惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

D
Docker
阮一峰的网络日志
阮一峰的网络日志
T
Tailwind CSS Blog
博客园 - 【当耐特】
量子位
博客园 - 叶小钗
有赞技术团队
有赞技术团队
Jina AI
Jina AI
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
博客园 - Franky
博客园 - 司徒正美
爱范儿
爱范儿
美团技术团队
小众软件
小众软件
酷 壳 – CoolShell
酷 壳 – CoolShell
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
V
V2EX
罗磊的独立博客
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
Last Week in AI
Last Week in AI
Hugging Face - Blog
Hugging Face - Blog
I
InfoQ
D
DataBreaches.Net
宝玉的分享
宝玉的分享

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant
I accidentally built a bot whose only job was to attack o...
Aidan Urbina · 2026-06-16 · via DEV Community

Aidan Urbina

Close one issue. That's all it took.

One click closed an issue on GitHub. That closed the linked task in our app. Closing the task fired our own "task changed" listener, which pushed the change back to GitHub, which closed the issue again, which fired another webhook, which closed the task again. I had built a machine whose entire job was to bury GitHub's API in its own echo.

It ran fine in testing. Of course it did. Loops need a real round trip to form, and my test never went all the way around the circle. The bug was waiting for production like it had manners.

Both directions worked, and that was the bug

When we wired up two-way sync between GitHub issues and sparQ tasks, the happy path was easy. Close an issue on GitHub, we close the task. Close a task in sparQ, we close the issue. Both directions worked the first time I tried them.

The thing is, "both directions worked" is the bug. Reading activity one way is forgiving. The moment you sync two systems in both directions, you get a failure mode that one-way sync simply cannot have: the loop.

It goes like this. A close comes in from GitHub over a webhook. We close the task. But closing a task is a change, and we have a listener watching for task changes so it can push them back to GitHub. So it pushes. GitHub closes the issue. GitHub fires a webhook telling us the issue closed. We close the task. Which is a change. Which we push. Which closes the issue. You can see where the rest of the afternoon went.

No single step is wrong. Each one is doing exactly its job. Arranged in a circle, they become a feedback loop whose only output is more work for itself.

The fix is boring, and that's the point

Before we apply a change that came from GitHub, we set a flag that says "this one came from a sync, do not bounce it back."

_SYNC_IN_PROGRESS[task.id] = True
try:
    Task.resolve(task.id, resolver_id=None, note="Closed via GitHub")
finally:
    _SYNC_IN_PROGRESS.pop(task.id, None)

Then the listener that pushes changes to GitHub checks the flag first and stays quiet while it's up:

if _SYNC_IN_PROGRESS.get(target.id, False):
    return

That's the whole thing. A dict, a flag, a try/finally. The GitHub change still closes the task, but the push-back is suppressed for that one task while the flag is set, so the circle never closes.

One detail I like: when GitHub closes a task, we resolve it with resolver_id=None. The None isn't laziness. It's the marker that a system did this, not a person, so the activity log can say "closed via GitHub" instead of stamping someone's name on a thing they never touched. The flag stops the loop. The None keeps the history honest.

What it taught me

Two-way sync is not "one-way sync, twice." The second direction hands you a whole category of bug the first one can't have. Once a change can travel in a circle, you need some way to tell "a person did this" apart from "the sync did this," or you end up with a very dedicated little machine for attacking your own API.

It never showed up in a single test. It showed up the first time a real close traveled all the way around the loop. A dict and a flag are the only thing standing between a working sync and a self-inflicted outage.

sparQ is open source (AGPL v3) and self-hostable. The sync lives in pulse/modules/integrations/github/sync.py if you want to read the rest.