bug: using github api for enumerating releases etc can hit rate-limiting

[philclifford]

I confirm this bug has not already been reported

• I have searched the issues and this bug has not been reported previously

Release enumeration quietly fails

Quickget output

Quickget output

quickget vanillaos

Vanilla OS
- Credentials:	-
- Website:	https://vanillaos.org/
- Description:	Designed to be a reliable and productive operating system for your daily work.
- Releases:	

ERROR! You must specify a release.

# This affects only 4 distros: 

grep -o -e "\"https://api.github.com/.*\"" quickget|cut -d \" -f 2
https://api.github.com/repos/Athena-OS/athena/releases
https://api.github.com/repos/CBPP/cbpp/releases
https://api.github.com/repos/Vanilla-OS/live-iso/releases
https://api.github.com/repos/CBPP/cbpp/releases
https://api.github.com/repos/HoloISO/releases/releases
https://api.github.com/repos/Vanilla-OS/live-iso/releases

Additional context
Adjusting the calls to use authenticated connections overcomes the problem, but we don't want to require some users of a few distros to set up GitHub accounts and tokens so probably better to find another way (most cases parsing the releases/latest release html is reasonable)

[lj3954]

Is this an issue anyone experiences in real world usage? 60 unauthenticated requests an hour is quite a lot, and if someone is using other tools which access the GitHub API on premises, it's quite likely those requests are authenticated (and thus shouldn't count against the unauthenticated ipaddr limit).

[philclifford]

Well I noticed when I ran the cog update of the list of supported distros that a few were missing in the diff. Turns out it was rate limiting. Afaik all my other API calls are authenticated. If I remember to selectively stage changed lines it won't matter but nevertheless it shouldn't be a problem but is.

[philclifford]

Single request to an api for a repo I don't have auth for (atuin) hit a rate-limit ... On closer inspection it seems EE-mobile funnels a lot of github request through a small number of NATed IPs. So when I'm out and about I have to use a tailnet exit node to have a chance of using the github api reliably without an auth token.