Repository navigation
sidecar: DXC's release check authenticates with GITHUB_TOKEN - #9
Merged
Merged
Conversation
mach-dxcompiler-rs, which links DXC into the x86_64 MSVC sidecar, asks the GitHub API whether its release is immutable before it downloads, and makes that request without authentication. On a shared runner the unauthenticated rate limit can be used up; the answer then has no "immutable" field and the build fails as though the release were mutable. That failed the 0.30.1 Windows x86_64 wheel once. The crate is vendored at the version the lock resolved and patched in. Its build script now sends Authorization: Bearer with GITHUB_TOKEN when that is set, on the API request only, passing the header to curl on stdin. The archive download, the immutability check and the checksum check are as upstream. The release workflow's wheel build passes the workflow token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Windows x86_64 wheel's build no longer depends on the unauthenticated GitHub API quota of a shared runner.
The sidecar links DXC statically on x86_64 MSVC through wgpu-hal's
static-dxc, which pullsmach-dxcompiler-rs. Its build script asks the GitHub API whether the release it downloads from is immutable, without authentication, and refuses to build unless the answer says so. On a shared runner that call can be rate-limited; the answer then has noimmutablefield and the build fails with "Refusing to download a mutable GitHub release" although the release is immutable. That failed the 0.30.1 release's Windows x86_64 wheel once; a rerun passed.The crate is vendored under
sidecar/vendor/mach-dxcompiler-rs(0.1.6+2026.09.16-48d5a66.1, the registry sources) with one change: whenGITHUB_TOKENis set, the release-metadata request sendsAuthorization: Bearer <token>, read by curl from stdin so it stays off the command line. The archive download, the immutability check and the SHA-256 check are as upstream, and the download sends no token to the asset host. The release workflow's wheel build gets the workflow's own token. The vendored README says why and what changed.Exercised by building the vendored crate for
x86_64-pc-windows-msvchere with a logging curl shim: without a token the API call runs at the 60-an-hour limit, with it at 5000, both answering"immutable": true; the download carries no Authorization header on either host; the archive's checksum passes.cargo fmt --check, clippy-D warningswith default features and--no-default-features, and the release build are clean.cargo treefor the MSVC target shows the patched path.🤖 Generated with Claude Code