ci: skip Vale binary download in the build job - #671
Merged
Merged
Conversation
@vvago/vale 3.21.0 downloads its binary from the unauthenticated GitHub REST API (api.github.com/.../releases/assets/<id>), which is limited to 60 requests per hour per IP. Shared macOS runner IPs exhaust that, so the postinstall fails with a 403. 3.17.1 used the releases/download URL, which is not subject to that limit. The build job never runs Vale: Vale's postinstall is the only script allow-scripts enables, and linting happens in the style-check job via vale-action. Drop the allow-scripts step so the build job no longer depends on that download.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
buildjob has started failing intermittently during dependency install:#667 bumped
@vvago/valefrom 3.17.1 to 3.21.0, and the new version changed where it downloads the Vale binary from:github.com/errata-ai/vale/releases/download/...api.github.com/repos/vale-cli/vale/releases/assets/<id>x-ratelimit-limit: 60, per IP)The package sends no token, and the
buildjob runs onmacos-latest, whose runners share IPs. When other jobs on the same IP have used up the 60 requests for that hour, our download gets a 403.What changed
Removed
npx --no allow-scriptsfrom the install step in.github/actions/astro_site/action.yaml.The
buildjob doesn't need that step. Vale's postinstall is the only script enabled in thelavamoat.allowScriptsconfig (everything else isfalse, and.npmrcsetsignore-scripts=true), so the step only downloaded a Vale binary, and nothing informat:checkorbuilduses it. Vale linting already runs in thestyle-checkjob viavale-action, which installs Vale on its own.The local
npm run lint:contentworkflow is unchanged: developers still runnpx allow-scriptsafternpm cito get the binary.Verification
In a clean checkout of
mainwith this change:npm ci(no Vale binary installed), thennpm run format:checkandastro buildboth pass, and all internal links are valid. This PR's own CI run is the end-to-end check.