Fix GitHub API rate limiting in cli-tests #2731
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit addresses intermittent cli-test failures on main caused by GitHub API rate limiting when Nix attempts to fetch nixpkgs metadata. Problem: - Tests were hitting 403 errors with "API rate limit exceeded" message - Despite having GITHUB_TOKEN configured in NIX_CONFIG and ~/.config/nix/nix.conf, the token wasn't being used properly by the Nix daemon on macOS runners Root Cause: - On macOS, the Nix daemon runs as a different user and reads /etc/nix/nix.conf instead of the user's ~/.config/nix/nix.conf - The daemon wasn't picking up the access token configuration Solution: 1. Configure /etc/nix/nix.conf system-wide on macOS runners and restart the daemon 2. As a backup, pass the access token explicitly via --option access-tokens in nix commands Changes: - .github/workflows/cli-tests.yaml: Update "Setup Nix GitHub authentication" step to configure /etc/nix/nix.conf on macOS and restart the daemon - internal/nix/command.go: Add GITHUB_TOKEN to nix command args as --option access-tokens - cli-tests-failure-report.md: Comprehensive diagnostic report of the issue 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
- Ensure /etc/nix directory and nix.conf file exist before appending - Move configuration to AFTER Nix is installed in auto-nix-install job - Configure user config before devbox runs (Nix installer respects this) - Then configure system-wide config after Nix installation completes This fixes the "No such file or directory" error in the auto-nix-install job on macOS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
savil
requested review from
LucilleH,
gcurtis,
ipince,
mikeland73 and
mohsenari
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The cli-tests on the
mainbranch have been failing intermittently in GitHub Actions since at least October 7, 2025, due to GitHub API rate limiting when Nix attempts to fetch nixpkgs metadata.Error Message
Despite having
GITHUB_TOKENconfigured in bothNIX_CONFIGenvironment variable and~/.config/nix/nix.conf, the tests were still hitting unauthenticated rate limits.Root Cause
On macOS runners, the Nix daemon:
/etc/nix/nix.confinstead of the user's~/.config/nix/nix.confThis meant that while
nix show-configshowed the access token was configured, the daemon wasn't actually using it when making GitHub API requests.Solution
This PR implements a two-pronged approach:
1. Configure Nix Daemon Properly (Primary Fix)
/etc/nix/nix.confwith the GitHub tokenauto-nix-installjob, configure AFTER Nix is installed (not before)2. Pass Token via Command-Line Options (Backup)
internal/nix/command.goto pass--option access-tokens github.com=$GITHUB_TOKENin all nix commandsChanges
.github/workflows/cli-tests.yaml:/etc/nix/nix.confexists before writingauto-nix-installjob to configure Nix AFTER installation completesinternal/nix/command.go: Add GITHUB_TOKEN to nix command args as --option access-tokensDetailed Analysis
For a comprehensive diagnostic report with evidence, timeline, and alternative solutions considered, see:
CLI Tests Failure Report
Note on Reproduction
The issue is specific to GitHub Actions environment and cannot be easily reproduced locally:
This PR validates the fix directly in CI/CD where the issue occurs.
Fixes the intermittent test failures that have been occurring since October 7, 2025.