Add async GitHub client rate limiting for the Dispatcher (DataDog#24179)

* Add async GitHub client rate limiting for the Dispatcher (AI-6475)

- Add InstrumentedAsyncLimiter wrapper around aiolimiter.AsyncLimiter that fires
  on_throttled/on_acquired callbacks for observability without touching aiolimiter internals
- Add RateLimiterFactory (dispatcher-specific) that holds two shared limiter instances
  (default 360 req/hr, slow 120 req/hr) so all processors in a run compete for the same
  token buckets; validates default+slow <= total_max_rate at construction time
- Wire rate_limiter into AsyncGitHubClient._request() and async_github_client() context manager
- Add aiolimiter==1.2.1 dependency

* Add changelog entry for DataDog#24179

* Update changelog entry for DataDog#24179

* Move RateLimiterConfig to dispatcher module and expose time_period

* Convert rate limiter config objects to Pydantic models

* Rename max_rate to hourly_max_rate and derive AsyncLimiter bucket size from it

* Revert hourly_max_rate rename; normalize to req/hr only in factory validation

* Address Codex review: keyword-only limiter arg and rate-limit artifact redirects

- Make rate_limiter, default_timeout, and transport keyword-only on
  AsyncGitHubClient and the async_github_client factory.
- Route the authenticated artifact-redirect GET through the rate-limited
  _request path so it counts against the shared limiter budget.

* Add header-driven budget governor with a configurable pacing cap

- BudgetGovernor reacts to GitHub's x-ratelimit/retry-after response headers,
  rationing requests as the shared budget runs low and hard-pausing on
  exhaustion or secondary limits; one governor is shared across both tiers.
- max_wait_seconds caps the voluntary pacing interval (factory default 300s)
  so a request never paces itself out toward the full reset window; hard
  pauses are still honored in full.
- The async client feeds each response's rate-limit headers to the governor.
- Test cleanup: shared assert_blocks helper, clock/governor fixtures and a
  snapshot factory, parametrized cases, and added branch/coverage tests.

* Address Codex review: commutative budget merges, drop underscore attributes

- observe() now keeps the lowest remaining within a window and the longest
  retry_after pause, so out-of-order concurrent responses converge to the
  strictest constraint regardless of arrival order.
- Drop leading underscores from InstrumentedAsyncLimiter and RateLimiterFactory
  instance attributes per the AGENTS.md naming rule.

* Fold the monotonic-remaining rule into BudgetSnapshot.merged_with

The within-window invariant (remaining is non-increasing until reset_at
advances) is intrinsic to a rate-limit budget, so combining two observations
enforces it directly rather than in a separate reconcile step. observe() drops
back to a plain merged_with call and the monotonic tests move to that level.

* Unify rate-limit observability into a single on_event callback

Replace the four separate callbacks (on_budget_low, on_secondary_limit,
on_throttled, on_acquired) with one on_event that receives a discriminated
RateLimitEvent union (BUCKET, BUDGET, SECONDARY_LIMIT, PACING). Events fire on
every acquire/observe/wait carrying a boolean or reason, so a single handler can
emit continuous 0/1 metrics instead of sparse per-state callbacks. The factory
shares one handler across the governor and both tier limiters.

* Collapse reserve()/reserve_with_reason() into a single reserve()

The bare reserve() had no production callers left (wait() is the only path that
reserves, and it needs the reason), so merge the two into one reserve() that
returns (target, reason). Callers take what they need.

* Harden BudgetGovernor and InstrumentedAsyncLimiter after review

- merged_with discards a stale, out-of-order response from an earlier window
  (smaller reset_at) instead of rolling budget state back, still coalescing
  retry_after.
- Acquire the local bucket token AFTER the governor wait, not before, so the
  token is taken immediately before the request fires rather than being spent
  across a long pause.
- wait() raises instead of silently proceeding if it fails to converge within
  MAX_WAIT_ITERATIONS, and emits a PacingEvent when a pause extends it mid-sleep.
- Rename budget_target_with_reason -> claim_budget_target_with_reason to signal
  the pacing-cursor mutation; sample now() once in observe's retry_after branch.
- Test suite: drop redundant/trivial tests, parametrize the merged_with overlay
  and wait() pacing-reason cases, assert behavior over internals, and add
  stale-window, concurrency, mid-sleep-extension, fail-loud, and acquire-order
  coverage.

