Repository navigation
feat(github): issue and status reads use gh-ci once its token grants them - #6325
Open
schickling-assistant wants to merge 2 commits into
Open
schickling-assistant wants to merge 2 commits into
schickling-assistant wants to merge 2 commits into
Conversation
…them When no github-ledger installation is published for an owner and the gh-ci sidecar grants issues read, issue/comment reads use the gh-ci installation instead of the PAT. When gh-ci grants statuses read, commit-status reads route to gh-ci and PR detail reads skip the per-head legacy status GET, since the GraphQL rollup already carries StatusContext entries. Behaviour is unchanged until the App's installations grant those permissions.
schickling
force-pushed
the
schickling-assistant/gh-ci-issue-status-reads
branch
from
November 10, 2026 22:08
c65e095 to
b97483b
Compare
Without statuses read, an installation-selected PR detail read adds one PAT combined-status GET per distinct head. Cover that a repeat read is conditional (304, free of primary quota), so only a new head or a cold cache costs the PAT.
schickling
force-pushed
the
schickling-assistant/gh-ci-issue-status-reads
branch
from
November 10, 2026 22:08
b97483b to
b93317c
Compare
schickling-assistant
marked this pull request as ready for review
November 10, 2026 22:43
schickling-assistant
requested a deployment
to
evidence-signing
November 10, 2026 22:45 — with 
GitHub Actions
In progress
GitHub Actions
In progress
schickling-assistant
requested a deployment
to
evidence-signing
November 10, 2026 22:46 — with
GitHub Actions
In progress
GitHub Actions
In progress
schickling-assistant
temporarily deployed
to
evidence-signing
November 10, 2026 22:47 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
schickling-assistant
temporarily deployed
to
evidence-signing
November 10, 2026 22:47 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
schickling-assistant
temporarily deployed
to
evidence-signing
November 10, 2026 22:52 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub observers read through
ROOT/gh-ciinstallation tokens when the operator publishes them (dotfiles#9097 enables that on dev3/dev5), but two read classes still use the sharedschickling-assistantPAT:github-ledger, which is not published on any host (st_github_auth_fallback{github_app="github-ledger",reason=~"missing|no-installation"}on dev3/dev5/mbp2025);reason="statuses"), one extra GET per distinct PR head per GraphQL read.That PAT ran to 0 core requests left on 2026-11-10.
What
ReadSourcekeeps the sidecar'spermissions;grants(permission).select(..., "github-ledger", ...): if no ledger installation is published (missing/no-installation) and gh-ci grantsissuesread, use gh-ci (no fallback recorded). Expired/unreadable ledger still falls back.statusesread; PR detail reads skip the per-head legacy status GET in that case (the rollup already carriesStatusContext).Behaviour is unchanged until the gh-ci App installations grant Issues/Commit statuses read (a person step; the dotfiles publisher already requests them once granted). Existing 403 "Resource not accessible by integration" replay to the PAT still applies.
Tests
issue_reads_use_gh_ci_only_when_it_grants_issues_and_no_ledger_is_published,status_reads_use_gh_ci_once_it_grants_statuses(crates/fractal-github-base/src/github_app_read.rs). Burst: https://github.com/compoundingtech/fractal/actions/runs/42910452423 (cargo test -p fractal-github-base --lib).Pushed with
ST_SKIP_EVIDENCE=1(no evidence signer on this machine).Why statuses matter for the PAT
Without
statusesread, PR detail reads under an installation add one PAT combined-status GET per distinct head. They are conditional (pat_legacy_status_reads_revalidate_with_their_etag; a live 304 is free), but a cold cache after every daemon start costs one charged GET per open PR: 379 + 304 for dotfiles + fractal (a dev3 canary spent ~650 PAT requests in 6 min). With the statuses grant, this PR skips those GETs entirely.