Add ignored-roles field to rate-limit configuration with defaults #15025

Copilot · 2026-02-11T23:09:51Z

Implementation Complete: Add "ignored-roles" field to rate-limiting ✅

Summary

Successfully implemented the ignored-roles field for the rate-limiting frontmatter configuration with default values of admin, maintain, write.

Changes Implemented

Go Backend - Added IgnoredRoles []string field to RateLimitConfig struct with default values
Schema Validation - Updated JSON schema with enum validation and default documentation
Config Parsing - Enhanced extractRateLimitConfig to set defaults when not specified
Workflow Generation - Modified generateRateLimitCheck to pass ignored roles as env var
Runtime Check - Implemented permission level checking with default fallback
Test Coverage - Added 8 comprehensive tests including default behavior (25 total tests passing)
Test Workflows - Moved test workflows to pkg/cli/workflows per review feedback

Default Behavior

When ignored-roles is not specified:

✅ Admin users bypass rate limiting
✅ Maintain users bypass rate limiting
✅ Write users bypass rate limiting
⚠️ Triage users are rate limited
⚠️ Read users are rate limited

To override defaults:

rate-limit:
  max: 5
  window: 60
  ignored-roles: []  # Apply rate limiting to all users

Validation Results

✅ All 25 JavaScript tests pass (including 2 new tests for defaults)
✅ All Go unit tests pass
✅ Linting checks pass
✅ Test workflows moved to pkg/cli/workflows
✅ Schema validation working correctly

Example: Default Behavior

rate-limit:
  max: 5
  window: 60
# ignored-roles defaults to ["admin", "maintain", "write"]

Result: Only triage and read users are rate limited to 5 runs per hour.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

- Updated RateLimitConfig struct to include IgnoredRoles field - Updated JSON schema validation to support ignored-roles - Implemented role check in check_rate_limit.cjs to skip rate limiting for users with ignored roles - Added comprehensive tests for the new functionality - Updated documentation with examples and troubleshooting guide - Created test workflow demonstrating role-based exemptions Co-authored-by: pelikhan <[email protected]>

Co-authored-by: pelikhan <[email protected]>

pelikhan · 2026-02-11T23:32:16Z

@copilot default is admin, maintain, write

Default behavior now exempts users with admin, maintain, or write permissions from rate limiting. Only triage and read users are subject to rate limiting by default. Users can override this by explicitly setting ignored-roles in frontmatter. Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-02-11T23:39:34Z

@copilot default is admin, maintain, write

Updated to use default values. When ignored-roles is not specified, it now defaults to ["admin", "maintain", "write"]. Only triage and read users are subject to rate limiting by default.

Commit: d1c655d

pelikhan · 2026-02-11T23:41:58Z

pkg/cli/workflows/test-rate-limit-defaults.md

@copilot move to pkg/cli/workflows

Moved to pkg/cli/workflows/

Commit: fc0c190

pelikhan · 2026-02-11T23:42:13Z

pkg/cli/workflows/test-rate-limit-ignored-roles.md

@copilot move to pkg/cli/workflows

Moved to pkg/cli/workflows/

Commit: fc0c190

pelikhan · 2026-02-11T23:42:31Z

docs/RATE_LIMITING.md

@copilot delete file

Deleted

Commit: fc0c190

…G.md - Moved test-rate-limit-defaults.md to pkg/cli/workflows/ - Moved test-rate-limit-ignored-roles.md to pkg/cli/workflows/ - Deleted docs/RATE_LIMITING.md (documentation exists elsewhere) - Lock files for test workflows are not tracked per .gitignore Co-authored-by: pelikhan <[email protected]>

Copilot

Pull request overview

Adds support for rate-limit.ignored-roles in workflow frontmatter so certain repository permission levels can bypass rate limiting (with intended defaults of admin, maintain, write), spanning compiler extraction, schema/docs, and the JS runtime check.

Changes:

Extend rate-limit config type/schema/docs with ignored-roles and document default behavior.
Parse ignored-roles in Go and pass it to the pre-activation rate limit check via env var.
Update JS rate-limit check + tests, and add example/test workflows.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
pkg/workflow/role_checks.go	Extracts `ignored-roles` and threads it into generated workflow env vars.
pkg/workflow/frontmatter_types.go	Adds `IgnoredRoles` to the typed frontmatter config struct.
pkg/parser/schemas/main_workflow_schema.json	Validates `ignored-roles` values via enum and documents defaults.
actions/setup/js/check_rate_limit.cjs	Implements ignored-role exemption using repo permission lookup.
actions/setup/js/check_rate_limit.test.cjs	Adds unit tests for default/custom ignored-role behavior.
pkg/cli/workflows/test-rate-limit-ignored-roles.md	Adds an example workflow demonstrating `ignored-roles`.
pkg/cli/workflows/test-rate-limit-defaults.md	Adds an example workflow demonstrating default ignored roles.
docs/src/content/docs/reference/frontmatter-full.md	Documents the new `ignored-roles` field in the full frontmatter reference.
docs/src/content/docs/agent-factory-status.mdx	Adds a listing entry for the new test workflow.
docs/RATE_LIMITING.md	Removes the legacy rate limiting doc file.

