[Bug] Unauthenticated GitHub API requests cause 403 Rate Limit errors when clicking "SET AS STABLE" #196

created with Gemini 3.7 flash Medium

Describe the bug

When attempting to submit an adapter version to the stable repository by clicking the "SET AS STABLE" button in the Developer Portal, the operation fails with a 403 Forbidden error from the GitHub API.

Error Output / Logs

Please fix the following errors before you can continue:
	[E0000] FATAL: cannot access repository https://api.github.com/repos/meistermopper/ioBroker.harvia-fenix
	[E9999] GLOBAL ERROR: AxiosError: Request failed with status code 403, {"message":"Request failed with status code 403","name":"AxiosError","stack":"AxiosError: Request failed with status code 403
    at settle (/app/node_modules/axios/dist/node/axios.cjs:2216:12)
    at IncomingMessage.handleStreamEnd (/app/node_modules/axios/dist/node/axios.cjs:4062:11)

Root Cause Analysis

Inspecting the Axios request configuration inside the error payload reveals that the HTTP GET request to https://api.github.com/repos/... is executed without an Authorization header:

"headers": {
  "Cache-Control": "no-cache",
  "Pragma": "no-cache",
  "Expires": "0",
  "User-Agent": "axios/1.18.1",
  "Accept-Encoding": "gzip, compress, deflate, br"
}

Because requests are unauthenticated, GitHub enforces the strict IP-based rate limit of 60 requests/hour across the entire dev-portal server instance. Once this quota is exhausted by background tasks or multiple users, all subsequent operations fail with HTTP 403.

Expected Behavior

The GitHub API request should include an authorization token (either the logged-in user's GitHub OAuth token or a dedicated bot/application token via OWN_GITHUB_TOKEN / Authorization: Bearer <token>), allowing up to 5,000 requests/hour and preventing rate limit collisions.

Suggested Solutions

1. Pass the user's OAuth access token (or a backend GitHub token) to the repochecker / API client in the Authorization header.
2. Inspect x-ratelimit-remaining and x-ratelimit-reset response headers to handle rate-limiting gracefully with a descriptive user message rather than failing with an unhandled Axios 403 error.