Some Git over HTTPS may temporarily require authentication
By Steven Van ·
GitHub may briefly require sign-in for some unauthenticated public clones and fetches over HTTPS during traffic spikes, on all plans.
During periods of unusual traffic, GitHub may temporarily require authentication for some clones and fetches of public repositories over HTTPS. The aim is to protect github.com's availability. The change applies to repositories on github.com across all plans, as described in the announcement.
What happens when it applies
An affected operation fails with a message saying authentication is required. There are two ways to continue: authenticate and retry, or wait and retry without authentication once the temporary protection has been lifted.
GitHub says it applies the protection as narrowly as possible, using signals associated with anomalous traffic. Legitimate and anomalous traffic can sometimes share those signals, so legitimate unauthenticated operations may occasionally be affected. It is not a general authentication requirement for public repositories.
What is not affected
- Authenticated Git operations over HTTPS
- Git operations over SSH
- Pushes
- Unrelated GitHub web and API traffic
Making automated clones more reliable
- GitHub Actions: use the built-in GITHUB_TOKEN.
- Other CI systems: prefer a GitHub App installation access token. A personal access token can also be used.
- Operations that cannot authenticate: retry after the temporary protection has been lifted.
