https://github.com/{org}/{repo}/releases/latest stopped returning JSON breaking electron-updater

[p2004a]

Select Topic Area

Bug

Body

As of 2023-01-28 22:55 UTC GitHub seems to stopped returning JSON when https://github.com/{org}/{repo}/releases/latest is called with Accept: application/json which seems to broke electron-updater package: electron-userland/electron-builder#7398.

Could this change in behavior be rolled back?

[thestuartcarson]

Select Topic Area

Bug

Body

As of 2023-01-28 22:55 UTC GitHub seems to stopped returning JSON when https://github.com/{org}/{repo}/releases/latest is called with Accept: application/json which seems to broke electron-updater package: electron-userland/electron-builder#7398.

Could this change in behavior be rolled back?

Hope this gets fixed as its causing issues in other places
dragoonDorise/EmuDeck#604

[iffy]

This is breaking my app, too. I'm getting a flood of bug reports from users. Please revert.

[iffy]

I've filed a support ticket through my paid account.

[iffy]

Whelp, I thought it was a paid plan. I pay GitHub money... but it's a free plan according to support. I still filed a ticket, but I don't know what kind of priority it will receive.

[cw-alexcroteau]

If it can help I filed an Enterprise ticket because this affects some critical pipelines. We'll see...

[iffy]

Got response on ticket:

Thanks for the information. Our Engineers are investigating. I'll update you when I have more.

[dragoonDorise]

thanks @iffy! Please let us know what they say

[cw-alexcroteau]

I don't want to pollute this thread too much, but same issue with Anchore's Syft and Grype installers, if it can help making noise.

anchore/syft#1523
anchore/grype#1102

[jdolitsky]

For those having issues with Grype install, please see the following work arounds:

• Fix for broken install script anchore/grype#1104
• Temporary workaround for broken action anchore/scan-action#212

[lutzroeder]

~/Projects/netron: /Applications/Netron.app/Contents/MacOS/Netron 
Checking for update
Error: Error: Cannot parse releases feed: Error: Unable to find latest version on GitHub (https://github.com/lutzroeder/netron/releases/latest), please ensure a production release exists: SyntaxError: Unexpected token '<', 

[jdolitsky]

A workaround for now is to hit the API endpoint instead:

https://api.github.com/repos/{org}/{repo}/releases/latest

However, this will result in a 403 if called from actions, so need to pass along a valid GitHub token in the Authorization header. For example:

curl -vL -H "Accept: application/json" -H "Authorization: Bearer ${{ github.token }}" \
  https://api.github.com/repos/{org}/{repo}/releases/latest

[Fuzzwah]

GitHub Engineers have pushed a change that has reverted releases/latest so it's once again respecting the Accept: application/json option, and once again returns json.

As @jdolitsky mentions, the longer term change should be for electron apps to use the Rest API.

[p2004a]

As @jdolitsky mentions, the longer term change should be for electron apps to use the Rest API.

This is actually a questions here I believe, (electron-userland/electron-builder#7398 (comment)), was this undocumented behavior that electron updater incorrectly depends on, or it was documented and it can be still used. What should be the longer term resolution.

[kzantow]

As I understand it, the problem with the API currently is that it requires a GitHub token (and not a workflow token but like a PAT), even for public repositories which breaks a lot of functionality that requires unauthenticated access

[jdolitsky]

For what it is worth, I was able to use the API call from within GitHub Actions (workflow token / ${{ github.token }}).

If you wanted to use the same thing locally, then yes you might need a PAT. But I think it likely comes down to rate-limiting/blocking your IP address. The API endpoints on public repos seems to work for bit unauthenticated.