From 3ff62e53f2bc090704c15fe06ed721761f813ec6 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 15:48:15 +0300 Subject: [PATCH] test(updater): treat GitHub 429 secondary rate limits as skip, not failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TestRealVerify_EndToEnd_v1_12_5 calls the live GitHub attestations API unauthenticated. isRateLimited() only matched "returned 403" and "rate limit", but GitHub answers secondary/abuse throttling with 429 and a body that says "abuse detection mechanism" — and spells the phrase hyphenated ("abuse-rate-limits") in the docs URL. Neither pattern matched, so throttling hard-failed the suite instead of skipping. Widen the match to cover 429, the hyphenated spelling, and the abuse detection wording. Test-only change. Co-Authored-By: Claude Opus 5 --- attestation_test.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/attestation_test.go b/attestation_test.go index f1c89b6..93fd502 100644 --- a/attestation_test.go +++ b/attestation_test.go @@ -193,8 +193,20 @@ func TestRealVerify_EndToEnd_v1_12_5(t *testing.T) { } } +// isRateLimited reports whether err is GitHub throttling us rather than a +// genuine verification failure. Unauthenticated callers get two distinct +// responses: 403 for the plain hourly rate limit, and 429 for secondary +// ("abuse detection") limits. The 429 body says "abuse detection mechanism" +// and only ever spells the phrase hyphenated ("abuse-rate-limits"), so +// neither of the original patterns matched it and the test hard-failed. func isRateLimited(err error) bool { - return err != nil && (containsAny(err.Error(), "returned 403", "rate limit")) + return err != nil && containsAny(err.Error(), + "returned 403", + "returned 429", + "rate limit", + "rate-limit", + "abuse detection", + ) } func containsAny(s string, subs ...string) bool {