From 9071a3f70f2cd847271aa176d592b34fb0dd2098 Mon Sep 17 00:00:00 2001 From: James Griffin Date: Thu, 20 Aug 2026 14:22:52 -0300 Subject: [PATCH] Stop authenticating setup-php against the GitHub API The GitHub API rate limit was the wrong diagnosis, so this reverts the 1Password-backed token added in #175 along with the mirrored composite action, leaving the workflows as they were. Timing every Setup PHP step across runs 454-523 rules the rate limit out. PHP 8.1 and 8.2 install in 26-41 seconds, 12 for 12, never once failing. PHP 8.3 has never finished in under 143 seconds and ranges up to 1273, with two outright failures. Those jobs share a fan-out, and so an egress address and a rate limit bucket, with the 8.1 and 8.2 jobs that are never touched. A throttle could not sort itself by PHP version that way. Run 523, the first to carry the token, is the direct refutation: the token resolved and verified, and Setup PHP still took 749 seconds on kallone and 408 on eris. The 8.3 penalty also predates the whole story, sitting at ~145 seconds back on 30 July. What is left is a slow path specific to 8.3 on these arm64 runners, whose long tail sometimes crosses the step timeout and reports the unhelpful "Could not setup PHP 8.3". That is worth fixing on its own terms rather than behind a token that was never in the path. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Uw545F1vveNJKjzLxdi2ks --- .gitea/actions/op-github-token/action.yml | 80 ----------------------- .gitea/workflows/ci.yml | 48 -------------- .gitea/workflows/release.yml | 15 ----- 3 files changed, 143 deletions(-) delete mode 100644 .gitea/actions/op-github-token/action.yml diff --git a/.gitea/actions/op-github-token/action.yml b/.gitea/actions/op-github-token/action.yml deleted file mode 100644 index a2944b8..0000000 --- a/.gitea/actions/op-github-token/action.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: GitHub API token from 1Password -description: > - Resolve the GitHub API token that setup-php authenticates with, via the - 1Password Connect instance running inside whichever cluster picked up this - job. Mirrors thatguygriff/infra .gitea/actions/op-connect, which is not - reachable from this repository. - -inputs: - connect-host: - description: 1Password Connect host - required: true - op-connect-token-eris: - description: 1Password Connect token for the eris cluster - required: true - op-connect-token-kallone: - description: 1Password Connect token for the kallone cluster - required: true - op-connect-token-nemesis: - description: 1Password Connect token for the nemesis cluster - required: true - -outputs: - token: - description: GitHub API token, for the GITHUB_TOKEN env of a setup-php step - value: ${{ steps.load.outputs.GH_API_TOKEN }} - -runs: - using: composite - steps: - # Connect is addressed at a cluster-local Service, so the token has to match - # the cluster the job landed on. A value with no match would configure no - # host at all and fail somewhere less obvious. - - name: Check RUNNER_CLUSTER is recognised - shell: bash - run: | - case "${RUNNER_CLUSTER:-}" in - eris|kallone|nemesis) echo "Runner cluster: $RUNNER_CLUSTER" ;; - "") echo "::error::RUNNER_CLUSTER is unset; no 1Password Connect token can be selected"; exit 1 ;; - *) echo "::error::RUNNER_CLUSTER='$RUNNER_CLUSTER' has no matching 1Password Connect token"; exit 1 ;; - esac - - - name: Configure Connect (eris) - if: env.RUNNER_CLUSTER == 'eris' - uses: 1password/load-secrets-action/configure@v2 - with: - connect-host: ${{ inputs.connect-host }} - connect-token: ${{ inputs.op-connect-token-eris }} - - - name: Configure Connect (kallone) - if: env.RUNNER_CLUSTER == 'kallone' - uses: 1password/load-secrets-action/configure@v2 - with: - connect-host: ${{ inputs.connect-host }} - connect-token: ${{ inputs.op-connect-token-kallone }} - - - name: Configure Connect (nemesis) - if: env.RUNNER_CLUSTER == 'nemesis' - uses: 1password/load-secrets-action/configure@v2 - with: - connect-host: ${{ inputs.connect-host }} - connect-token: ${{ inputs.op-connect-token-nemesis }} - - # export-env stays false so the token surfaces as a step output rather than - # entering the job environment, where `composer install` would run third - # party package scripts alongside it. - - name: Load GitHub API token - id: load - uses: 1password/load-secrets-action@v2 - with: - export-env: false - env: - GH_API_TOKEN: "op://Unsupervised/GitHub Personal Access Token for Gitea/token" - - - name: Verify token loaded - shell: bash - env: - GH_API_TOKEN: ${{ steps.load.outputs.GH_API_TOKEN }} - run: | - test -n "$GH_API_TOKEN" || { echo "::error::GitHub API token is empty after loading from 1Password"; exit 1; } - echo "GitHub API token loaded" diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index e96414f..c14788b 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -14,26 +14,11 @@ jobs: steps: - uses: actions/checkout@v4 - # setup-php resolves its tools through the GitHub API, which allows 60 - # requests an hour per source address unauthenticated. A CI fan-out across - # the fleet exhausts that, and the step then retries for minutes before - # reporting only "Could not setup PHP". - - name: Load GitHub API token - id: gh-token - uses: ./.gitea/actions/op-github-token - with: - connect-host: ${{ vars.OP_CONNECT_HOST }} - op-connect-token-eris: ${{ secrets.OP_CONNECT_TOKEN_ERIS }} - op-connect-token-kallone: ${{ secrets.OP_CONNECT_TOKEN_KALLONE }} - op-connect-token-nemesis: ${{ secrets.OP_CONNECT_TOKEN_NEMESIS }} - - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.3' tools: composer:v2 - env: - GITHUB_TOKEN: ${{ steps.gh-token.outputs.token }} - name: Cache Composer packages uses: actions/cache@v3 @@ -54,22 +39,11 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Load GitHub API token - id: gh-token - uses: ./.gitea/actions/op-github-token - with: - connect-host: ${{ vars.OP_CONNECT_HOST }} - op-connect-token-eris: ${{ secrets.OP_CONNECT_TOKEN_ERIS }} - op-connect-token-kallone: ${{ secrets.OP_CONNECT_TOKEN_KALLONE }} - op-connect-token-nemesis: ${{ secrets.OP_CONNECT_TOKEN_NEMESIS }} - - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.3' tools: composer:v2 - env: - GITHUB_TOKEN: ${{ steps.gh-token.outputs.token }} - name: Cache Composer packages uses: actions/cache@v3 @@ -96,15 +70,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Load GitHub API token - id: gh-token - uses: ./.gitea/actions/op-github-token - with: - connect-host: ${{ vars.OP_CONNECT_HOST }} - op-connect-token-eris: ${{ secrets.OP_CONNECT_TOKEN_ERIS }} - op-connect-token-kallone: ${{ secrets.OP_CONNECT_TOKEN_KALLONE }} - op-connect-token-nemesis: ${{ secrets.OP_CONNECT_TOKEN_NEMESIS }} - - name: Setup PHP uses: shivammathur/setup-php@v2 with: @@ -112,8 +77,6 @@ jobs: extensions: mbstring, intl coverage: none tools: composer:v2 - env: - GITHUB_TOKEN: ${{ steps.gh-token.outputs.token }} - name: Cache Composer packages uses: actions/cache@v3 @@ -150,22 +113,11 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Load GitHub API token - id: gh-token - uses: ./.gitea/actions/op-github-token - with: - connect-host: ${{ vars.OP_CONNECT_HOST }} - op-connect-token-eris: ${{ secrets.OP_CONNECT_TOKEN_ERIS }} - op-connect-token-kallone: ${{ secrets.OP_CONNECT_TOKEN_KALLONE }} - op-connect-token-nemesis: ${{ secrets.OP_CONNECT_TOKEN_NEMESIS }} - - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.3' tools: composer:v2 - env: - GITHUB_TOKEN: ${{ steps.gh-token.outputs.token }} - name: Build plugin zip run: composer build diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index a5a06ce..ff7e6b9 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -18,26 +18,11 @@ jobs: steps: - uses: actions/checkout@v4 - # setup-php resolves its tools through the GitHub API, which allows 60 - # requests an hour per source address unauthenticated. A CI fan-out across - # the fleet exhausts that, and the step then retries for minutes before - # reporting only "Could not setup PHP". - - name: Load GitHub API token - id: gh-token - uses: ./.gitea/actions/op-github-token - with: - connect-host: ${{ vars.OP_CONNECT_HOST }} - op-connect-token-eris: ${{ secrets.OP_CONNECT_TOKEN_ERIS }} - op-connect-token-kallone: ${{ secrets.OP_CONNECT_TOKEN_KALLONE }} - op-connect-token-nemesis: ${{ secrets.OP_CONNECT_TOKEN_NEMESIS }} - - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.3' tools: composer:v2 - env: - GITHUB_TOKEN: ${{ steps.gh-token.outputs.token }} # A tag that disagrees with the plugin header would make sites see a # phantom update forever (or never see a real one), so fail fast.