Rate limit reached due to `GITHUB_TOKEN` not being read

[nickelghost]

Hi there, we just ran into the rate limit ssue.

Failed to download binary:
HttpError: API rate limit exceeded for <REDACTED> (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)

We tried adding a GITHUB_TOKEN environment variable, but it wasn't read.

[mstruebing]

@nickelghost I don't think we request anything from this tool.

If your issue occurs in one of the wrappers i.e. python, javascript, PHP, please report the issue there.
I'll close this for now.

(If I have overseen something and we actually request something from Github, please feel free to reopen)

[vbode]

Hi @mstruebing, we are running into this issue in our CI.
I have been also able to reproduce this locally somewhat. By calling this endpoint:
https://api.github.com/rate_limit

I am able to see how many requests I have left. If I delete the node modules in my project, then do an npm install, and then run editorconfig-checker, I see as output:
PS C:\Repositories\build\test-project> npm run editorconfig

test-project@0.0.0 editorconfig
editorconfig-checker

Downloading v3.3.0

When I then call the rate limit endpoint, I see that I have one less request remaining. If I run the editor-config again, I do not see the 'Downloading' message and I have the same amount of requests remaining.
If however, I delete my node modules and do an npm install again, and then run editor-config, then again I see the 'Downloading' message, and my amount of requests goes down by one again.

I see the editorconfig-checker in our npm proxy in our binary storage tool, and the requests don't go down when doing npm install, only when actually running it, so something is downloaded from Github while running the tool.
Is there a way to use a github token so that we don't get rate limited on our CI machines?

[mstruebing]

This is an issue with the javascript-wrapper, please report the issue there: https://github.com/editorconfig-checker/editorconfig-checker.javascript

[mstruebing]

I see something similiar is already reported: #419

[klaernie]

Is there a way to use a github token so that we don't get rate limited on our CI machines?

Ideally just set environment variable GITHUB_TOKEN - the javascript wrapper uses Octokit, which then should automatically apply the token to all requests it sends out. However the final download of the release asset from GitHub was done without Octokit, which would probably explain the number of available requests going down by exactly one. I opened a PR that should address this issue, please give it a try.

I'll also move this issue to the javascript wrapper repo.

[chrisopperwall-qz]

Hello! Sorry for bumping this issue, I can totally start a new thread, but I've come across similar rate limit issues in my CI due to being unauthenticated. I'm currently on v6.1.0, so I'm on the latest version. I was looking at the docs for the Octokit constructor in @octokit/rest and it looks like it re-exports the constructor from @octokit/core. I found some comments in the constructor in that package that say that if auth or authStrategy are not set then requests will continue unauthenticated https://github.com/octokit/core.js/blob/main/src/index.ts#L155.

It looks like @octokit/action has some built-in features to look for GITHUB_TOKEN via the @octokit/auth-action package here https://github.com/octokit/action.js/blob/main/src/index.ts#L16, whereas the @octokit/rest version expects auth information to be passed explicitly.

I made a fork that passes the token explicitly, but I wanted to check first if that approach seemed okay. Thanks for maintaining this!

[mstruebing]

@chrisopperwall-qz I would be personally fine with this - but should that rather be changed in octokit?
If an auth token is present as an environment variable I can see no reason for it to operate unauthenticated.
They may have good reasons for that, but without knowing these it feels like the better place to fix in my opinion.

[chrisopperwall-qz]

Thanks for the quick response! Their docs pointed me to this page on the different auth strategies they support, so maybe they don't default to one to leave it up to the developer using the library? https://github.com/octokit/authentication-strategies.js/ I'll keep looking though because their Authentication section on octokit.js mentions that it supports static token auth by default https://github.com/octokit/core.js/#authentication

By default, the Octokit API client supports authentication using a static token.

[mstruebing]

If you can't find any other way, please open a PR to adjust our call side :)