fix(traffic): require a traffic-capable PAT for the archive workflow#265
Merged
Conversation
The daily Archive GitHub Traffic run has failed since creation: the TRAFFIC_ARCHIVE_TOKEN secret was never provisioned, so the workflow fell back to github.token, which GitHub categorically rejects on traffic endpoints (403 "Resource not accessible by integration"). - Fall back to the existing POLL_NVD_CVES_PAT automation token instead of github.token, keeping TRAFFIC_ARCHIVE_TOKEN as the preferred override once provisioned. - Fail fast with an actionable error when no traffic-capable token is configured. - Explain token requirements in the script's 401/403 errors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…AT fallback A live dispatch confirmed POLL_NVD_CVES_PAT is expired (401 Bad credentials), so falling back to it only trades one daily failure for another. Require the dedicated secret and fail fast with setup instructions instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
Comment on lines
+326
to
+329
| const hint = lacksPushAccess | ||
| ? ' Traffic endpoints require a token with push access to the repository; the Actions GITHUB_TOKEN is always rejected. Use a classic PAT with the repo scope or a fine-grained PAT with read access to Administration.' | ||
| : response.status === 401 | ||
| ? ' The token was rejected as invalid — it may be expired or revoked. Rotate the TRAFFIC_ARCHIVE_TOKEN secret.' |
Contributor
There was a problem hiding this comment.
The invalid-token hint is gated only on response.status === 401, but GitHub can return 403/404 for auth failures too — should we key this off the error body (for example Bad credentials) or include those cases as well?
Want Baz to fix this for you? Activate Fixer
Other fix methods
Prompt for AI Agents
Before applying, verify this suggestion against the current code. In
scripts/archive-github-traffic.mjs around lines 321-332 inside the `if (!response.ok)`
error handling, the token-invalid/expired hint is currently only shown when
`response.status === 401` (lines ~328-330). Refactor the `hint` selection so it also
covers GitHub’s documented auth/permission failure variants (notably 403 and 404) by
keying off the response body text (e.g., look for “Bad credentials” /
authentication-failure phrases) rather than status alone, while keeping the existing
dedicated “missing push access” hint for 403 with the “resource not
accessible/must have push access” messages. Ensure the body-based checks are used in
the right precedence order so unrelated 401s don’t incorrectly get the expired-token
message, and revoked/expired tokens get the correct hint for 401/403/404 shapes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary
The daily Archive GitHub Traffic workflow (example failure) has failed on every scheduled run since it was added in #252, so no traffic history has been captured yet. Root cause: the
TRAFFIC_ARCHIVE_TOKENsecret was never provisioned, and the|| github.tokenfallback can never work — GitHub rejects the Actions installation token on all traffic endpoints (403 Resource not accessible by integration). Traffic endpoints require a PAT from a user with push access.Changes
.github/workflows/archive-traffic.yml—GH_TRAFFIC_TOKENnow usessecrets.TRAFFIC_ARCHIVE_TOKENonly (thegithub.tokenfallback was guaranteed to 403). When the secret is missing, the step fails fast with an actionable::errorannotation instead of a cryptic API error.scripts/archive-github-traffic.mjs— 403 push-access failures and 401 invalid-token failures now append a hint explaining the token requirements.scripts/test-github-traffic-archive.mjs— new tests for the 401/403 hints; the workflow-shape test now assertsGH_TRAFFIC_TOKENbinds tosecrets.TRAFFIC_ARCHIVE_TOKENand never togithub.token.Live verification (workflow_dispatch from this branch)
POLL_NVD_CVES_PAT— it returned 401 Bad credentials, i.e. that PAT (set 2026-02-05) is expired or revoked, so the fallback was dropped.repo-scoped token from a maintainer was confirmed to read/traffic/viewssuccessfully (834 views / 378 uniques in the current 14-day window).Required follow-up after merge (ops)
reposcope also works), owned by a user with push access.gh secret set TRAFFIC_ARCHIVE_TOKEN --repo prompt-security/clawsecgh workflow run archive-traffic.yml --repo prompt-security/clawsec— the first green run creates thetraffic-archivebranch and seeds it with the current 14-day window.⏳ GitHub only retains ~14 days of traffic data; each day without the secret permanently loses a day of history.
Heads-up (separate issue)
POLL_NVD_CVES_PATreturning 401 also means thecommunity-advisory.ymlautomation will fail the next time an issue is labeledadvisory-approved— that PAT needs rotation regardless of this PR.🤖 Generated with Claude Code
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Clarify the archive workflow token requirements by binding
GH_TRAFFIC_TOKENexclusively tosecrets.TRAFFIC_ARCHIVE_TOKENand failing fast with guidance when the secret is missing. Enhancearchive-github-traffic.mjsand its tests to append specific hints for 403/401 errors so operators know to provide a push-capable PAT.secrets.TRAFFIC_ARCHIVE_TOKEN, report an actionable error when absent, and only runarchive-github-trafficonce the token guard passes.Modified files (1)
Latest Contributors(2)
scripts/archive-github-traffic.mjsand its tests to append push-access or rotation hints on 403/401 responses so failures point to the required PAT credentials.Modified files (2)
Latest Contributors(2)