Frequent "java.net.UnknownHostException: raw.githubusercontent.com" on Wild Web Developer CI

In ci.eclipse.org/wildwebdeveloper, we've started to see very frequent java.net.UnknownHostException: raw.githubusercontent.com for build steps that have been always successful for a while. Anything we can do here?

assigned to @webmaster

We have seen such errors before, probably related to DNS issues.

@webmaster can you take a look?

/cc me

we have the same on Xtext regularly https://ci.eclipse.org/xtext/job/releng/job/sign-and-deploy/1360/ #913 (closed)

marked #913 (closed) as a duplicate of this issue

marked this issue as related to #913 (closed)

it happens also on ci.eclipse.org/xtext (see #913 (closed))

I just found that raw.githubusercontent.com has a rate limit of about 5000 requests/hour/IP (https://github.com/github/docs/issues/8031#issuecomment-881427112). I know that java.net.UnknownHostException: raw.githubusercontent.com seems unrelated, but maybe we are getting the wrong exception for this cause? I mention that because a DNS resolution issue on EF's infra side would manifest on many domains and for a longer period of time. Here, we see the issue for raw.githubusercontent.com and only from time to time...

If the rate limit is the issue and as all Jenkins instances retrieve artifacts from raw.githubusercontent.com from the same public IP address, so there is not much we can do from the EF infra side unfortunately.

Related bug for platform releng: https://bugs.eclipse.org/bugs/show_bug.cgi?id=578862

Does it mean, if we move all of the platform projects to github (https://bugs.eclipse.org/bugs/show_bug.cgi?id=577322), jenkins builds will be like a Russian roulette (which is what we see now with SDK builds)?

Some of my Oomph builds builds have been failing with this problem a few times last week and again last night. This seems like a new problem that started happening first last week...

One option is to avoid using raw.githubusercontent.com and get the file content from an authenticated API call. Authenticated API calls are still rate limited. However, as all projects have their own bot, each one can use its own bot's credentials and the rate limit will thus be specific to their project and won't depend on others anymore.

See below an example (note that $BOT and $BOTTOKEN would need to be injected via withCredentials Jenkins directive. If you don't know what this means, we can help).

$ curl -sSL -u $BOT:$BOTTOKEN \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/eclipse/xtext-lib/contents/gradle/versions.gradle | jq -r '.content' | base64 -d
/*
 * Base project version and versions of common dependencies.
 */

version = '2.26.0-SNAPSHOT'

ext.versions = [
	'xtext_bootstrap': '2.26.0.M3',
	'xtext_gradle_plugin': '3.0.1',
	'gwt': '2.8.2'
]

See https://docs.github.com/en/rest/reference/repos#get-repository-content for the full API doc (e.g., you can retrieve a branch specific content by adding ?ref=branch_name to the URL above. Default is to retrieve content from configured default branch)

Note that authenticated calls are limited to 5k/hour/authenticated user

My access is from a Java application so curl won't help:

https://ci.eclipse.org/oomph/job/setup-archiver/lastBuild/console

This problem seems new...

My access is from a Java application so curl won't help:

https://ci.eclipse.org/oomph/job/setup-archiver/lastBuild/console

You can do authenticated HTTP calls from Java...

This problem seems new...

It's most probably due to the fact that more and more projects are moving to Github ( Eclipse Platform et al.) and using raw.githubusercontent.com to fetch some artifacts from there.

we see this all the time. i will try to work around it to be able to build Xtext milestone what do i need to pass to withCredentials clause?

jq also seems not to be available

line 2: jq: command not found

changed title from Frequest "java.net.UnknownHostException: raw.githubusercontent.com" on Wild Web Developer CI to Frequent "java.net.UnknownHostException: raw.githubusercontent.com" on Wild Web Developer CI

mentioned in issue #925 (closed)

marked this issue as related to #925 (closed)

marked #925 (closed) as a duplicate of this issue

@mbarbero @fgurr do you have any idea how to get the withcredentials working so that string interpolation wont complain https://ci.eclipse.org/xtext/job/releng/job/test-raw.githubusercontent.com/15/console

