Enhance GitHub GraphQL Rate Limit Handling and Token Security#8273
Enhance GitHub GraphQL Rate Limit Handling and Token Security#8273pisum-sativum wants to merge 5 commits into
Conversation
…nt timeout on large repos
|
@pisum-sativum is attempting to deploy a commit to the jhasourav07's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
This pull request effectively resolves critical issues related to GitHub GraphQL rate limits and enhances token security. The changes made, such as request deduplication and error handling, are crucial for maintaining the integrity of our API interactions. It's worth noting that similar past decisions focused on improving user experience through visually themed error responses, which highlights our commitment to both functionality and user experience. Thank you for your contributions, and I look forward to your feedback! |
retenta-bot
Bot
changed the title
|
@JhaSourav07 I have done the necessary changes kindly check and merge with appropriate labels. |
There was a problem hiding this comment.
Pull request overview
Improves GitHub API resiliency by adjusting retry/abort behavior and contribution-request coalescing to reduce duplicated calls and avoid leaking sensitive request details, while also tweaking CI analytics paging and reordering the socials registry.
Changes:
- Updates
fetchWithRetryerror/abort handling and adjusts contribution-fetch coalescing so abort signals don’t bypass deduplication. - Reduces CI Actions pagination depth for CI analytics fetches.
- Sorts the socials registry alphabetically at module initialization.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| services/github/ci-analytics.ts | Reduces Actions pagination (likely to lower API usage). |
| lib/github.ts | Changes abort/error behavior in retry logic and contribution request coalescing for better dedup + safer error surfaces. |
| app/generator/data/socials.ts | Sorts socials registry by display name (user-visible ordering change). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (didThrow) { | ||
| if (options.signal?.aborted) throw fetchError; | ||
| if (options.signal?.aborted) throw new Error('AbortError'); |
| return new Promise<ExtendedContributionData>((resolve, reject) => { | ||
| if (options.signal?.aborted) return reject(new Error('AbortError')); | ||
|
|
||
| const onAbort = () => reject(new Error('AbortError')); | ||
| options.signal?.addEventListener('abort', onAbort, { once: true }); | ||
|
|
| placeholder: 'e.g. https://huggingface.co/yourname', | ||
| }, | ||
| ] as Social[] | ||
| ).sort((a, b) => a.name.localeCompare(b.name)); |
📦 Next.js Bundle Size Report (Gzipped Sizes)✨ No significant bundle size changes detected. 📊 Summary of Totals
|
Aamod007
added
level:advanced
Aamod007
left a comment
Aamod007
left a comment
There was a problem hiding this comment.
This is a solid improvement to our GraphQL rate limit handling and request cancellation logic! The way you're handling \AbortError\ and coalescing requests is very robust.
However, similar to PR #8274, it looks like this branch contains unrelated changes that were accidentally committed. Specifically, the changes to \�pp/generator/data/socials.ts\ and \services/github/ci-analytics.ts\ do not belong in this PR.
To fix this, please revert the changes to those files using \git restore\ or \git checkout\ so that this PR is focused entirely on the GitHub API rate limit and token handling.
Looking forward to getting this merged once the branch is cleaned up!
Label Justification:
- \level:advanced: Implementing complex request coalescing, abort controller logic, and rate-limit backoff across the API layer is an advanced task.
- \ ype:bug\ & \ ype:security: Prevents token exhaustion and handles API edge cases securely.
- \mentor:Aamod007: Assigned as required.
Description
Fixes #6239
This PR resolves critical issues related to GitHub GraphQL rate limit exhaustion and token exposure vulnerabilities.
Specific changes include:
lib/github.tswhere request deduplication was bypassed for requests providing anoptions.signal. The background cache-populating fetch is now properly decoupled from individual request abort signals, preventing duplicate GraphQL calls for concurrent same-user requests.TypeError) and converted them into generic errors. This guarantees thatRequestobjects, which contain theAuthorizationheader with the Personal Access Token (PAT), are stripped and never logged to serverless dashboards or exposed to clients.Pillar
Visual Preview
No visual changes. This PR strictly improves backend API resilience, rate limit handling, and token security.
Checklist before requesting a review:
CONTRIBUTING.mdfile.localhost:3000/api/streak?user=YOUR_USERNAME).npm run formatandnpm run lintlocally and resolved all errors (CI will fail otherwise).feat(themes): ...,fix(calculate): ...).README.mdif I added a new theme or URL parameter.