Where to add GitHub personal token to not get rate limited by the GitHub API?

[o-l-a-v]

Question

Where to add GitHub personal access token to not get rate limited by the GitHub API?

Conclusions

• Depends on Excavator - Handle GitHub API rate limiting GithubActions#64 (?).
• Scoop GitHubActions uses the repository GitHub actions built in environment variable GITHUB_TOKEN.
• There is currently no built-in way to provide a PAT (personal access token) to Scoop GitHubActions (?).
• Scoop does not use GITHUB_TOKEN everywhere it can, which causes inconsistent rate limiting.
  • fix(autoupdate): Ensure GitHub API requests use token Scoop#6535
  • [Feature] GitHub API rate limiting: Download release assets using API and add GitHub token to it Scoop#6609
• Scoop makes unnecessarily many API requests:
  • [Feature] GitHub API rate limiting: Cache response from checkver and use it with autoupdate Scoop#6608

GitHub API rate limiting:

• https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api

Type	Limit	Scope
Unathenticated	60 per hour	Source IP address
Repo built in secret GITHUB_TOKEN	1000 per hour	Per repo
Personal Access Token (PAT)	5000 per hour	Per user

• Multiple PATs will not increase the rate limit, as it is per user.

Context

Related issues:

• 2025-10-16: Excavator - Handle GitHub API rate limiting GithubActions#64
• 2025-11-23: Outstanding Excavator issues Main#7394
  • 2025-12-22: Outstanding Excavator issues Main#7394 (comment)

Related PRs:

• 2025-11-01: fix(autoupdate): Ensure GitHub API requests use token Scoop#6535

Related code:

• Scoop -> lib -> download.ps1 -> function Get-GitHubToken: https://github.com/ScoopInstaller/Scoop/blob/b588a06e41d920d2123ec70aee682bae14935939/lib/download.ps1#L580-L582
• Scoop -> lib -> core.ps1 -> function get_config: https://github.com/ScoopInstaller/Scoop/blob/b588a06e41d920d2123ec70aee682bae14935939/lib/core.ps1#L97-L103
• BucketTemplate -> .github -> workflows -> excavator.yml: https://github.com/ScoopInstaller/BucketTemplate/blob/master/.github/workflows/excavator.yml
  • Uses: https://github.com/ScoopInstaller/GithubActions/blob/main/action.yml
    • Calls Invoke-Action: https://github.com/ScoopInstaller/GithubActions/blob/main/src/ActionWrapper.psm1

[o-l-a-v]

Today I learned, from @brian6932: You can overwrite the token in the workflow.

• [Feature] GH_Token docs Scoop#6496 (comment)
• https://github.com/brian6932/dank-scoop/blob/75536719ed542092bb39438e3df035e7eca57af5/.github/workflows/excavator.yml#L16

[z-Fng]

$Env:GITHUB_TOKEN: https://github.com/ScoopInstaller/GithubActions?tab=readme-ov-file#available-environment-variables

[z-Fng]

Repo built in secret GITHUB_TOKEN 1000 per hour Per repo

My tests indicate the limit appears to be 5,000 requests per hour, not 1,000. The documentation seems to be out of date.

See: https://github.com/ScoopInstaller/Extras/actions/runs/23012952317/job/66828376421

GITHUB API RATE LIMIT: {"limit":5000,"used":1296,"remaining":3704,"reset":1773337131}