It comes down to quoting. See https://www.youtube.com/watch?v=yfjtMIDgmfs for a good full explanation.

still have struggles

withCredentials([string(credentialsId: "${GITHUB_API_CREDENTIALS_ID}", variable: 'GITHUB_API_TOKEN')]) {
                    script {
                    env.BRANCH_REF="master"
                    def id ="log4j:log4j"
                    env.CURSE="grep -Po \"${id}[^\\d]*\\K[^']*\""
                    def result = sh (script: 'curl -sSL -H "Cookie: logged_in=no" -H "Authorization: token $GITHUB_API_TOKEN" -H "Content-Type: text/plain; charset=utf-8" https://api.github.com/repos/eclipse/xtext-lib/contents/org.eclipse.xtext.dev-bom/build.gradle?ref=$BRANCH_REF | jq -r ".content" | base64 -d | $CURSE', returnStdout: true).trim()
                    }
                    
                }

does work

                withCredentials([string(credentialsId: "${GITHUB_API_CREDENTIALS_ID}", variable: 'GITHUB_API_TOKEN')]) {
                    script {
                    env.BRANCH_REF="master"
                    env.CURSE="log4j:log4j:"
                    def result = sh (script: 'curl -sSL -H "Cookie: logged_in=no" -H "Authorization: token $GITHUB_API_TOKEN" -H "Content-Type: text/plain; charset=utf-8" https://api.github.com/repos/eclipse/xtext-lib/contents/org.eclipse.xtext.dev-bom/build.gradle?ref=$BRANCH_REF | jq -r ".content" | base64 -d | grep -Po \'api \\\"$CURSE:\\K[^\"]*\'', returnStdout: true).trim()
                    }
                    
                }

does not. what stops interpolation in the 2nd for CURSE but makes it work in the first

It seems you got it with https://ci.eclipse.org/xtext/job/releng/job/test-raw.githubusercontent.com/43/console, correct?

yes and no. i finally have up and use files for places where it does not work. and also having all the artifical env vars is bad. see https://github.com/eclipse/xtext-umbrella/pull/296

mentioned in issue #946 (closed)

marked #946 (closed) as a duplicate of this issue

marked this issue as related to #946 (closed)

mentioned in issue #1032 (closed)

marked #1230 (closed) as a duplicate of this issue

marked this issue as related to #1230 (closed)

mentioned in issue #1230 (closed)

Closing. Please re-open if necessary.

closed

marked this issue as related to #1382 (closed)

marked this issue as related to #1446 (closed)

mentioned in issue #1446 (closed)

In our case, https://ci.eclipse.org/lsp4mp/job/lsp4mp/job/PR-283/ , Tycho fetches from a .target file that contains <location type="Target" uri="https://raw.githubusercontent.com/eclipse/eclipse.jdt.ls/master/org.eclipse.jdt.ls.target/org.eclipse.jdt.ls.tp.target"/> .

I don't think there's a way (yet) to tell Tycho to include certain headers (eg. Authorization) in all its requests.

Update : In our case, we just realized we also deploy the target file to repo.eclipse.org, so we can use that directly for now.

If this is not possible with configuration of simple authentication files somewhere, Then one alternative is to create a proxy that does add the header (eg https://stackoverflow.com/questions/154441/set-up-an-http-proxy-to-insert-a-header ) and configure Tycho/Maven/p2/... to use this proxy instead of raw.githubusercontent.com.

mentioned in issue eclipse-wg/oniro-wg/products-services-oniro-wg/it-services-oniro-wg/pipelines-architecture-oniro-wg#20 (closed)

marked #2187 (closed) as a duplicate of this issue

marked this issue as related to #2187 (closed)

mentioned in issue #2187 (closed)

mentioned in issue #2206 (closed)

mentioned in issue eclipsefdn/it/api/eclipsefdn-cve-api#16 (closed)

marked this issue as related to #2304 (closed)

mentioned in issue #2304 (closed)