fix(github): retry ip allow list errors without auth by risu729 · Pull Request #9506 · jdx/mise

risu729 · 2026-05-01T07:31:11Z

Summary

keep GitHub API requests authenticated by default so installation-token/user-token rate limits still apply
when an authenticated GitHub REST API request returns a 403 body containing "IP allow list", retry the same request without Authorization
leave vfox GitHub header behavior unchanged

Notes

mise-versions appears to use a user-token pool today, but its JSON enrichment path can still burn the workflow-level MISE_GITHUB_TOKEN because mise resolves MISE_GITHUB_TOKEN before the per-tool GITHUB_API_TOKEN override. This PR avoids making that worse by only falling back to anonymous requests after the specific IP allow-list 403.

Tests

cargo fmt --check
cargo test github::tests
cargo test http::tests
cargo test -p vfox lua_mod::http::tests::test_add_default_headers

greptile-apps · 2026-05-01T07:32:46Z

Greptile Summary

This PR fixes a GitHub IP allow-list 403 error by splitting send_once into a thin wrapper and send_once_inner, adding a use_netrc flag to prevent credential re-injection on the retry path, and retrying unauthenticated when a api.github.com 403 response body contains "IP allow list". The recursion-termination logic is sound: use_netrc=false skips netrc on the retry, and the stripped Authorization header prevents is_authenticated_github_forbidden from firing a second time.

Confidence Score: 5/5

Safe to merge; only P2 findings with no blocking bugs.

All three previously-threaded concerns appear addressed in the current revision. The two remaining findings are P2 quality concerns that do not cause runtime failures on the expected happy path.

src/http.rs — new retry path has no dedicated test coverage.

Important Files Changed

Filename	Overview
src/http.rs	Adds IP allow-list 403 retry without auth: splits send_once into send_once/send_once_inner, adds use_netrc flag, adds is_authenticated_github_forbidden helper. Recursion-termination is sound; two P2 findings: loose substring match and missing test coverage.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant send_once
    participant send_once_inner
    participant GitHub as api.github.com

    Caller->>send_once: method, url, headers
    send_once->>send_once_inner: use_netrc=true
    send_once_inner->>send_once_inner: extend headers with netrc
    send_once_inner->>GitHub: request (with Authorization)
    GitHub-->>send_once_inner: 403 "IP allow list"
    send_once_inner->>send_once_inner: is_authenticated_github_forbidden? true
    send_once_inner->>send_once_inner: read body, strip Authorization
    send_once_inner->>send_once_inner: recurse use_netrc=false
    send_once_inner->>GitHub: request (no Authorization)
    GitHub-->>send_once_inner: 200 OK
    send_once_inner-->>Caller: Response

_{Reviews (9): Last reviewed commit: "fix(github): retry netrc ip allow list e..." | Re-trigger Greptile}

gemini-code-assist

Code Review

This pull request introduces a check to prevent the use of GitHub App installation tokens (prefixed with 'ghs_') when authenticating requests to 'api.github.com'. This logic is implemented through a new helper function, 'should_authenticate_github_api_request', in both the Lua HTTP module and the GitHub utility module. Unit tests have been added to ensure that authentication is correctly skipped for the public GitHub API while remaining active for other hosts. I have no feedback to provide.

