GitHub may require temporary authentication for some public HTTPS clones
GitHub said on October 19 that it may temporarily require authentication for some clones and fetches of public repositories over HTTPS during unusual traffic. The protection is intended to help preserve github.com availability. It is not a permanent authentication requirement for all public repositories.
An affected operation fails with a message saying authentication is required. GitHub says users can authenticate and retry, or wait until the temporary protection is lifted and retry without authentication. This report does not establish how long a particular restriction will last.
GitHub says it targets signals associated with anomalous traffic as narrowly as possible. Legitimate and anomalous traffic can share those signals, so legitimate unauthenticated operations may sometimes be affected. The announcement does not identify every trigger or provide a traffic threshold.
Authenticated Git over HTTPS, Git over SSH, pushes, and unrelated GitHub web and API traffic are listed as unaffected. A failure in a public HTTPS clone therefore should not be described as a general outage of every GitHub interface.
For more reliable automated clones and fetches, GitHub recommends the built-in GITHUB_TOKEN for GitHub Actions. For other continuous-integration systems, it prefers a GitHub App installation access token; a personal access token can also be used. These are its setup recommendations, not changes made to any account by this article.
The protection applies to repositories on github.com across all plans. Teams running automated source retrieval should distinguish this temporary authentication response from other failures and follow their own credential controls. GitHub does not say that all public access has become private or that existing authenticated workflows must be replaced.