fix(github): fail fast on a dead GH_TOKEN instead of hanging the mirror #50

Merged

ryangr0 merged 1 commit from fix/github-distribute-fail-fast into main 2026-08-25 05:16:58 +00:00

Conversation 0 Commits 1 Files changed 1 +77 -4

ryangr0 commented 2026-08-25 05:16:29 +00:00

Owner

Copy link

Both GitHub-track jobs in webgrip/ploeg run 170 (v0.2.0-rc.20) died from one invalid GH_TOKEN, and only one of them said so.

job	symptom
Distribute image (GHCR)	docker login ghcr.io -> denied: denied, exit 1
Mirror & Release (GitHub)	no failure at all — the push step logged zero lines and sat running for 20+ minutes, holding a runner slot with the caller's flattened job stuck on blocked

Why the messages are so bad

GHCR's token endpoint returns {"code":"DENIED","message":"denied"} for a non-empty token it does not accept, versus the longer "requested access to the resource is denied" for an empty password — so denied: denied reads like a package-permission problem rather than a dead secret. Probed directly against ghcr.io to confirm.

The mirror is worse: github.com 401s the push, git falls back to the credential subsystem, finds no helper, and blocks on a terminal prompt that never arrives. Nothing times out.

Changes

• Both jobs preflight GH_TOKEN against api.github.com/user before doing any work, and echo the token's scopes. Verified against a junk token: named failure in ~1s instead of the opaque one.
• The GHCR job additionally hard-fails without write:packages — fine-grained PATs can never carry it, which is the likeliest shape of the bad secret.
• The push runs with GIT_TERMINAL_PROMPT=0, empty credential.helper / core.askPass, and a 5m timeout backstop, so no auth or egress failure can park a runner again.

This makes the failure legible; it does not make the jobs pass. webgrip/ploeg's GHCR_TOKEN still needs rotating to a classic PAT with repo + write:packages.

Both GitHub-track jobs in `webgrip/ploeg` run 170 (v0.2.0-rc.20) died from one invalid `GH_TOKEN`, and only one of them said so. | job | symptom | |---|---| | `Distribute image (GHCR)` | `docker login ghcr.io` -> `denied: denied`, exit 1 | | `Mirror & Release (GitHub)` | no failure at all — the push step logged zero lines and sat `running` for 20+ minutes, holding a runner slot with the caller's flattened job stuck on `blocked` | **Why the messages are so bad** GHCR's token endpoint returns `{"code":"DENIED","message":"denied"}` for a non-empty token it does not accept, versus the longer `"requested access to the resource is denied"` for an empty password — so `denied: denied` reads like a package-permission problem rather than a dead secret. Probed directly against ghcr.io to confirm. The mirror is worse: github.com 401s the push, git falls back to the credential subsystem, finds no helper, and blocks on a terminal prompt that never arrives. Nothing times out. **Changes** - Both jobs preflight `GH_TOKEN` against `api.github.com/user` before doing any work, and echo the token's scopes. Verified against a junk token: named failure in ~1s instead of the opaque one. - The GHCR job additionally hard-fails without `write:packages` — fine-grained PATs can never carry it, which is the likeliest shape of the bad secret. - The push runs with `GIT_TERMINAL_PROMPT=0`, empty `credential.helper` / `core.askPass`, and a 5m `timeout` backstop, so no auth or egress failure can park a runner again. This makes the failure legible; it does not make the jobs pass. `webgrip/ploeg`'s `GHCR_TOKEN` still needs rotating to a classic PAT with `repo` + `write:packages`.

ryangr0 added 1 commit 2026-08-25 05:16:29 +00:00

fix(github): fail fast on a dead GH_TOKEN instead of hanging the mirror ... 2e2d49eda6

ploeg run 170 lost both GitHub-track jobs to one invalid GH_TOKEN, and only
one of them said so:

- `Distribute image (GHCR)` died at `docker login ghcr.io` with the opaque
  `denied: denied`. GHCR's token endpoint returns exactly that for a token it
  does not accept (an empty password gets the longer "requested access to the
  resource is denied"), so the message reads like a package-permission problem
  rather than a dead secret.
- `Mirror & Release (GitHub)` did not fail at all. github.com 401s the push,
  git falls back to the credential subsystem, finds no helper, and blocks on a
  terminal prompt that never arrives — the job sat `running` for 20+ minutes
  holding a runner slot, with the caller's flattened job stuck on `blocked`.

Both jobs now preflight the token against api.github.com/user before doing any
work, and report the scopes (GHCR additionally hard-fails without
`write:packages`, which fine-grained PATs can never carry). The push runs with
GIT_TERMINAL_PROMPT=0, an empty credential.helper/core.askPass, and a 5m
timeout backstop, so no auth or egress failure can park a runner again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 merged commit 14b5825f17 into main 2026-08-25 05:16:58 +00:00

ryangr0 referenced this pull request from a commit 2026-08-25 05:16:59 +00:00

Merge pull request 'fix(github): fail fast on a dead GH_TOKEN instead of hanging the mirror' (#50) from fix/github-distribute-fail-fast into main

webgrip-ci referenced this pull request from a commit 2026-08-25 05:17:46 +00:00

chore(release): v1.9.1 [skip ci]

ryangr0 referenced this pull request 2026-08-25 05:40:57 +00:00

fix(github): create the release over the REST API; drop GitHub-only annotations #51

renovate referenced this pull request from webgrip/twente.dev 2026-09-19 12:46:44 +00:00

fix(actions): Update dependency webgrip/workflows ( v1.6.0 ➔ v1.11.3 ) #21

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/workflows!50

No description provided.