fix: Stop exhausting GitHub API rate limits on busy orgs

[billyvg]

Fixes SENTRY-GITHUB-ACTIONS-APP-5W: HTTPError: 403 Client Error: Forbidden for url: https://api.github.com/repos/getsentry/.sentry/contents/sentry_config.ini, 16.4M events. It should also stop most of SENTRY-GITHUB-ACTIONS-APP-V: 422s from fetching required workflows.

Root cause

The 403 is GitHub's hourly rate limit on the installation, not a missing permission:

• Some fetches succeed. Over the last 24h, getsentry config fetches returned 200 about 101k times and 403 about 66k times. cyeragit (135k / 126k) and MetaMask (90k / 7k) show the same mix.
• The 403s follow the hourly reset. They start around :40–:50 past each hour and stop around :18–:20, when the window resets.
• Nearly all 403s hit the config fetch. It's the first call each webhook makes, and when it fails no later call runs. That's 65,937 of getsentry's 66,207 403s.

Every completed workflow_job webhook made up to three API calls with the installation token:

1. Fetch .sentry/sentry_config.ini.
2. Fetch the run.
3. Fetch the workflow.

The config fetch also ran for skipped jobs, which are then dropped. getsentry alone sends about 167k webhooks a day, which is roughly 18k calls/hr if none were rate limited. It gets through about 10.8k calls/hr before GitHub starts refusing. For the rest of each hour, CI jobs are dropped, and each drop is reported here as an error.

The issue's first-seen date matches #71 (2025-09-08), which added logger.exception to the fetch. The 403s were probably happening before then and only started reaching Sentry with that change.

Changes

• Cache each org's DSN for 10 minutes, keyed on (installation id, org).
  • Keying on the installation means a DSN is only served to an installation whose token could read that org's config. Without it, a cache hit would skip that check.
  • Failed fetches aren't cached, so a 403 doesn't stick once the rate limit resets.
  • The cache is a module global, not a @cached decorator. The decorator's wrapper holds the cache as a closure variable, so it ends up in the frame variables Sentry sends with any error. That would put other orgs' cached values into this app's error events.
• Read the workflow path from the run (runs["path"]) instead of fetching the workflow. The fetch also fails with 422 for required workflows, whose workflow_url points at /actions/required_workflows/{id}; path is correct for those runs too.
  • A required workflow's path can name its repo and end in a ref (e.g. org/repo/.github/workflows/foo.yml@refs/heads/main), so the ref is stripped before taking the file name.
  • The two workflow fixtures are deleted.
  • The 2022 jobA run fixture gains the path field that current API responses include.
• Bail on skipped jobs in the handler before minting a token or calling the API. send_trace already ignored them.
• Add cachetools==5.3.2 to requirements.txt. The production image already ships it through requirements.frozen.txt as a transitive dependency of google-auth. Newer google-auth releases dropped it, so the dev and tox environments didn't have it.
• README: note that changes to sentry_config.ini can take up to 10 minutes to apply.

A traced job now costs about 1 API call instead of 3, and a skipped job costs none. For getsentry that's an estimated ~5.5k calls/hr, about half of what it already gets through before being limited. Token revocation (DELETE /installation/token) returned 204 on all ~587k calls, including during the limited windows, so it isn't blocked by the budget and is unchanged.

Testing

• pytest: 27 passed, 1 skipped (already skipped before this change). New tests check that:
  • The DSN is fetched once per installation and org across tokens, each org gets its own DSN, and another installation has to read the config itself.
  • A failed DSN fetch is retried on the next webhook.
  • A failed DSN fetch doesn't expose other cached DSNs in any frame's local variables.
  • A required-workflow run is traced with a single API call, and its workflow tag is the file name whether or not the path carries a repo and ref.
  • A skipped job makes no HTTP calls in GitHub App mode, where a token would otherwise be minted.
• Mutation check: putting back the @cached decorator, the workflow fetch, an org-only cache key, a skip check after minting the token, or splitting the path without stripping its ref each makes its test fail.
• cli.py with GitHub and Sentry mocked out: it now passes the installation id, where the old call raised TypeError: missing a required argument: 'installation_id'.
• End-to-end, through the Flask app with signed webhooks: after one org's config and run were cached, a failing webhook for a second org produced Sentry events containing neither the first org's DSN nor its repo or workflow URL.
• pre-commit run passes on all changed files.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f04f751. Configure here.}

[armenzg]

Good change. Thanks @billyvg