From cee324725c38e9cbebe64756dad86698f6ef8333 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 6 May 2026 13:20:45 +0000
Subject: [PATCH] CI: pass GH_TOKEN to install/update steps to dodge GitHub API
 rate limits

studio/install_llama_prebuilt.py lists releases on
ggml-org/llama.cpp via the GitHub API. Unauthenticated calls get
60/hr per source IP, which is fine for one install per workflow but
the new Studio Update CI does install + update + update back-to-back
on the same runner, blowing past the limit and falling back to a
source build (which then fails the idempotency assertion).

Surfaced on the Studio Update CI run with:
  failed to inspect published releases in ggml-org/llama.cpp:
  GitHub API returned 403 ...
  set GH_TOKEN or GITHUB_TOKEN to avoid GitHub API rate limits.

GITHUB_TOKEN with the existing `permissions: contents: read` is more
than enough for unauthenticated read API access (1000/hr, scoped to
the repo). Wired into every install.sh and `unsloth studio update`
step across studio-update-smoke.yml, studio-inference-smoke.yml, and
studio-ui-smoke.yml so a busy runner can't trip the same fallback.
---
 .github/workflows/studio-inference-smoke.yml |  6 ++++++
 .github/workflows/studio-ui-smoke.yml        |  2 ++
 .github/workflows/studio-update-smoke.yml    | 11 +++++++++++
 3 files changed, 19 insertions(+)

diff --git a/.github/workflows/studio-inference-smoke.yml b/.github/workflows/studio-inference-smoke.yml
index 2b0517250b..36d581b2b3 100644
--- a/.github/workflows/studio-inference-smoke.yml
+++ b/.github/workflows/studio-inference-smoke.yml
@@ -101,6 +101,8 @@ jobs:
             hf download "$GGUF_REPO" "$GGUF_FILE"
 
       - name: Install Studio (--local, --no-torch)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p logs
           set -o pipefail
@@ -327,6 +329,8 @@ jobs:
             hf download "$GGUF_REPO" "$GGUF_FILE"
 
       - name: Install Studio (--local, --no-torch)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p logs
           set -o pipefail
@@ -630,6 +634,8 @@ jobs:
             hf download "$GGUF_REPO" "$MMPROJ_FILE"
 
       - name: Install Studio (--local, --no-torch)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p logs
           set -o pipefail
diff --git a/.github/workflows/studio-ui-smoke.yml b/.github/workflows/studio-ui-smoke.yml
index 0b678a636d..c3f96784c1 100644
--- a/.github/workflows/studio-ui-smoke.yml
+++ b/.github/workflows/studio-ui-smoke.yml
@@ -83,6 +83,8 @@ jobs:
             hf download "$GGUF_REPO" "$GGUF_FILE"
 
       - name: Install Studio (--local, --no-torch)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p logs
           set -o pipefail
diff --git a/.github/workflows/studio-update-smoke.yml b/.github/workflows/studio-update-smoke.yml
index f4a481b4ad..4edf157cdb 100644
--- a/.github/workflows/studio-update-smoke.yml
+++ b/.github/workflows/studio-update-smoke.yml
@@ -59,6 +59,13 @@ jobs:
           cache: 'pip'
 
       - name: Install Studio (--local, --no-torch)
+        # Pass the workflow token so the llama.cpp prebuilt installer's
+        # GitHub-API call to list releases isn't rate-limited (60/hr
+        # unauthenticated). Without this, three consecutive install +
+        # update + update calls in this job exceed the limit and the
+        # prebuilt path falls back to source build.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p logs
           set -o pipefail
@@ -71,6 +78,8 @@ jobs:
         # take the "prebuilt up to date and validated" code path. Any
         # source-build fallback or re-download here means setup.sh's
         # idempotency regressed.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -o pipefail
           unsloth studio update --local 2>&1 | tee logs/update.log
@@ -91,6 +100,8 @@ jobs:
         # flow (auto-update, then user-triggered update). Asserting the
         # second run is also clean rules out hidden state changes from
         # the first one.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -o pipefail
           unsloth studio update --local 2>&1 | tee logs/update2.log