jasonwbarnett · 2026-05-01T21:46:20Z

Let's go! 🔥

Thanks @risu729 ❤️

@jdx

### 🚀 Features - **(conda)** graduate conda backend out of experimental by @jdx in [#9544](#9544) - **(deps)** Add dart and flutter providers by @tjarvstrand in [#9505](#9505) - **(registry)** add neo4j by @mnm364 in [#9525](#9525) - **(registry)** add rustfs by @mnm364 in [#9530](#9530) - **(task)** support exclusion patterns in task sources by @jlarmstrongiv in [#9496](#9496) - **(vfox)** add stat function to lua file module by @esteve in [#9497](#9497) ### 🐛 Bug Fixes - **(backend)** flag regex prerelease versions by @jdx in [#9500](#9500) - **(backend)** mark -nightly/-canary/-experimental as prereleases by @jdx in [#9523](#9523) - **(backend)** suppress no-versions warning for unresolved-latest backends by @jdx in [#9548](#9548) - **(backend)** include dotnet prereleases from package flags by @jdx in [#9551](#9551) - **(backend)** scope PEP 440 prerelease detection to Python backends by @jdx in [#9558](#9558) - **(cargo)** Apply install_env during cargo install by @c22 in [#9502](#9502) - **(copr)** drop epel-9 chroots since rust >= 1.91 is unavailable by @jdx in [#9484](#9484) - **(github)** skip attestations on non-default api_url by @jdx in [#9486](#9486) - **(github)** retry ip allow list errors without auth by @risu729 in [#9506](#9506) - **(http)** update versions host tracking endpoint by @jdx in [#9527](#9527) - **(install)** don't warn for configured tools when version is passed via CLI by @jdx in [#9522](#9522) - **(install)** refresh latest before installing missing tools by @jdx in [#9545](#9545) - **(install)** don't cache nonexistent install paths by @jdx in [#9553](#9553) - **(lockfile)** don't propagate ad-hoc CLI overrides into the project lockfile by @jdx in [#9562](#9562) - **(plugin)** detect plugin types after cloning by @risu729 in [#9540](#9540) - **(release)** pass --no-git-checks to aube publish by @jdx in [#9483](#9483) - **(task)** convert PATH to MSYS Unix form when spawning POSIX shells on Windows by @JamBalaya56562 in [#9547](#9547) ### 📚 Documentation - **(contributing)** require popularity check for registry PRs by @jdx in [7bbeebe](7bbeebe) - **(watch)** update pitchfork domain to en.dev by @risu729 in [#9536](#9536) - document ghtkn GitHub token setup by @jdx in [#9546](#9546) - clarify registry backend acceptance policy by @jdx in [#9543](#9543) - Change exec command to use bash for variable echo by @kuboon in [#9567](#9567) ### 🧪 Testing - **(e2e)** run test-tool targets in parallel by @jdx in [#9564](#9564) - **(e2e)** run tests in parallel by @jdx in [#9563](#9563) - **(e2e)** bind-mount /tmp on disk and surface failed tests in CI summary by @jdx in [#9570](#9570) - **(tasks)** migrate test_task_help atask to usage field by @jdx in [#9549](#9549) ### 📦️ Dependency Updates - update fedora:45 docker digest to 8b838b3 by @renovate[bot] in [#9507](#9507) - update ghcr.io/jdx/mise:deb docker digest to f02194c by @renovate[bot] in [#9509](#9509) - update taiki-e/install-action digest to 7769b73 by @renovate[bot] in [#9512](#9512) - update ghcr.io/jdx/mise:alpine docker digest to 581f8a8 by @renovate[bot] in [#9508](#9508) - update rust crate ctor to v0.10.1 by @renovate[bot] in [#9515](#9515) - update ghcr.io/jdx/mise:rpm docker digest to a5c9655 by @renovate[bot] in [#9510](#9510) - update rust docker digest to a9cfb75 by @renovate[bot] in [#9511](#9511) - update rust crate age to v0.11.3 by @renovate[bot] in [#9514](#9514) - update rust crate jiff to v0.2.24 by @renovate[bot] in [#9516](#9516) - update dependency vitepress-plugin-tabs to ^0.9.0 by @renovate[bot] in [#9518](#9518) - update autofix-ci/action action to v1.3.4 by @renovate[bot] in [#9513](#9513) - update rust crate usage-lib to v3.2.1 by @renovate[bot] in [#9517](#9517) - update apple-actions/import-codesign-certs action to v7 by @renovate[bot] in [#9519](#9519) - update taiki-e/install-action digest to 51cd0b8 by @renovate[bot] in [#9531](#9531) - exclude taiki-e/install-action from renovate by @jdx in [#9532](#9532) - update rust crate blake3 to v1.8.5 by @renovate[bot] in [#9533](#9533) ### 📦 Registry - enable shellcheck on windows by @zeitlinger in [#9487](#9487) - add google-java-format by @zeitlinger in [#9488](#9488) - add expert ([aqua:expert-lsp/expert](https://github.com/expert-lsp/expert)) by @AlternateRT in [#9498](#9498) - update entry for checkmake by @eread in [#9504](#9504) - add systemctl-tui ([aqua:rgwood/systemctl-tui](https://github.com/rgwood/systemctl-tui)) by @2xdevv in [#9521](#9521) - add codon by @3w36zj6 in [#9538](#9538) - add tool yr (backend:github:VirusTotal/yara-x) by @adam-moss in [#9542](#9542) - add tool betterleaks (backend:aqua/betterleaks/betterleaks) by @adam-moss in [#9541](#9541) - add `git-filter-repo` by @garysassano in [#9550](#9550) - add umoci ([aqua:opencontainers/umoci](https://github.com/opencontainers/umoci)) by @2xdevv in [#9555](#9555) - add aqua backend for elixir-ls by @AlternateRT in [#9557](#9557) - deny inline backend options by @risu729 in [#9565](#9565) ### Chore - **(ci)** fail registry tests without summary by @jdx in [#9559](#9559) - **(ci)** use !cancelled() instead of always() for test-ci aggregator by @jdx in [#9569](#9569) - **(ci)** use namespace runners for ci jobs by @jdx in [#9561](#9561) - **(config)** deprecate shorthands_file setting by @risu729 in [#9534](#9534) - **(docs)** remove shrill.en.dev analytics script by @jdx in [#9539](#9539) - **(release)** replace bc with awk in release-plz star formatting by @jdx in [d7f177f](d7f177f) - bump hk to 1.44.3 by @jdx in [#9493](#9493) - invert CLAUDE.md/AGENTS.md so AGENTS.md is canonical by @jdx in [#9560](#9560) - set dev profile debug to 1 by @jdx in [#9572](#9572) ### New Contributors - @kuboon made their first contribution in [#9567](#9567) - @AlternateRT made their first contribution in [#9557](#9557) - @2xdevv made their first contribution in [#9555](#9555) - @adam-moss made their first contribution in [#9541](#9541) - @jlarmstrongiv made their first contribution in [#9496](#9496) - @tjarvstrand made their first contribution in [#9505](#9505)

