Usage Limits
| Git repo size | “Packages” size | Git LFS size | Actions Artifacts size |
|---|---|---|---|
| 5 GB | 5 GB | 2 GB | 2 GB |
| CPU | Memory | Storage | Build times | Max. # concurrent matrix jobs |
|---|---|---|---|---|
| 4 | 3 GB | Inf | Inf1 | Inf1 |
Rate limits
Section titled “Rate limits”Each operation has its own budget.
Higher shared limits act as abuse backstops; traffic from other users sharing an IP or network can still exhaust them.
Requests over a rate limit receive HTTP 429.
Shared abuse limits
Section titled “Shared abuse limits”| Scope | Requests per 30 minutes |
|---|---|
| Per IP address | 10,000 |
Per IPv4 /16 or IPv6 /64 network | 100,000 |
These totals include page assets; repository names and asset paths do not change the thresholds.
More than 50 server errors (HTTP 5xx) in 5 minutes per IP also trigger throttling; ordinary 4xx responses do not count toward this threshold.
Git over HTTP, package and container registry requests, and Actions runner API requests do not consume these shared budgets. CrowCI is exempt from the network and server-error limits.
Specific operations
Section titled “Specific operations”| Operation | Anonymous | Signed in |
|---|---|---|
| Source archive downloads | 3 per 10 minutes per IP | 600 per 10 minutes per account |
| Filtered issue and pull request lists | 10 per 10 minutes per IP | 60 per 10 minutes per browser session |
| Commit-hash views, including source and raw files | 20 per 10 minutes per IP | No separate operation limit |
| Web code search | Sign-in required | 60 per 10 minutes per browser session |
POST requests to /login | 10 per 3 minutes per IP and URL | Same limit |
Filtered lists and web code search each have an additional backstop of 600 requests per 10 minutes per IP, shared across browser sessions.
Signed-in filtered-list requests do not consume the anonymous filtered-list budget.
The filtered-list limits cover labels, named sorting, and non-default author, assignee, milestone, or project filters; unfiltered lists are unaffected.
The commit-hash limit does not apply to branch or tag views.
Web session limits require a browser sign-in; an API token does not replace it.
The /login rule applies to that exact path, not /user/login.
Archive downloads accept authenticated tokens and sessions, sharing the account’s download budget.
Uncached archive generation also has instance-wide limits: 6 starts per minute for anonymous requests and 30 starts per minute in total, with 2 generation workers.
Cached archives consume only the download budget.
Archive 429 responses include Retry-After; wait that many seconds before retrying.
Access tokens
Section titled “Access tokens”Archive downloads accept access tokens with read:repository scope and access to the requested repository.
Tokens are available under Settings → Applications.
Browser and connection requirements
Section titled “Browser and connection requirements”Use the latest Chrome, Edge, Chrome for iOS, or Firefox release, or one of the previous three major releases. Supported Firefox ESR releases and Android System WebView are also accepted; Internet Explorer and Presto-based Opera are blocked. Anonymous access to source, raw-file, and blame pages pinned to a commit may require a browser challenge. Archive downloads never require a browser challenge. HTTPS requires TLS 1.2 or newer; plain HTTP requests with URLs longer than 1,024 characters are rejected before redirecting to HTTPS.
Temporary IP bans
Section titled “Temporary IP bans”Malformed HTTP requests and failed SSH authentication attempts can trigger the following overlapping bans.
Ordinary HTTP 403 and 404 responses do not count as malformed requests.
| Trigger per IP | Window | Ban duration |
|---|---|---|
| 10 malformed HTTP requests | 10 minutes | 1 hour |
| 10 malformed HTTP requests | 5 minutes | 24 hours |
| 100 malformed HTTP requests | 1 minute | 2 hours |
| 5 failed SSH authentication attempts | 10 minutes | 1 hour |
| 10 failed SSH authentication attempts | 5 minutes | 24 hours |
| 20 failed SSH authentication attempts | 1 minute | 2 hours |
| 15 failed SSH authentication attempts | 1 hour | 24 hours |
SSH connections
Section titled “SSH connections”Each SSH connection allows up to 20 authentication attempts, 60 seconds to authenticate, and 50 simultaneous sessions. Offering several unrecognized SSH keys can trigger an IP ban before reaching the per-connection limit. See SSH Access for configuring the correct key.