GitHub said on 19 October 2026 that unusual traffic may lead it to ask for a login on some public-repository downloads over HTTPS. This covers clones (full copies of a repository) and fetches (updates to a copy you already hold). GitHub said the aim is to keep github.com running. Blocked requests fail with a message saying a login is needed. It applies on all plans.
GitHub said it aims the check at as little traffic as it can, using signals tied to odd behaviour. Honest and abusive traffic can share those signals, so some legitimate anonymous requests may be caught. GitHub said this is not a blanket login rule. The post gives no start time, duration, or traffic level that triggers it. General context, not from GitHub: a login lets a server tell requesters apart and limit anonymous load cheaply.
Our reading: anonymous access to a public repo is a convenience, not a guarantee, so builds that rely on it carry a hidden availability risk. GitHub points Actions users to the built-in GITHUB_TOKEN, and other CI systems to a GitHub App installation token; a personal access token also works. Leaders can ask which pipelines clone anonymously, who owns the credentials, and how often they are rotated.