CI: authenticate Composer against GitHub to avoid codeload 429s #50

New issue

Closed

opened 2026-08-17 18:00:00 +02:00 by myrmidex · 0 comments

myrmidex commented

2026-08-17 18:00:00 +02:00

Owner

composer install in CI fails with HTTP 429 from codeload.github.com — GitHub rate-limits anonymous dist downloads per-IP, and the Forgejo runner's egress IP gets hard-limited (all retry attempts fail, even single downloads).

Proper fix: authenticate Composer against GitHub with an OAuth token so downloads use the per-token limit instead of the per-IP anonymous limit:

Create a GitHub PAT (fine-grained "Public Repositories — read-only", or a classic token with no scopes).
Add it as a Forgejo secret GITHUB_TOKEN (Settings → Actions → Secrets).
In .forgejo/workflows/ci.yml, set on the install step:
COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GITHUB_TOKEN }}"}}'
and revert --prefer-source back to --prefer-dist.

Temporary workarounds in place (no GitHub account):

composer install --prefer-source (git clone) for most packages.
phpstan/phpstan baked into the CI image via a cache-warm step in docker/build/Dockerfile.ci (it is dist-only and has no VCS source), so it avoids codeload.

Both workarounds should be removed once the GitHub token is configured.

`composer install` in CI fails with HTTP 429 from `codeload.github.com` — GitHub rate-limits anonymous dist downloads per-IP, and the Forgejo runner's egress IP gets hard-limited (all retry attempts fail, even single downloads). **Proper fix:** authenticate Composer against GitHub with an OAuth token so downloads use the per-token limit instead of the per-IP anonymous limit: 1. Create a GitHub PAT (fine-grained "Public Repositories — read-only", or a classic token with no scopes). 2. Add it as a Forgejo secret `GITHUB_TOKEN` (Settings → Actions → Secrets). 3. In `.forgejo/workflows/ci.yml`, set on the install step: `COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GITHUB_TOKEN }}"}}'` and revert `--prefer-source` back to `--prefer-dist`. **Temporary workarounds in place (no GitHub account):** - `composer install --prefer-source` (git clone) for most packages. - `phpstan/phpstan` baked into the CI image via a cache-warm step in `docker/build/Dockerfile.ci` (it is dist-only and has no VCS source), so it avoids codeload. Both workarounds should be removed once the GitHub token is configured.