https://codeload.github.com/<owner>/<repo>/legacy.zip/<sha>" file could not be downloaded (HTTP/2 400)
  Source fallback is disabled. Not trying alternative sources.

With the same legacy.zip URL fetched

[v-ember]

Hi @wiljanslofstra , thanks for posting in GitHub Discussions!

The Repositories category is meant for questions related to repositories on GitHub. A repository contains all of your project's files and each file's revision history. I've gone ahead and moved this post to our Actions category, as this topic may be more relevant there and might help someone give you a nudge in the right direction. 😁

[wiljanslofstra]

Thank you! Didn't know which category I had to pick for this issue 😊

[o1y]

I managed to get it under control in my CI by setting COMPOSER_MAX_PARALLEL_HTTP=1. But it still fails occasionally, so I just added a dumb retry:

installed=0
for attempt in 1 2 3 4 5; do
    if COMPOSER_MAX_PARALLEL_HTTP=1 composer install --prefer-dist --no-progress --no-ansi --no-interaction; then
        installed=1
        break
    fi
    echo "composer install failed. retry ${attempt}/5 ..."
done
if [ "$installed" -ne 1 ]; then
    echo "composer install failed" >&2
    exit 1
fi