api.github.com requests from actions often throw 403

[MichaIng]

Select Topic Area

Question

Body

Since some weeks, when accessing https://api.github.com/repos/<owner>/<repo>/releases/latest to fetch latest release information for a repo from within a GitHub actions workflow, the API returns 403 in around 50% of cases.

Has a new rate limit been implemented or made stricter, which applies as shared across GitHub hosted runners? If so, is there something which can be done to work around it, like passing a token (curl used in our case). In our case it is often the very first network request done to GitHub, hence the workflow itself cannot hit a rate limit by itself.

Wishing everyone happy Christmas holidays and happy new year 2023 🥳 🚀.

[paescuj]

Has a new rate limit been implemented or made stricture, which applies as shared across GitHub hosted runners?

I do wonder the same! Lately, I've seen many workflows that suddenly stopped working because of this.
Cannot see a corresponding announcement at https://github.blog/changelog/.

Note: It seems that this applies to all endpoints, not just releases.

[MichaIng]

Since last few days the issue seems to be gone, along with a significant faster workflow execution. Probably related to: https://www.githubstatus.com/incidents/00km0kwpz23b?utm_ts=1673373278
Workflows are faster than before (before the indeed major slowdown for a few ways), so there seem to have been quite some updates 🙂.

Can you confirm?

[paescuj]

I can indeed confirm that at least some of the workflows that failed for this reason now seem to be working again!
Nevertheless, it would give a bit more certainty to see an official statement from GitHub...

[MichaIng]

Note solved, just ran into a 403 again.

EDIT: Wasn't there a way to pass GITHUB_TOKEN via header to increase the rate limit?

EDIT2:

curl -H 'Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' https://api.github.com/...

• https://docs.github.com/en/rest/rate-limit
• https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limits-for-requests-from-github-actions

[paescuj]

EDIT: Wasn't there a way to pass GITHUB_TOKEN via header to increase the rate limit?

Absolutely, but it used to work before without a token... So I wonder why it suddenly stopped working (without notice).

[MichaIng]

Absolutely, but it used to work before without a token... So I wonder why it suddenly stopped working (without notice).

Same here. I used the token for link checkers where some HTML pages with a lot of links to GitHub repos, issues, PRs etc are checked with high concurrency. But for one or two API calls in a workflow, it was never required. So something must have changed either with more GitHub runners sharing the same IP than before, or stricter API rate limits per IP.

EDIT: Just got a 403 even with token passed 🤔.

[MichaIng]

Marked the token method as answer. There is still a rate limit even with token, but it is much higher. While at first I thought it makes sense to not rate limit from GitHub Actions to GitHub API, it actually makes sense: Nothing prevents intended or accidental request floods from within a GitHub Action, and everyone can run several runners in parallel. Protecting the API infrastructure from such makes hence sense.

And also, I did not receive any 403 lately, aside of from the mentioned link check, where hundreds to thousands of GitHub URLs (though with a cache for duplicates) are checked in 10-20 seconds 😅.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