Skip to content

fix(github-runner): report GitHub App rate limit from registration token response - #5429

Open
tehlers320 wants to merge 1 commit into
github-aws-runners:mainfrom
tehlers320:metric-github-app-rate-limit-registration-token
Open

tehlers320 wants to merge 1 commit into
github-aws-runners:mainfrom
tehlers320:metric-github-app-rate-limit-registration-token

Conversation

@tehlers320

Copy link
Copy Markdown

Summary

`getGithubRunnerRegistrationToken()` (the classic, non-JIT registration flow) never called `metricGitHubAppRateLimit`, unlike its JIT sibling three lines below it in `createJitConfig()`. This means `metrics.enable` + `enable_github_app_rate_limit` only ever surfaced rate-limit data for the `isJobQueued` check and JIT config generation — never for the actual `createRegistrationTokenForOrg`/`ForRepo` call, which is the one every non-JIT runner registration depends on minting.

Change

One line, mirroring the existing JIT call site exactly:
```ts
metricGitHubAppRateLimit(registrationToken.headers, githubRunnerConfig.appIndex);
```
No new API calls — the GitHub response already carries `x-ratelimit-remaining`/`x-ratelimit-limit` headers on every request; this just reads and publishes what's already there.

Why this matters

Found this while root-causing a GitHub App installation rate-limit incident on a large self-hosted fleet running the classic (non-JIT) flow. With `ENABLE_METRIC_GITHUB_APP_RATE_LIMIT=true` but `ENABLE_JOB_QUEUED_CHECK=false` and `ENABLE_JIT_CONFIG=false` (both defaults for a fully ephemeral fleet that hasn't opted into either), the metric is a structurally dead flag — neither of its two call sites ever executes. This fix closes that gap for anyone on the classic flow.

Test plan

  • Added coverage in `scale-up.test.ts` mirroring the existing "creates a token when maximum runners has not been reached" test, asserting `metricGitHubAppRateLimit` is called with the response headers.
  • Full `scale-up.test.ts` suite passes: 115/115.
  • `eslint`/prettier clean.

Marked draft while I confirm CLA/contribution requirements on my end — code and tests are complete and passing.

…ken response

getGithubRunnerRegistrationToken() (classic, non-JIT registration flow)
never called metricGitHubAppRateLimit, unlike its JIT sibling three
lines below it in createJitConfig(). This means metrics.enable +
enable_github_app_rate_limit only ever surfaced rate-limit data for
the isJobQueued check and JIT config generation - never for the
actual createRegistrationTokenForOrg/ForRepo call, which is the one
that mints the token every non-JIT runner registration depends on.

No new API calls added: the GitHub response already carries
x-ratelimit-remaining/x-ratelimit-limit headers on every request,
this just reads and publishes what's already there.

Adds coverage in scale-up.test.ts mirroring the existing
"creates a token when maximum runners has not been reached" test.
@tehlers320
tehlers320 marked this pull request as ready for review September 14, 2026 18:14
@tehlers320
tehlers320 requested a review from a team as a code owner September 14, 2026 18:14

@Brend-Smits Brend-Smits left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!
Tested and it works 🚀

Please make sure to sign your commits so we can merge the PR @tehlers320

@Brend-Smits
Brend-Smits enabled auto-merge (squash) September 17, 2026 14:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants