What happens
Intermittently, the action fails before scanning anything:
Downloading asset: docker-scout-action_linux_amd64 (179.2 MB)
##[error]Unexpected HTTP response: 403
No image is scanned and no finding is reported, so the job goes red for a reason unrelated to the code under test. A re-run usually clears it.
Why
In src/index.js, downloadRelease() builds an authenticated client and then does not use it for the download:
const octokit = github.getOctokit(core.getInput('github-token')) // authenticated
release = await octokit.rest.repos.getReleaseByTag({ ... }) // authenticated
await tc.downloadTool(asset.url, binary, undefined, { // <-- auth: undefined
accept: 'application/octet-stream',
})The third parameter of @actions/tool-cache's downloadTool is auth. It is undefined, so the asset is fetched anonymously from api.github.com, which puts it on the 60-requests-per-hour-per-IP budget:
$ curl -sI -H "Accept: application/octet-stream" \
https://api.github.com/repos/docker/scout-action/releases/assets/493034676
HTTP/2 302
x-ratelimit-limit: 60
x-ratelimit-resource: coreAuthenticated, that limit is 5,000/hour. GitHub-hosted runners come from a shared address pool, so the anonymous budget is spent collectively by everyone using this action — which is consistent with the failures being bursty and with a re-run (a different runner) succeeding.
It also means retrying inside the same job does not help: the retry runs from the same address against the same exhausted budget.
Suggested fix
Pass the token the action already accepts (github-token, default ${{ github.token }}):
const token = core.getInput('github-token')
await tc.downloadTool(asset.url, binary, `token ${token}`, {
accept: 'application/octet-stream',
})Version
docker/scout-action@v1.24.0 (pinned by digest, 7c6b6c3f7844478ace1ffd4e7aef649053d1f87d), ubuntu-24.04 runners.
Happy to open a PR if that would be useful.
What happens
Intermittently, the action fails before scanning anything:
No image is scanned and no finding is reported, so the job goes red for a reason unrelated to the code under test. A re-run usually clears it.
Why
In
src/index.js,downloadRelease()builds an authenticated client and then does not use it for the download:The third parameter of
@actions/tool-cache'sdownloadToolisauth. It isundefined, so the asset is fetched anonymously fromapi.github.com, which puts it on the 60-requests-per-hour-per-IP budget:Authenticated, that limit is 5,000/hour. GitHub-hosted runners come from a shared address pool, so the anonymous budget is spent collectively by everyone using this action — which is consistent with the failures being bursty and with a re-run (a different runner) succeeding.
It also means retrying inside the same job does not help: the retry runs from the same address against the same exhausted budget.
Suggested fix
Pass the token the action already accepts (
github-token, default${{ github.token }}):Version
docker/scout-action@v1.24.0(pinned by digest,7c6b6c3f7844478ace1ffd4e7aef649053d1f87d),ubuntu-24.04runners.Happy to open a PR if that would be useful.