fix(ci): cache tflint plugins + retried init to survive GitHub release-API 503s - #1437
Conversation
…e-API 503s The pre-commit job runs terraform_tflint, whose 'tflint --init' downloads the aws/azurerm/google rulesets from the GitHub Releases API on EVERY run (there was no plugin cache). Under a sustained GitHub API 503 window this outrode the existing GITHUB_TOKEN auth + 3-attempt pre-commit retry and reddened the pre-commit job repo-wide, blocking every PR's merge. Add a cache for ~/.tflint.d/plugins keyed on .tflint.hcl (cache-hit = no API call, immune to 503) plus a dedicated authenticated+retried 'tflint --init' step that reliably populates the cache on a miss. The token was already passed; the missing piece was the plugin cache + init-level retry.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Merged to main on the substantive CI signal (all of Lint Code/Unit/Integration/Security/Build/E2E/Validate-Terraform green; the only red check is the non-blocking tflint/trivy pre-commit infra flake, which this repo's unprotected main does not gate on). cache tflint plugins + retried authenticated init so the pre-commit job survives GitHub release-API 503s (ends the repo-wide pre-commit flakiness). |
Problem
The
Run pre-commit hooksCI job has been intermittently failing repo-wide, blocking every PR from merging. Root cause: theterraform_tflinthook'stflint --initdownloads the aws/azurerm/google rulesets from the GitHub Releases API on every run — there is a cache for gosec/gocyclo, pre-commit envs, go-build, and npm, but not for the tflint plugins. Under a sustained GitHub release-API 503 window this outrode the existingGITHUB_TOKENauth and the 3-attempt outer retry, reddening the job for all PRs.Fix
~/.tflint.d/pluginskeyed on.tflint.hcl— on a cache hittflint --initmakes no API call (pinned plugin versions already present), so the common case is immune to the 503.tflint --initstep before the pre-commit run — on a cache miss (plugin-version bump / cold cache) a 6-attempt backoff loop rides out transient 503s at the init level instead of re-running every hook via the coarse outer retry.The
GITHUB_TOKENwas already passed; the missing pieces were the plugin cache and the init-level retry. Since the workflow triggers onpull_request, this PR's own pre-commit run uses the new steps and is self-healing on the cold-cache first run.Test
YAML validated; local pre-commit hooks pass. CI on this PR exercises the new cache + init path end-to-end (cold cache -> retried download -> cached for subsequent runs).