sneak
b38d33f817
check / check (push) Failing after 21s
/metrics is behind a password, and REPO_POLICIES.md requires rate limiting on password logins. Each client address may now send it 30 requests a minute, counted by httprate before Basic Auth, so failed logins use up the allowance and a request over it gets 429 without the password being checked. The address is the one the existing trusted-proxy logic in internal/middleware works out, with IPv6 addresses grouped by /64. A Prometheus server scraping every 15 seconds sends 4 requests a minute. Model: opus-5-5