Rate-limits from GitHub for GitHubActions prevent finding updates

[hohwille]

Actual behavior

Our Update URLs workflow could not update maven because of this error:

15:21:23.646 [com.devonfw.tools.ide.url.UpdateInitiator.main()] - ERROR - c.d.t.ide.url.updater.UpdateManager - Failed to update mvn
java.lang.IllegalStateException: Error while getting versions from JSON API https://api.github.com/repos/apache/maven/releases
	at com.devonfw.tools.ide.url.updater.JsonUrlUpdater.update(JsonUrlUpdater.java:54)
	at com.devonfw.tools.ide.url.updater.UpdateManager.update(UpdateManager.java:133)
	at com.devonfw.tools.ide.url.updater.UpdateManager.updateAll(UpdateManager.java:108)
	at com.devonfw.tools.ide.url.UpdateInitiator.main(UpdateInitiator.java:65)
	at org.codehaus.mojo.exec.ExecJavaMojo$1.run(ExecJavaMojo.java:279)
	at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.IllegalStateException: Failed to retrieve response body from url: https://api.github.com/repos/apache/maven/releases
	at com.devonfw.tools.ide.url.updater.AbstractUrlUpdater.doGetResponseBodyAsString(AbstractUrlUpdater.java:176)
	at com.devonfw.tools.ide.url.updater.JsonUrlUpdater.update(JsonUrlUpdater.java:42)
	... 5 common frames omitted
Caused by: java.lang.IllegalStateException: Unexpected response code 403:{"message":"API rate limit exceeded for 172.190.93.131. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)","documentation_url":"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"}

	at com.devonfw.tools.ide.url.updater.AbstractUrlUpdater.doGetResponseBodyAsString(AbstractUrlUpdater.java:174)
	... 6 common frames omitted

Reproduce

See Logs of "Update URLs" GitHub action workflow.

Expected behavior

New maven versions should be found via the REST API.

IDEasy status

n.a.

Related/Dependent issues

#1771

Comments/Hints

https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting

Maybe from GitHub action we get a token out of the box that we can pass to our URL updater process.
Otherwise we can create an account and configure the credentials as GitHub secrets.

[maybeec]

The token you get for the build out of the box has very restricted access restrictions on the current repo only. You need to use an org wide token stored as credentials. I think there is already one existing if I remember correctly

[hohwille]

This are the secrets/variables we already have in our actions:

ACTION_PUSH_TOKEN
BUILD_USER
BUILD_USER_EMAIL
BUILD_USER_PASSWD
GHA_TOKEN
GPG_KEY
GPG_PASSPHRASE
GPG_PRIVATE_KEY
OKTETO_LOGIN_TOKEN
SONAR_TOKEN
SONATYPE_PASSWORD
SONATYPE_USERNAME

IMHO we could delete the OKTETO_LOGIN_TOKEN - or is anybody still using that? IDEasy for sure not.
So if we have it, then IMHO it must be the GHA_TOKEN.
The ACTION_PUSH_TOKEN was created by me only for IDEasy (and devonfw-ide) to be able to push changes into ide-urls (and into IDEasy itself during release process).