Add selective retries for STS token exchange#532
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
| import { AuthClient, Client, ClientParameters } from './client'; | ||
|
|
||
| const STS_MAX_ATTEMPTS = 4; | ||
| const STS_RETRY_BACKOFF_MILLISECONDS = 100; |
There was a problem hiding this comment.
A delay of <1 second across all 4 attempts might be too short to see the backend to recover.
Please, consider bumping the base backoff up. For example, using a 500ms base will provide delays of 500ms, 1s, 2s, which buys a more resilient 3.5 seconds for the backend to recover.
| `Failed to generate Google Cloud federated token: operation=token_exchange, ` + | ||
| `endpoint_class=${endpoint}, status=${status}, ` + | ||
| `error_class=${failure.errorClass}, attempt=${attempt}/${STS_MAX_ATTEMPTS}`, |
There was a problem hiding this comment.
Hiding the entire resp.result object here makes a lot of sense.
Including resp.result?.error_description || resp.result?.error?.message shouldn't harm and will provide more insights into the error.
kkarrenn
left a comment
kkarrenn
left a comment
There was a problem hiding this comment.
Thank you for this PR! Added a couple of comments below.
2 participants
Summary
The workload identity flow retries GitHub OIDC token retrieval, but
@actions/http-clientdoes not retry the POST to Google Security Token Service. A transient connection reset or socket timeout therefore ends authentication on the first failed exchange.This change adds four bounded STS attempts with 100, 200, and 400 ms backoffs. Retries are limited to connection failures and HTTP 408, 429, 500, 502, 503, and 504 responses. HTTP 400, 401, 403, empty responses, and unknown errors fail without retrying.
Attempt diagnostics contain only the operation, STS hostname, status or classified error, and attempt count. The existing STS request and computed-audience debug messages were removed so these diagnostics do not include the OIDC assertion, returned access token, headers, credential data, service account, or workload identity provider resource.
Mocked tests cover each retryable HTTP status, connection errors, the uncoded
@actions/http-clientsocket timeout, permanent HTTP failures, the four-attempt limit, and diagnostic redaction.