Skip to content

build-docker fails with "tag is needed when pushing to registry" when the anonymous read of the latest release is rate limited #1046

Description

@vharseko

Run 34854564649 (PR #968), job build-docker: the step «Get latest release version» printed last release: with nothing after it, docker/metadata-action warned «No Docker image version has been generated. Check tags input.», and docker/build-push-action failed with

ERROR: failed to build: tag is needed when pushing to registry

Every maven leg of the run was green, and attempt 2 of the same run passed with no change to the branch.

.github/workflows/build.yml:450 and :595 read https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest with an unauthenticated curl. The anonymous limit is 60 requests an hour per source address, shared by every job the runner's address hosts; a rate-limited answer carries no "name", so the version comes out empty and the image has no tag to be pushed under. build-docker-alpine reads the release the same way.

Fix: send the workflow token (github.token), which has a budget of its own, and fail the step with a named error when the version is still empty, so the next failure of this shape is reported at the step which caused it rather than at the push.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions