Incident with several GitHub Services

What to do

• Check whether you use GitHub API Requests, Issues, Pull Requests, Actions and 1 more. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 1h 29m it lasted.

  Anything that failed between 2026-09-13 09:16 UTC and 2026-09-13 10:44 UTC may need a replay.

• Subscribe to GitHub's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=github works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from GitHub 6

1. investigatingSep 13, 2026, 9:16 AM UTC

   We are investigating reports of degraded availability for API Requests, Issues, Pages and Pull Requests

   provider

2. investigatingSep 13, 2026, 9:25 AM UTC

   Actions is experiencing degraded performance. We are continuing to investigate.

   provider

3. investigatingSep 13, 2026, 9:36 AM UTC

   We're seeing increased database replication delays on collab which is causing increased error rates in authorization endpoints and follow-on increased error rates across the system - we are investigating

   provider

4. investigatingSep 13, 2026, 10:26 AM UTC

   We have reduced load on this cluster with internal load-shedding and are seeing signs of recovery but continue to monitor

   provider

5. investigatingSep 13, 2026, 10:28 AM UTC

   Pull Requests is experiencing degraded performance. We are continuing to investigate.

   provider

6. resolvedSep 13, 2026, 10:44 AM UTC

   On September 13, 2026, between 08:43 and 10:44 UTC, GitHub experienced degraded availability across approximately 28 services, including Issues, Pull Requests, Actions, Codespaces, Pages, Notifications, Code Scanning, Git LFS, and new account signup. At peak, 8.8% of requests to create GitHub App installation access tokens failed. Token issuance for Actions workflows was also affected, impacting approximately 4% of workflows during the incident time frame. Creating issues through the web interface failed for about 96% of attempts, and signup failures were above 90%. The cause was an internal data-cleanup job that began writing to a shared database cluster at 07:33 UTC. That cluster stores permission data read on nearly every authenticated request. The safeguard that was pacing the background job watched only one health signal — how far the database replicas were lagging — and that signal stayed low the whole time. It did not account for the load building on the primary itself, so the job kept writing while the primary quietly ran toward its limit. When the primary ran out of available connections, requests that needed it could not complete. First, there was no quick timeout on these database calls, so request handlers waited on the stalled database instead of failing fast, and the shared request-handling capacity degraded into site-wide errors. Second, a retry loop around token creation kept re-sending the writes that were already failing, which held the database saturated rather than letting it recover. Monitoring declared the incident at 08:50 UTC, but due to the broad impact and amplification from token creation, it took time to identify the source of the load. First responders mitigated by shedding internal load and pausing the job, and all services recovered by 10:44 UTC. To prevent recurrence, we are rate-limiting background jobs against shared, customer-serving databases by default, and adding automatic pausing and paging on primary-server load rather than replication lag alone. We are also surfacing running background work directly alongside database health signals so responders can see and pause it without leaving those dashboards, bounding retries in the token-issuing path, and adding request-level timeouts so one unhealthy database cannot consume shared web server capacity. In addition, we are breaking apart this database cluster to remove the single point of failure. We will be moving various service-specific data, including the authorization data, out of this shared cluster in the next two weeks.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.