Update

[ghstack-poisoned]

Author: jeanschmidt

greenlight/tests/test_github_types.py

@@ -0,0 +1,9 @@
+from greenlight import github_types
+
+
+def test_github_types_module_imports_and_exposes_runtime_protocols():
+    # Every other Protocol in github_types is defined under TYPE_CHECKING; VerdictClient and ScanClient
+    # are the only two that exist at import time, so importing the module and touching them is all there
+    # is to exercise at runtime.
+    assert isinstance(github_types.VerdictClient, type)
+    assert isinstance(github_types.ScanClient, type)

greenlight/tests/test_review.py

@@ -1254,8 +1254,11 @@ def factory(_token, *, seconds_between_requests=None):
 
 
 def test_fingerprint_throttle_stays_under_burst_limit():
-    # Aggregate fan-out rate is workers / seconds-between-requests; keep it <= 8 req/s to stay
-    # under GitHub's secondary (burst-rate) limit.
+    # The asserted quantity is the fan-out's aggregate request rate (workers / seconds-between-requests).
+    # 8 req/s is our own conservative budget, NOT a GitHub-published limit -- it is the ceiling we chose
+    # to stay comfortably under GitHub's (undocumented, variable) secondary/burst rate limit. It bounds
+    # only this fingerprint fan-out; the listing, dispatch, verdict, and authz clients each pace
+    # themselves independently and sit outside this budget.
     assert review._FINGERPRINT_WORKERS / review._FINGERPRINT_SECONDS_BETWEEN_REQUESTS <= 8