Comments suppressed due to low confidence (1)

actions/setup/js/check_rate_limit.cjs:47

ignoredRolesList.split(",") will produce [""] when the env var is an empty string. If you implement support for ignored-roles: [], also normalize the parsed roles by filtering out empty strings so the log output and includes check behave as expected.

  // Check if user has an ignored role (exempt from rate limiting)
  const ignoredRoles = ignoredRolesList.split(",").map(r => r.trim());
  core.info(`   Ignored roles: ${ignoredRoles.join(", ")}`);

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-11T23:54:07Z

docs/src/content/docs/agent-factory-status.mdx

 | [Test Create PR Error Handling](https://github.com/github/gh-aw/blob/main/.github/workflows/test-create-pr-error-handling.md) | claude | [![Test Create PR Error Handling](https://github.com/github/gh-aw/actions/workflows/test-create-pr-error-handling.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-create-pr-error-handling.lock.yml) | - | - |
 | [Test Dispatcher Workflow](https://github.com/github/gh-aw/blob/main/.github/workflows/test-dispatcher.md) | copilot | [![Test Dispatcher Workflow](https://github.com/github/gh-aw/actions/workflows/test-dispatcher.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-dispatcher.lock.yml) | - | - |
 | [Test Project URL Explicit Requirement](https://github.com/github/gh-aw/blob/main/.github/workflows/test-project-url-default.md) | copilot | [![Test Project URL Explicit Requirement](https://github.com/github/gh-aw/actions/workflows/test-project-url-default.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-project-url-default.lock.yml) | - | - |
+| [Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/blob/main/.github/workflows/test-rate-limit-ignored-roles.md) | copilot | [![Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml) | - | - |


This table row links to .github/workflows/test-rate-limit-ignored-roles.md, but the workflow file in this PR is under pkg/cli/workflows/. As-is, the link (and likely the badge target) will be broken. Update the URL to the correct path, or omit this entry if pkg/cli/workflows files aren’t intended to be published as runnable Actions workflows.

Suggested change

| [Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/blob/main/.github/workflows/test-rate-limit-ignored-roles.md) | copilot | [![Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml) | - | - |

| [Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/blob/main/pkg/cli/workflows/test-rate-limit-ignored-roles.md) | copilot | [![Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml) | - | - |

Copilot · 2026-02-11T23:54:08Z

pkg/workflow/frontmatter_types.go

+	Max          int      `json:"max,omitempty"`           // Maximum number of runs allowed per time window (default: 5)
+	Window       int      `json:"window,omitempty"`        // Time window in minutes (default: 60)
+	Events       []string `json:"events,omitempty"`        // Event types to apply rate limiting to (e.g., ["workflow_dispatch", "issue_comment"])
+	IgnoredRoles []string `json:"ignored-roles,omitempty"` // Roles that are exempt from rate limiting (e.g., ["admin", "maintainer"])


The example role value "maintainer" isn’t one of GitHub’s permission levels (GitHub uses maintain). Using an invalid role name here is misleading since the schema/enforcement only accepts maintain. Please update the comment example to use maintain.

Suggested change

IgnoredRoles []string `json:"ignored-roles,omitempty"` // Roles that are exempt from rate limiting (e.g., ["admin", "maintainer"])

IgnoredRoles []string `json:"ignored-roles,omitempty"` // Roles that are exempt from rate limiting (e.g., ["admin", "maintain"])

Copilot · 2026-02-11T23:54:08Z

pkg/cli/workflows/test-rate-limit-ignored-roles.md

+- Limits non-admin/non-maintainer users to 3 runs within a 30-minute window
+- Exempts users with "admin" or "maintain" roles from rate limiting
+- Applies to workflow_dispatch and issue_comment events
+
+## Testing
+
+### For Admin/Maintainer Users:


This doc uses “maintainer” terminology (e.g. “non-admin/non-maintainer”, “Admin/Maintainer Users”), but the actual GitHub permission level is maintain. Please update the wording to match the real role name to avoid confusion when testing/configuring ignored-roles.

