policy rate_limiting ai_generated partial

GitHub API returns 403 Abuse Detection for legitimate CI/CD automation

ID: policy/github-api-abuse-detection-cicd

Also available as: JSON · Markdown
68%Fix Rate
80%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

GitHub's abuse detection triggers on patterns, not just rate: creating many PRs quickly, commenting on many issues, rapid content creation, or concurrent identical requests. Legitimate CI/CD tools are frequently flagged.

generic

Workarounds

  1. 90% success Add 1-2 second delays between mutating API calls (create/update/delete) 
    time.sleep(1)  # between each PR creation, comment, or issue update
  2. 85% success Use GraphQL for read-heavy workloads (single request for multiple resources) 
    GraphQL queries count as single request. Fetching 100 PRs via REST = 100 requests, via GraphQL = 1.
  3. 88% success Implement exponential backoff with minimum 60s wait on 403 
    On 403 abuse detection: wait 60s, then 120s, then 240s. Check Retry-After header if present.

Dead Ends

Common approaches that don't work:

  1. Stay under the documented 5000 req/hr rate limit 85% fail

    Abuse detection is behavior-based, not rate-based. You can be flagged at 50 req/hr if the pattern looks automated (rapid sequential mutations).

  2. Use a GitHub App instead of PAT to avoid abuse detection 78% fail

    GitHub Apps have higher rate limits but are equally subject to abuse detection on mutation endpoints.