GitHub Authentication fails silently

[tobsecret]

Bug report

Expected behavior and actual behavior

Expected behavior:
When trying to authenticate with GitHub (or other services) and failing, Nextflow should give a clear warning, then continue to try and perform what it tried unauthenticated.

Observed behavior:
Nextflow GitHub authentication fails silently, then tries to pull from GitHub unauthenticated. This sometimes works and sometimes hits the GitHub unauthenticated rate limit. Because we don't get a warning that our authentication failed, it's not clear if our token reached the rate limit or if authentication failed.

Steps to reproduce the problem

nextflow.config

providers {
    github {
        user = 'myuser'
        password = 'a_token_mistakenly_used_as_a_password'
    }
}

pull_repo.sh

nextflow pull nf-core/sarek

Program output

Pulling nf-core/sarek ...
WARN: Cannot read project manifest -- Cause: API rate limit exceeded -- Provide your GitHub user name and password to get a higher rate limit
API rate limit exceeded -- Provide your GitHub user name and password to get a higher rate limit

Sometimes this will work despite no authentication since GitHub does allow some amount of unauthenticated requests per hour.

Environment

• Nextflow version: 24.10.5
• Java version: [?]
• Operating system: linux
• Bash version:

Additional context

Ran into this in our build and testing pipeline which was both using outdated credentials and an incorrect config file. I thought that the problem was using password instead of token but a message telling me that Github Authentication failed would have been helpful. If this is available via verbose nextflow, I think this should be printed by default even without verbose.

UPDATE: still failing, even when using token instead of password

[bentsherman]

@jorgee looked into this and found that the GitHub API does not return an error response when accessing a public repository with invalid credentials, it just ignores the credentials. So this seems like a limitation of the GitHub API

We might be able to get around this in Nextflow by requesting some private resource that is guaranteed to fail if the credentials are invalid. Maybe the user info? Or maybe there is some query param in the GitHub API to force an error response even when the resource is public

[tobsecret]

That sounds good, thanks for looking into this!