API delivering outdated information.

[jkowalleck]

Under certain circumstances (described here),
https://www.bestpractices.dev/projects/7953/badge.json / https://bestpractices.coreinfrastructure.org/projects/7953/badge.json
delivers outdated (cached?) information.

Expected response:

{"id":7953,"name":"CycloneDX PHP ComposerPlugin","updated_at":"2023-10-18T00:12:11.928Z","badge_level":"passing","tiered_percentage":125}

But for some client, the observed response always is:

{"id":7953,"name":"cyclonedx/cyclonedx-php-composer","updated_at":"2023-10-15T14:15:00.046Z","badge_level":"in_progress","tiered_percentage":24}

see badges/shields#9660 (comment) for more details and analysis.

[jkowalleck]

*Update: 2023-10-20

New issue: also the badge you provide yourself shows a 99% while it shows a "100%" in the top bar

[andrewfader]

probably related to our production caching

[david-a-wheeler]

This is very very strange. I thought we'd fixed this.

My best hypothesis is that this is a race condition in the communication between our site and our CDN (Fastly). We update our data and send a "remove from cache" message. However, if the CDN requests a data retrieval, executes a remove from cache, and then receives the data with old data, it would put old data into the cache. I don't see anything in the APIs that can fully prevent this, if that's what is going on.

If that's the problem, then maybe we need to re-send "remove from cache" messages later, to reduce the time where it can occur. That's basically harmless ("do no harm").

Other ideas welcome.