No way to check if a renamed repo's namespace is retired without claiming it — supply-chain risk

[Shoshkin]

🏷️ Discussion Type

Bug

Body

This is about the "Popular repository namespace retirement" policy documented in the Username reference: https://docs.github.com/en/account-and-profile/reference/username-reference

The policy is meant to protect popular repositories: when an account is renamed, a qualifying namespace (a Marketplace-listed action, >100 clones, or >100 Actions uses in the prior week) is permanently retired so the old owner/repo combination cannot be reclaimed and used for namespace hijacking.

The problem: there is no way to determine whether a given owner/repo namespace is actually protected. Retirement appears to be evaluated only server-side at repository creation time. From the outside, a retired namespace and a plain non-existent one are indistinguishable — both just 404. There is no API, no UI indicator, and no lookup that reports a namespace's retired/protected status.

The consequence is that the only apparent way to find out whether a formerly-popular namespace is protected is to register the freed username and attempt to create the exact repo name:

• If creation is blocked with "The repository has been retired and cannot be reused", it was protected.
• • If creation succeeds, it was not — meaning any project pinned to owner/repo@ref could be redirected to attacker-controlled content (a supply-chain compromise).
    So the check itself is the risky action. To confirm a popular repo's old namespace is safe, someone has to perform the exact steps that would compromise it if it is not protected — which is not something a defender should have to do.

Requests / questions:

• Is there a way (e.g. an API endpoint, or a distinct response for retired namespaces) to check whether a namespace is retired/protected WITHOUT claiming the username and creating the repo?
• • If not, could such a check be added? Maintainers and downstream dependents currently have no safe way to verify that a renamed popular repo's namespace is protected.
• • Could the docs clarify exactly how the eligibility criteria are evaluated (e.g. the exact window and thresholds) so people can reason about their own exposure?

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