mirror of
https://github.com/mudler/LocalAI.git
synced 2026-07-30 09:57:57 -04:00
47c0e06198
The "Bump Backend dependencies" workflow has failed every night for the last two weeks. #11012 fixed one cause (repos renamed under localai-org); what is left is rate limiting. bump_deps.sh fans out to ~25 parallel matrix jobs that each query api.github.com anonymously. Anonymous calls are capped at 60/hour per source IP and GitHub-hosted runners egress through shared NAT addresses, so a random handful of jobs draw HTTP 403 and die at curl exit 22 with an empty response. Last night that hit ggml-org/whisper.cpp and mudler/depth-anything.cpp -- both public and resolvable, nothing wrong with either pin. Route every bump script through a shared gh_curl helper that sends GITHUB_TOKEN when present (1000/hour instead of 60) and retries transient failures, including the 403s that plain --retry ignores. The helper suppresses xtrace around the call so the Authorization header cannot land in a public job log. bump_docs.sh had a sharper version of the same bug: it piped an unchecked response into `jq -r .tag_name`, so a throttled request resolved to the string "null" and would have been published as the docs version. It now refuses to write anything it cannot resolve to a tag. Verified locally by running all four scripts end to end against their real upstreams: correct SHAs/tags written, exit 0; a nonexistent repo now fails with a named diagnostic instead of a bare exit 22 and leaves the pinned file untouched; the token is absent from the xtrace output; and the scripts still work unauthenticated. Assisted-by: Claude:opus-4.8 [Claude Code] Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
43 lines
1.4 KiB
Bash
Executable File
43 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
set -xe
|
|
|
|
source "$(dirname "${BASH_SOURCE[0]}")/gh_curl.sh"
|
|
|
|
REPO=$1
|
|
BRANCH=$2
|
|
VAR=$3
|
|
FILE=$4
|
|
|
|
if [ -z "$FILE" ]; then
|
|
FILE="Makefile"
|
|
fi
|
|
|
|
# gh_curl follows redirects so a renamed/transferred upstream repo (GitHub
|
|
# answers 301) still resolves, and fails on HTTP errors rather than letting an
|
|
# error page reach sed below. `|| true` keeps a failed lookup from aborting the
|
|
# script at exit 22 with no context — the SHA guard below reports it instead.
|
|
LAST_COMMIT=$(gh_curl -H "Accept: application/vnd.github.VERSION.sha" "https://api.github.com/repos/$REPO/commits/$BRANCH" || true)
|
|
|
|
# Guard the sed input: anything that is not a bare 40-hex SHA (an API error
|
|
# body, an empty response) would otherwise be spliced into the Makefile pin —
|
|
# either corrupting it silently or blowing up sed with an unterminated
|
|
# expression, which is how this job failed for a renamed repo.
|
|
if ! [[ "$LAST_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "Refusing to bump $VAR: expected a 40-char commit SHA for $REPO@$BRANCH, got: $LAST_COMMIT" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Read $VAR from Makefile (only first match)
|
|
set +e
|
|
CURRENT_COMMIT="$(grep -m1 "^$VAR?=" $FILE | cut -d'=' -f2)"
|
|
set -e
|
|
|
|
sed -i $FILE -e "s/$VAR?=.*/$VAR?=$LAST_COMMIT/"
|
|
|
|
if [ -z "$CURRENT_COMMIT" ]; then
|
|
echo "Could not find $VAR in Makefile."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Changes: https://github.com/$REPO/compare/${CURRENT_COMMIT}..${LAST_COMMIT}" >> "${VAR}_message.txt"
|
|
echo "${LAST_COMMIT}" >> "${VAR}_commit.txt" |