What changed
On October 19, 2026, GitHub announced that during unusual traffic it may temporarily require authentication for some public-repository Git clone and fetch operations over HTTPS on github.com. Affected operations fail with an authentication-required message. The company says protections are applied narrowly using signals associated with anomalous traffic, but legitimate clients sharing those signals can be caught. Authenticated HTTPS Git operations, SSH Git operations, pushes, and unrelated web/API traffic are unaffected. This is not a permanent blanket login requirement for public repositories.
Why it matters
Anonymous cloning is a common assumption in deployment scripts, ephemeral build agents, dependency mirrors and unattended automation. A job can now fail even when a repository is public and healthy. Operators should distinguish selective traffic-protection failures from missing repository permissions, TLS problems and ordinary outages, then choose credentialed transport or a bounded retry policy appropriate to the environment.
The failure is conditional, not a change to repository visibility
GitHub can request credentials for an otherwise public HTTPS clone or fetch only while its traffic protection is active for the affected request. This applies across github.com plans. The protection is targeted, but legitimate automated clients can be caught because traffic characteristics overlap with abusive patterns. A failure is not evidence the repository became private.
CI should use credentials where reliability matters
GitHub recommends the built-in GITHUB_TOKEN for GitHub Actions and a GitHub App installation token for other CI systems; personal access tokens remain an alternative. Authenticated HTTPS Git and SSH are outside the announced protection. Avoid placing tokens in clone URLs, shell history or logs; scope permissions and rotate credentials according to your usual CI policy.
Unauthenticated consumers need a retry path
Where credentials cannot be supplied, GitHub says to wait and retry after the temporary protection lifts. Backoff with a cap and a clear failure reason is preferable to infinite retries or silently substituting an untrusted mirror. Separate this failure mode from GitHub's earlier SHA-1/TLS compatibility retirement, which is unrelated.