Suggested change

- Limits non-admin/non-maintainer users to 3 runs within a 30-minute window

- Exempts users with "admin" or "maintain" roles from rate limiting

- Applies to workflow_dispatch and issue_comment events

## Testing

### For Admin/Maintainer Users:

- Limits non-admin/non-maintain users to 3 runs within a 30-minute window

- Exempts users with "admin" or "maintain" roles from rate limiting

- Applies to workflow_dispatch and issue_comment events

## Testing

### For Admin/Maintain Users:

Copilot · 2026-02-11T23:54:09Z

docs/src/content/docs/reference/frontmatter-full.md


+  # Optional list of roles that are exempt from rate limiting. Users with any of
+  # these roles will not be subject to rate limiting checks. Common roles: 'admin',
+  # 'maintain', 'write', 'triage', 'read'.


This reference snippet shows ignored-roles: [] without mentioning the default behavior when the field is omitted (defaults to admin/maintain/write) vs. when it is explicitly set to an empty array (no exemptions). As written, it’s easy to infer that the default is an empty list. Consider adding a short note here clarifying omit-vs-empty semantics.

Suggested change

# 'maintain', 'write', 'triage', 'read'.

# 'maintain', 'write', 'triage', 'read'. If this field is omitted, 'admin',

# 'maintain', and 'write' are exempt by default. Set this to an empty array []

# to apply rate limiting to all roles with no exemptions.

Copilot · 2026-02-11T23:54:09Z

pkg/workflow/role_checks.go

+	// Set ignored roles (if specified)
+	if len(data.RateLimit.IgnoredRoles) > 0 {
+		// Sort roles alphabetically for consistent output
+		ignoredRoles := make([]string, len(data.RateLimit.IgnoredRoles))
+		copy(ignoredRoles, data.RateLimit.IgnoredRoles)
+		sort.Strings(ignoredRoles)
+		steps = append(steps, fmt.Sprintf("          GH_AW_RATE_LIMIT_IGNORED_ROLES: %q\n", strings.Join(ignoredRoles, ",")))
+	}


ignored-roles: [] is intended to exempt no one, but this generator only sets GH_AW_RATE_LIMIT_IGNORED_ROLES when the slice is non-empty. That means an explicitly empty list won’t be passed to the runtime check, so the JS script will fall back to its defaults and still exempt admin/maintain/write. Consider always emitting GH_AW_RATE_LIMIT_IGNORED_ROLES (even as an empty string) when rate limiting is configured, so an explicit empty list can be honored.

Suggested change

// Set ignored roles (if specified)

if len(data.RateLimit.IgnoredRoles) > 0 {

// Sort roles alphabetically for consistent output

ignoredRoles := make([]string, len(data.RateLimit.IgnoredRoles))

copy(ignoredRoles, data.RateLimit.IgnoredRoles)

sort.Strings(ignoredRoles)

steps = append(steps, fmt.Sprintf(" GH_AW_RATE_LIMIT_IGNORED_ROLES: %q\n", strings.Join(ignoredRoles, ",")))

}

// Set ignored roles (always emit, even when empty, so an explicit empty list is honored)

ignoredRolesValue := ""

if len(data.RateLimit.IgnoredRoles) > 0 {

// Sort roles alphabetically for consistent output

ignoredRoles := make([]string, len(data.RateLimit.IgnoredRoles))

copy(ignoredRoles, data.RateLimit.IgnoredRoles)

sort.Strings(ignoredRoles)

ignoredRolesValue = strings.Join(ignoredRoles, ",")

}

steps = append(steps, fmt.Sprintf(" GH_AW_RATE_LIMIT_IGNORED_ROLES: %q\n", ignoredRolesValue))

Copilot · 2026-02-11T23:54:09Z

actions/setup/js/check_rate_limit.cjs

  const windowMinutes = parseInt(process.env.GH_AW_RATE_LIMIT_WINDOW || "60", 10);
  const eventsList = process.env.GH_AW_RATE_LIMIT_EVENTS || "";
+  // Default: admin, maintain, and write roles are exempt from rate limiting
+  const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES || "admin,maintain,write";


Using process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES || "admin,maintain,write" makes an explicitly empty env var (used to represent ignored-roles: []) fall back to the defaults, preventing users from overriding to “no ignored roles”. Use a nullish check (??) instead so "" is preserved.

This issue also appears on line 45 of the same file.

