feat(github-app): select app by rate limit budget - #5283
Merged
guicaulada merged 1 commit intoSep 8, 2026
Merged
Conversation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Replace uniform random GitHub App selection with budget-aware selection. The auth module tracks the last observed x-ratelimit-remaining per app (fed by response headers and the throttling plugin callbacks) and selects the app with the most budget left. Apps that hit a secondary rate limit are skipped for 60 seconds. Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random selection kept sending ~1/N of traffic to apps that were already exhausted or throttled. Selection state is per warm container and converges within a few invocations.
guicaulada
force-pushed
the
gc/feat/rate-limit-aware-app-selection
branch
from
September 8, 2026 13:11
210cd52 to
fb3555f
Compare
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
from
September 8, 2026 13:11
70c81ad to
19b8130
Compare
Brend-Smits
approved these changes
Sep 8, 2026
guicaulada
merged commit Sep 8, 2026
3eb2d6a
into
gc/feat/github-apps-manifest
12 of 18 checks passed
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
This was referenced Sep 8, 2026
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Replaces uniform random GitHub App selection with selection based on the last observed rate-limit budget. Apps under a secondary rate-limit cooldown are temporarily skipped, and randomized starting points spread cold-start traffic across apps. Uses the credential storage interface introduced on main and preserves the selected app index throughout each operation. Includes a regression test verifying selection from an injected credentials store without reading SSM. This PR targets `main` and contains only the rate-limit selection change. The manifest prerequisite was merged separately in #5282. Replaces #5283, which was originally merged into the parent feature branch. Validation: 350 control-plane tests passed; TypeScript, ESLint, and diff whitespace checks passed. The commit is signed and verified. Follow-up to #5269 / #5038.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #5269, item 2 of the #5038 review. Stacked on #5282 (manifest transport); review that first.
Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork:
x-ratelimit-remainingper app, fed bymetricGitHubAppRateLimitheaders and the throttling plugin callbacks.Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before.
Test Plan
Related Issues
Follow-up to #5269 / #5038. Depends on #5282.