gemini-code-assist Bot reviewed May 1, 2026

View reviewed changes

risu729 force-pushed the codex-skip-ghs-github-api-auth branch from c76989b to fba74c4 Compare May 1, 2026 07:44

risu729 changed the title ~~fix(github): skip ghs auth for github api~~ fix(github): retry ip allow list errors without auth May 1, 2026

risu729 force-pushed the codex-skip-ghs-github-api-auth branch 3 times, most recently from 5604ef6 to ddc6877 Compare May 1, 2026 10:17

greptile-apps Bot reviewed May 1, 2026

View reviewed changes

Comment thread src/http.rs

risu729 force-pushed the codex-skip-ghs-github-api-auth branch from ddc6877 to 36968c4 Compare May 1, 2026 10:22

greptile-apps Bot reviewed May 1, 2026

View reviewed changes

Comment thread src/http.rs Outdated

fix(github): retry ip allow list errors without auth

6779355

risu729 force-pushed the codex-skip-ghs-github-api-auth branch from 36968c4 to 6779355 Compare May 1, 2026 10:53

fix(github): avoid auth retry recursion

b3fd45b

greptile-apps Bot reviewed May 1, 2026

View reviewed changes

Comment thread src/http.rs

fix(github): retry netrc ip allow list errors

b8af15b

risu729 marked this pull request as ready for review May 1, 2026 14:32

jdx merged commit 178f63a into jdx:main May 1, 2026
34 checks passed

mise-en-dev mentioned this pull request May 1, 2026

chore: release 2026.5.0 #9485

Merged

risu729 deleted the codex-skip-ghs-github-api-auth branch May 1, 2026 23:08

BrewTestBot mentioned this pull request May 3, 2026

mise 2026.5.0 Homebrew/homebrew-core#280712

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(github): retry ip allow list errors without auth#9506

fix(github): retry ip allow list errors without auth#9506
jdx merged 3 commits intojdx:mainfrom
risu729:codex-skip-ghs-github-api-auth

risu729 commented May 1, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 1, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonwbarnett commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

risu729 commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes

Tests

Uh oh!

greptile-apps Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonwbarnett commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

risu729 commented May 1, 2026 •

edited

Loading

greptile-apps Bot commented May 1, 2026 •

edited

Loading