Intermittent GitHub App init failures on github.com — getAppDetails "Authentication failure" / getPlatformConfig "platform-unknown-error" with a valid token

[redscaresu]

We run Renovate as a GitHub App on github.com (self-hosted via renovatebot/github-action, with an org-wide installation token minted at runtime by actions/create-github-app-token). For about a week we've had intermittent, sustained bursts of init failures even though the app installation token mints fine every run.

Two failure shapes show up during these bursts:

1) Most common — at initPlatform / getAppDetails:

DEBUG: Error authenticating with GitHub
  "err": {"message": "Init: Can't get App details"}
    at getAppDetails (lib/modules/platform/github/user.ts:19)
    at initPlatform (lib/modules/platform/github/index.ts:200)
FATAL: Initialization error  "errorMessage": "Authentication failure"

i.e. the GraphQL query { viewer { login databaseId } } comes back with no usable data.

2) In heavier bursts — one step later, at initRepo / getPlatformConfig:

ERROR: Repository has unknown error  "platform-unknown-error"
    at initRepo (lib/modules/platform/github/index.ts:575)
    at getPlatformConfig (lib/workers/repository/init/apis.ts:96)

i.e. the next init GraphQL call (repository metadata) also comes back without usable data.

What we've ruled out / observed:

• The token is valid — during a failing window, a direct curl of the same token returns 200 on REST (/rate_limit) and on GraphQL; /user is 403, as expected for an installation token.
• Not version-specific — reproduces on 43.31.x through 43.229.3.
• Intermittent but sustained — same config passes on a later run once the burst clears; bursts have lasted ~1 hour or more. No config or token change.
• Not the new stateless installation-token format — tokens are still the old short form in our case.

Questions:

1. Is anyone else seeing intermittent GitHub App init failures like this on github.com (not GHE)?
2. Does this look like transient GitHub GraphQL responses with empty/null data that Renovate treats as fatal — and would retry/tolerance on these init GraphQL calls (getAppDetails, getPlatformConfig) be reasonable?
3. Is there anything that can be done client-side, or is this purely GitHub-side GraphQL reliability?

Environment: Renovate 43.229.3, renovatebot/github-action, GitHub App installation token (org-wide), github.com (not GitHub Enterprise).

[github-actions[bot]]

Hi there,
We notice that the Discussion you've created doesn't quite follow our template.
Please update the top-level comment in this Discussion to follow the structure of the template.
This improves the maintainers' time to triage, as key information is clearly indicated in the format we expect.
Thanks, the Renovate team

[jamietanna]

Please also share more logs from the platform-unknown-error case

[jamietanna]

And confirm what permissions your App has

[redscaresu]

Thanks. We think we have found the root cause: the installation's GraphQL rate limit getting exhausted, so the init GraphQL calls return HTTP 200 with an errors array and no data, which shows up as "Authentication failure" and "platform-unknown-error".

Trace logs for the platform-unknown-error case:

{"type":"RATE_LIMIT","code":"graphql_rate_limit","message":"API rate limit already exceeded for installation ID <redacted>"}

ERROR: Repository has unknown error  "platform-unknown-error"
    at getPlatformConfig (lib/workers/repository/init/apis.ts:96)
    at initRepo (lib/modules/platform/github/index.ts:575)

The getAppDetails / "Authentication failure" case shows the same graphql_rate_limit response on the viewer query.

We think this one is ours to solve, so happy for you to close it as a config issue on our end. The one thing that might help others: Renovate could detect graphql_rate_limit and report it as rate limiting rather than "Authentication failure" / "platform-unknown-error".

[jamietanna]

Thanks, I've captured #44243