OAuth: update the affected member directly on organization member events - #13242
Draft
ericholscher wants to merge 1 commit into
Draft
OAuth: update the affected member directly on organization member events#13242ericholscher wants to merge 1 commit into
ericholscher wants to merge 1 commit into
Conversation
This was referenced Aug 18, 2026
ericholscher
force-pushed
the
claude/gh-app-member-events
branch
from
August 18, 2026 21:51
66fb41f to
60fb149
Compare
ericholscher
marked this pull request as ready for review
August 18, 2026 22:27
ericholscher
marked this pull request as draft
August 18, 2026 22:32
Bulk membership changes send one organization event per member, and each event triggered a full sync of the installation, costing at least one API request per repository. Large installations exceed GitHub's per-installation rate limit this way. Since the event includes the affected member, we now update that member only. Removed members have their access revoked directly from the database, without querying the API. Added members with an account connected have their access checked against repositories linked to a project (one request each); the rest of their access is synced when they sign in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVjkPjH3EDEQmtywJvDVau
ericholscher
force-pushed
the
claude/gh-app-member-events
branch
from
August 18, 2026 22:37
60fb149 to
80962a8
Compare
ericholscher
changed the title
ericholscher
added a commit
that referenced
this pull request
Aug 19, 2026
A rate-limited GitHub API request [fails with a 403](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api), and `update_or_create_repositories()` treats any 403 as if we lost access to the repository — deleting the `RemoteRepository` and silently disconnecting its projects. Large installations are currently hitting the rate limit during webhook-triggered syncs, so this is actively waiting to happen. A rate limit now aborts the operation without deleting anything, and without making further doomed requests. The task still fails visibly — no retries. PyGithub raises `RateLimitExceededException` (a `GithubException` subclass) for both [primary and secondary rate limits](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api#about-secondary-rate-limits), so catching it before the generic 403/404 handling covers both. Reducing the API usage that triggers the rate limits is handled separately in #13241, #13242, and #13243. Likely related to #13101, since build statuses and PR comments share the same per-installation budget. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01LVjkPjH3EDEQmtywJvDVau Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bulk membership changes in a GitHub organization send one
organizationwebhook event per member, and each event triggered a full sync of the installation — at least one API request per repository. Large installations exceed GitHub's per-installation hourly rate limit this way: a recent bulk change produced ~600 events in a few minutes, every sync failing withRateLimitExceededException.Since the event names the affected member, we now update exactly that member instead of re-syncing the whole installation. Removed members have their relations deleted using the
membership.userpayload — zero API requests, which also works while rate limited. Added members are first checked for a connected account (most org members don't have one — zero requests); when they do, we check their permission on repositories linked to a project only, one request each, and the rest of their access is populated on their next sign-in (existing behavior). Cost now scales with the event rather than the org, so no debouncing or caching is needed.#13243 builds on this branch to make the remaining full syncs cheaper.
🤖 Generated with Claude Code
https://claude.ai/code/session_01LVjkPjH3EDEQmtywJvDVau