PAT is being rate-limited

[laurentsimon]

My PAT is being rate-limited. (it's also used for scorecard weekly cron).

We need some more donation. We could have a GENERIC_BLAZE_TOKEN, GENERIC_TOKEN, etc from different people

/cc @ianlewis @asraa

[ianlewis]

Is the rate limiting per-user? or per-token? If it's per-token you could just make more tokens?

[laurentsimon]

it's per-user, unfortunately

[ianlewis]

Hrm, and no ORG PAT tokens I guess?

[laurentsimon]

what do you mean by ORG token? I'm not aware of them. Do they have specific features?
Note: we could also create a few "bot" accounts, if that's possible without too much burden

[ianlewis]

I just meant a PAT token that's attached to an organization. Yah, bot accounts are not ideal but are one solution.

[ianlewis]

We should also investigate a bit and doc why we need the PAT tokens so we can more easily get rid of them.

[ianlewis]

I think one way to help solve this issue is to use a PAT for the things we need to use a PAT for and github.token for everything else.

Things I've noticed we need a PAT for so far:

1. git push doesn't trigger subsequent workflows if pushed using a github.token: https://github.community/t/push-from-action-does-not-trigger-subsequent-action/16854

[ianlewis]

GITHUB_TOKEN also has a rate limit but it's much lower than a PAT: 1000 requests per repo per hour
https://docs.github.com/en/rest/overview/resources-in-the-rest-api#requests-from-github-actions

Each PAT has a rate limit of 5000 request per repo per hour
https://docs.github.com/en/rest/overview/resources-in-the-rest-api#requests-from-personal-accounts

Some of our scripts use quite a lot of requests. For example, e2e-create-release.sh performs up to 202 requests per execution.

I wonder if we can't use DEFAULT_VERSION here to say only check the body for releases that have the same major version as DEFAULT_VERSION. That would greatly limit the number of requests we need to make here.

example-package/.github/workflows/scripts/e2e-create-release.sh

Lines 25 to 26 in 486d384

	BODY=$(GH_TOKEN=$TOKEN gh release view "$TAG" --json body | jq -r '.body')
	if [[ "$BODY" == *"$THIS_FILE"* ]]; then