Repository navigation
fix(ci): authenticate live E2E RPC requests - #984
Merged
Merged
Conversation
Co-authored-by: Derek Cofausper <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Member
|
A probe from a GitHub runner using the secret (key never printed) showed:
Keyed 429s return both The proxy in Two changes would make the key useful:
|
snario
added a commit
that referenced
this pull request
Oct 14, 2026
#984 appended TEMPO_RPC_API_KEY to rpc.moderato.tempo.xyz, but that load balancer does not know Tempo API keys. Requests counted as anonymous and hit the per-IP connection limit, and from one IP the Node proxy's many connections broke live tests even on GitHub runners. api.tempo.xyz/rpc/:chainId takes the key as a Bearer token with the `data:read` scope and reaches Moderato as an authenticated client, which the per-IP limit does not apply to. From one runner it served 180 concurrent requests without a 429; the public RPC rejected 123. The Verify workflow passes the key to Playwright again. Co-Authored-By: Liam Horne <[email protected]> Co-Authored-By: Claude Opus 5.5 <[email protected]>
snario
added a commit
that referenced
this pull request
Oct 14, 2026
* ci: run E2E shards on Depot with authenticated Moderato RPC TEMPO_RPC_API_KEY is now configured, so live tests reach Moderato through an authenticated relay instead of the anonymous per-IP pool that Depot's shared egress IPs exhausted. The shards move to the same 8-core Depot runners as the build and run six Playwright workers. Co-Authored-By: Liam Horne <[email protected]> Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(e2e): send live Moderato RPC through the Tempo API proxy #984 appended TEMPO_RPC_API_KEY to rpc.moderato.tempo.xyz, but that load balancer does not know Tempo API keys. Requests counted as anonymous and hit the per-IP connection limit, and from one IP the Node proxy's many connections broke live tests even on GitHub runners. api.tempo.xyz/rpc/:chainId takes the key as a Bearer token with the `data:read` scope and reaches Moderato as an authenticated client, which the per-IP limit does not apply to. From one runner it served 180 concurrent requests without a 429; the public RPC rejected 123. The Verify workflow passes the key to Playwright again. Co-Authored-By: Liam Horne <[email protected]> Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Liam Horne <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live demo E2E tests currently use the anonymous Moderato RPC pool, where rate limits can block docs CI. Forward their HTTP RPC requests from the Playwright runner using the optional
TEMPO_RPC_API_KEYActions secret, and block anonymous WebSocket fallback when the key is present.The key stays out of the site build and browser requests. Node fetch avoids recording the authenticated URL in Playwright traces, and upstream fetch exceptions are sanitized. Tests without a key retain public RPC access. The deployed public demo is unchanged.
Setup: add a dedicated Moderato RPC key as the
TEMPO_RPC_API_KEYrepository Actions secret. This PR wires the secret; it does not provision one.Validation: four browser transport checks pass, covering authenticated forwarding, upstream rate limits, sanitized failures, and WebSocket fallback. Browser network traces contain no test key. Repository type checks, targeted E2E type checks, Biome, and Playwright discovery (277 tests) pass. A real authenticated live run still requires the secret.
Prompted by: @Zygimantass