Action fails due to "too many 403 error responses"

[danni-m]

This happens sometimes, the last time it happend was in a dependabot PR.
Action configuration:

      - name: Publish Unit Test Results
        uses: EnricoMi/publish-unit-test-result-action@v1.23
        if: always()
        with:
          files: results.xml

The output of the action:

2021-11-17 13:37:23 +0000 - publish-unit-test-results -  INFO - reading results.xml
2021-11-17 13:37:23 +0000 - publish -  INFO - publishing success results for commit 99aa12eb1178be560ee201031bed471b82c408c6
2021-11-17 13:37:23 +0000 - publish -  INFO - creating check
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 859, in urlopen
    **response_kw
  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 859, in urlopen
    **response_kw
  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 859, in urlopen
    **response_kw
  [Previous line repeated 7 more times]
  File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 836, in urlopen
    retries = retries.increment(method, url, response=response, _pool=self)
  File "/usr/local/lib/python3.6/site-packages/urllib3/util/retry.py", line 574, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.github.com', port=443): Max retries exceeded with url: /repos/**ORG**/**REPO**/check-runs (Caused by ResponseError('too many 403 error responses',))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/action/publish_unit_test_results.py", line 292, in <module>
    main(settings, gha)
  File "/action/publish_unit_test_results.py", line 103, in main
    Publisher(settings, gh, gha).publish(stats, results.case_results, conclusion)
  File "/action/publish/publisher.py", line 65, in publish
    check_run = self.publish_check(stats, cases, conclusion)
  File "/action/publish/publisher.py", line 232, in publish_check
    output=output)
  File "/usr/local/lib/python3.6/site-packages/github/Repository.py", line 3645, in create_check_run
    input=post_parameters,
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 355, in requestJsonAndCheck
    verb, url, parameters, headers, input, self.__customConnection(url)
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 454, in requestJson
    return self.__requestEncode(cnx, verb, url, parameters, headers, input, encode)
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 529, in __requestEncode
    cnx, verb, url, requestHeaders, encoded_input
  File "/action/publish_unit_test_results.py", line 125, in throttled_gh_request_raw
    return gh_request_raw(cnx, verb, url, requestHeaders, input)
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 555, in __requestRaw
    response = cnx.getresponse()
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 133, in getresponse
    allow_redirects=False,
  File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 590, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 507, in send
    raise RetryError(e, request=request)
requests.exceptions.RetryError: HTTPSConnectionPool(host='api.github.com', port=443): Max retries exceeded with url: /repos/**ORG**/**REPO**/check-runs (Caused by ResponseError('too many 403 error responses',))

[EnricoMi]

Can you run the action with:

with:
  log_level: DEBUG
  root_log_level: DEBUG

to see the timings and frequency of API calls?
Are there other actions running in the workflow that call the GitHub API?
Is the repo public?

[danni-m]

its not a public repo, we don't have any other action using the API. just regular/plain build actions.

[EnricoMi]

If DEBUG output does not provide useful insights into the underlying issue, you could try and set higher values for the following options:

• seconds_between_github_reads (default is 0.25)
• seconds_between_github_writes (default is 2)

[BlasiusSecundus]

Encountered this issue when creating PR from a fork repo.

Seems to affect v1.23+.

Possibly related to e33a080, but occurs even if the event_file parameter (or any other parameter) is not used.

Reverting to v1.22 solves the issue.

Example PR demonstrating this behavior:
graphql-java-kickstart/graphql-spring-boot#737

[EnricoMi]

Encountered this issue when creating PR from a fork repo.

This is a great observation. It turns our that only the composite action is behaving this way. @BlasiusSecundus Can you try this fix please:

- name: Publish Unit Test Results
  uses: EnricoMi/publish-unit-test-result-action/composite@branch-treat-empty-input-strings-as-none

[EnricoMi]

@danni-m can you confirm that you only see this issue for PRs from fork repositories, for those PRs it fails consistently (as in always) and that you are running the action as a composite action (i.e. via uses: EnricoMi/publish-unit-test-result-action/composite@...)?

[BlasiusSecundus]

@EnricoMi I tried, and I can confirm that the fix works

[EnricoMi]

@EnricoMi I tried, and I can confirm that the fix works

Thanks for testing. Merged into master, to be released soon.

[gionn]

I've the same problem on every dependabot PRs, so this has something to do with the special environment in which dependabot PR runs.

A workaround is to manually rebuild, since in this way it became a "normal" PR.

ref https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/

[EnricoMi]

@gionn have you followed the instructions on dependabot branches in the README.md?

[EnricoMi]

@danni-m the same question for you, did you follow the dependabot specific instructions in the README.md?

[gionn]

@gionn have you followed the instructions on dependabot branches in the README.md?

sorry, found that later 👯

[danni-m]

@EnricoMi I didn't, will try it out, thanks!

[EnricoMi]

OK, in that case the 403 that you are seeing are those "Resource not accessible by integration" 403 errors that are not retry-able.

There is some improvement in master (#202) that will be released in the next v1 release that will not retry this particular 403 but genuine rate limit exceeded errors only, which are retry-able. Closing then as the source of the 403 is understood.