Bug Report - Rate limiting large OSS organization uploads.

[dopry]

Describe the bug
I am a team lead with https://github.com/jazzband/django-oauth-toolkit and our uploads are getting rate limited. Example here: https://github.com/jazzband/django-oauth-toolkit/actions/runs/15582850170/job/44015235321#step:8:38

This is a recent change. Project team leads don't have the ability to set repo secrets and the repo specific upload token, otherwise I'd do that. Jazzband is a rather large org with a lot of projects and contributors. Is there anyway you guys can ease the rate limiting for the ORG?

[thomasrockhu-codecov]

@dopry you can try using OIDC here, I think that would fix the issue

[spalmurray]

https://github.com/codecov/codecov-action?tab=readme-ov-file#using-oidc

[dopry]

I think I've got this setup and it seems to be working, django-oauth/django-oauth-toolkit#1585, with OIDC is the user/principal the Github repo? or is it some other entity? I don't really understand who/what is authenticating when we use OIDC and github's docs didn't really make that very clear to me.

[spalmurray]

@dopry good question, hadn't really thought about that before. Best I can find is this quote which makes it sound like it authenticates as the workflow:

A step or action in the workflow job can request a token from GitHub’s OIDC provider, which can then be presented to the cloud provider as proof of the workflow’s identity.

from https://docs.github.com/en/actions/concepts/security/openid-connect#how-oidc-integrates-with-github-actions

[dopry]

oh there it is just below in the example token, "sub": "repo:octo-org/octo-repo:environment:prod". It looks like the subject is the repo/environment.