mirror of
https://github.com/containers/podman.git
synced 2026-03-29 12:03:29 -04:00
8942e2dbda
Frequent but intermittently, the stale issue and PR locking workflow generates the error: ``` You have exceeded a secondary rate limit. Please wait a few minutes before you try again. If you reach out to GitHub Support for help, please include the request ID XYZ ``` According to upstream `dessant/lock-threads` issue 48, this seems to be coming from the GitHub side (bug/feature/limitation), since the action uses an official github API rate-limiting library. It's unlikely related to which style/syntax of github token is used, nor if the action is executed concurrently across multiple repos. According to the rate-limiting docs: https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#about-secondary-rate-limits it's possible the issue is caused due to an unknown aspect of the clause: ``` These secondary rate limits are subject to change without notice. You may also encounter a secondary rate limit for undisclosed reasons. ``` The same docs indicate Github Apps have enhanced rate-limits which scale with the org's repo count. Attempt to fix the intermittent failures by making use of a new, dedicated, org-specific, private "Stale Locking App" I recently created. This requires the addition of a new action to the workflow that obtains a short-lived token for passing to lock-threads. Note: Because both `vars.STALE_LOCKING_APP_ID` and `secrets.STALE_LOCKING_APP_PRIVATE_KEY` are defined at the containers-organization level, the Buildah and Skopeo re-use of this workflow should continue to function normally w/o change. Signed-off-by: Chris Evich <cevich@redhat.com>
86 lines
3.0 KiB
YAML
86 lines
3.0 KiB
YAML
---
|
|
|
|
# WARNING ALERT DANGER CAUTION ATTENTION: This file is re-used from the
|
|
# `main` branch, by workflows in (at least) the Buildah and Skopeo repos.
|
|
# Please think twice before making large changes, renaming, or moving the file.
|
|
|
|
# Format ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
|
|
|
|
name: "Lock closed issues and PRs"
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * *'
|
|
# Allow re-use of this workflow by other repositories
|
|
# Ref: https://docs.github.com/en/actions/using-workflows/reusing-workflows
|
|
workflow_call:
|
|
secrets:
|
|
STALE_LOCKING_APP_PRIVATE_KEY:
|
|
required: true
|
|
ACTION_MAIL_SERVER:
|
|
required: true
|
|
ACTION_MAIL_USERNAME:
|
|
required: true
|
|
ACTION_MAIL_PASSWORD:
|
|
required: true
|
|
ACTION_MAIL_SENDER:
|
|
required: true
|
|
# Debug: Allow triggering job manually in github-actions WebUI
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: lock
|
|
|
|
env:
|
|
# Number of days before a closed issue/PR is be comment-locked.
|
|
# Note: dessant/lock-threads will only process a max. of
|
|
# 50 issues/PRs at a time.
|
|
CLOSED_DAYS: 90
|
|
# Pre-created issue/PR label to add (preferably a bright color).
|
|
# This is intended to direct a would-be commenter's actions.
|
|
LOCKED_LABEL: 'locked - please file new issue/PR'
|
|
|
|
jobs:
|
|
manage_locking:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
steps:
|
|
# Use dedicated github app to workaround API rate limiting
|
|
# Ref: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow
|
|
- name: Obtain Stale Locking App token
|
|
id: generate-token
|
|
uses: actions/create-github-app-token@v1
|
|
with:
|
|
# N/B: These are both defined at the containers-org level
|
|
app-id: ${{ vars.STALE_LOCKING_APP_ID }}
|
|
private-key: ${{ secrets.STALE_LOCKING_APP_PRIVATE_KEY }}
|
|
|
|
# Ref: https://github.com/dessant/lock-threads#usage
|
|
- uses: dessant/lock-threads@v5
|
|
with:
|
|
github-token: '${{ steps.generate-token.outputs.token }}'
|
|
process-only: 'issues, prs'
|
|
issue-inactive-days: '${{env.CLOSED_DAYS}}'
|
|
pr-inactive-days: '${{env.CLOSED_DAYS}}'
|
|
add-issue-labels: '${{env.LOCKED_LABEL}}'
|
|
add-pr-labels: '${{env.LOCKED_LABEL}}'
|
|
pr-lock-reason: 'resolved'
|
|
log-output: true
|
|
- if: failure()
|
|
name: Send job failure notification e-mail
|
|
uses: dawidd6/action-send-mail@v3.12.0
|
|
with:
|
|
server_address: ${{secrets.ACTION_MAIL_SERVER}}
|
|
server_port: 465
|
|
username: ${{secrets.ACTION_MAIL_USERNAME}}
|
|
password: ${{secrets.ACTION_MAIL_PASSWORD}}
|
|
subject: Github workflow error on ${{github.repository}}
|
|
to: podman-monitor@lists.podman.io
|
|
from: ${{secrets.ACTION_MAIL_SENDER}}
|
|
body: "Job failed: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}"
|