Suggested change

const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES || "admin,maintain,write";

const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES ?? "admin,maintain,write";

Copilot · 2026-02-11T23:54:09Z

actions/setup/js/check_rate_limit.test.cjs

+  it("should use default ignored roles (admin, maintain, write) when not specified", async () => {
+    // Don't set GH_AW_RATE_LIMIT_IGNORED_ROLES, so it uses default
+


There’s coverage for default ignored roles and custom lists, but no test for the explicit empty override (e.g. GH_AW_RATE_LIMIT_IGNORED_ROLES=""), which should result in no exemptions (admin should go through the rate-limit path). Add a test to lock in the intended ignored-roles: [] semantics.

Initial plan

1209653

Copilot AI assigned Copilot and pelikhan Feb 11, 2026

Copilot started work on behalf of pelikhan February 11, 2026 23:10 View session

Copilot stopped work on behalf of pelikhan due to an error February 11, 2026 23:10
Failed to launch agent

Copilot AI and others added 2 commits February 11, 2026 23:18

Complete implementation of ignored-roles field

a7d3081

Co-authored-by: pelikhan <[email protected]>

Copilot AI changed the title ~~[WIP] Add ignored-roles field to rate-limiting configuration~~ Add ignored-roles field to rate-limit configuration Feb 11, 2026

Copilot AI requested a review from pelikhan February 11, 2026 23:27

Copilot finished work on behalf of pelikhan February 11, 2026 23:27

Copilot started work on behalf of pelikhan February 11, 2026 23:32 View session

github-actions bot mentioned this pull request Feb 11, 2026

[agentics] No-Op Runs #14645

Closed

Copilot AI changed the title ~~Add ignored-roles field to rate-limit configuration~~ Add ignored-roles field to rate-limit configuration with defaults Feb 11, 2026

Copilot finished work on behalf of pelikhan February 11, 2026 23:40

pelikhan reviewed Feb 11, 2026

View reviewed changes

Copilot started work on behalf of pelikhan February 11, 2026 23:43 View session

Copilot AI requested a review from pelikhan February 11, 2026 23:49

Copilot finished work on behalf of pelikhan February 11, 2026 23:49

pelikhan approved these changes Feb 11, 2026

View reviewed changes

Merge branch 'main' into copilot/add-ignored-roles-field

311277c

pelikhan marked this pull request as ready for review February 11, 2026 23:50

Copilot AI review requested due to automatic review settings February 11, 2026 23:50

Copilot started reviewing on behalf of pelikhan February 11, 2026 23:50 View session

pelikhan merged commit 660a07e into main Feb 11, 2026
57 checks passed

pelikhan deleted the copilot/add-ignored-roles-field branch February 11, 2026 23:52

Copilot AI reviewed Feb 11, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 12, 2026

🌱 Daily Team Evolution Insights - February 11-12, 2026 #15080

Closed

	\| [Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/blob/main/.github/workflows/test-rate-limit-ignored-roles.md) \| copilot \| [![Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml) \| - \| - \|
	\| [Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/blob/main/pkg/cli/workflows/test-rate-limit-ignored-roles.md) \| copilot \| [![Test Rate Limiting with Ignored Roles](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml/badge.svg)](https://github.com/github/gh-aw/actions/workflows/test-rate-limit-ignored-roles.lock.yml) \| - \| - \|

	IgnoredRoles []string `json:"ignored-roles,omitempty"` // Roles that are exempt from rate limiting (e.g., ["admin", "maintainer"])
	IgnoredRoles []string `json:"ignored-roles,omitempty"` // Roles that are exempt from rate limiting (e.g., ["admin", "maintain"])

-  # 'maintain', 'write', 'triage', 'read'.
+  # 'maintain', 'write', 'triage', 'read'. If this field is omitted, 'admin',
+  # 'maintain', and 'write' are exempt by default. Set this to an empty array []
+  # to apply rate limiting to all roles with no exemptions.

	const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES \|\| "admin,maintain,write";
	const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES ?? "admin,maintain,write";

		it("should use default ignored roles (admin, maintain, write) when not specified", async () => {
		// Don't set GH_AW_RATE_LIMIT_IGNORED_ROLES, so it uses default

Add ignored-roles field to rate-limit configuration with defaults #15025

Add ignored-roles field to rate-limit configuration with defaults #15025

Uh oh!

Conversation

Copilot AI commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Complete: Add "ignored-roles" field to rate-limiting ✅

Summary

Changes Implemented

Default Behavior

Validation Results

Example: Default Behavior

Uh oh!

pelikhan commented Feb 11, 2026

Uh oh!

Copilot AI commented Feb 11, 2026

Uh oh!

pelikhan Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 11, 2026 •

edited

Loading