[0x73746F66]

Documents Vulnetix/cli#342 in cli/ci-cd/granular-actions.md.

• Scanners skip impossible names and stop early. They never ask GitHub about a name that cannot be a repository (uses: $/sbom, globs, placeholders), and a repository 404 ends the lookup, so one repository costs 1–4 requests.
• In GitHub Actions the lookups keep 80% of the job token's hourly limit. They stop at 4,000 of 5,000, above analyze's half. They also stop on any rate-limit answer, and unchecked licences stay UNKNOWN with a warning.
• Each batch logs its request count, so run logs show what each job spent.
• Prior steps get no token. An extra's prior scanner step gets github-token: "" on every event.
• Includes the evidence. On the push that merged fix(analyze): a spent GitHub quota at preflight skips the forge pass instead of failing the run cli#341 the scan jobs' lookups spent 4,913 requests in under 3.5 minutes, and the SCA job's SARIF upload failed on the rate limit.