* Track the pause floor for extension events; drop a misleading concurrency test

- wait() emits the mid-sleep SECONDARY_LIMIT PacingEvent only when the pause
  floor actually grows, instead of on every post-first iteration. This avoids a
  spurious event from monotonic-vs-wall-clock skew (asyncio.sleep uses the loop's
  monotonic clock while now() is wall-clock) and keeps the fail-loud path quiet.
- Remove test_concurrent_waits_stagger_by_pacing_interval: the shared-advancing
  fake clock cannot model overlapping sleeps, so the test only passed because it
  ran sequentially; making it genuinely interleave collapses all finish times.
  The cursor invariant is structural (no await between reading and advancing
  next_slot) and covered by the sequential pacing test.
- Nits: rename test to match its contract, use get_running_loop/create_task, and
  cancel the in-flight task in a finally.

* Replace max_wait_seconds cap with a window-reset clamp

max_wait_seconds was an arbitrary bound. The principled bound is the window
itself: a rationed request never needs to wait past reset_at, because the budget
refills then. claim_budget_target_with_reason now clamps at the boundary — once
the pacing cursor reaches reset_at the window is spent, so overflow requests wait
exactly until reset+buffer (EXHAUSTED) without advancing the cursor, so they all
get the same target. Removes the config field, the governor parameter, and their
tests; drops the pointless conditional advance in test_reserve_returns_now.

* Forbid unknown keys in the rate limiter config models

* Shorten the rate limiting changelog entry

* Drop retry_after from the persisted budget and tighten rate-limit tests

- BudgetSnapshot.merged_with no longer carries retry_after; it is a transient
  secondary-limit signal consumed only in observe, which makes the budget merge
  fully commutative.
- Normalize snapshot construction in tests onto the make_snapshot factory and
  give it explicit optional fields instead of opaque **fields.
- Rewrite the convergence test to assert an explicit expected state and name the
  failing permutation.
- Docstring cleanup: state final behavior only, no development history.

* Enforce the synchronous pacing-claim invariant with tests

Add two guards for the "no await between reading and advancing next_slot" rule
that reserve()'s inline comment relies on:

- test_pacing_claim_path_is_synchronous asserts the claim path stays synchronous
  and, on failure, tells the editor what mechanism they owe in exchange.
- test_reserve_assigns_distinct_slots_under_concurrent_claims gathers concurrent
  claims on the real event loop and asserts distinct, interval-spaced slots.

Point the inline comment at both tests so it reads as enforced, not advisory.

* Replace the wait iteration cap's flood role with a time budget

The iteration count bounded nothing meaningful in time: one iteration costs
anywhere from seconds to a retry_after of many minutes. Add an opt-in
max_wait_seconds killswitch on BudgetGovernor that bounds the total time a
single wait() may target, from when it starts, across both exhausted-window
waits and accumulated secondary-limit extensions.

- Raise RateLimitWaitAbandoned (subclasses TimeoutError) carrying waited_seconds
  and remaining_seconds; fail fast the moment the floor crosses the budget
  rather than sleeping into a doomed wait.
- Emit a PacingEvent with the new PacingReason.ABANDONED before raising.
- Default None keeps the current wait-indefinitely behavior.
- Keep MAX_WAIT_ITERATIONS as the RuntimeError backstop for the no-progress bug
  (frozen clock) that a time budget cannot detect.
- Fold in the single-current_floor cleanup in the wait loop.

* Make GitHub client rate-limit protection the default and add rate-limit-aware retries

Protection is now always on: constructing the async client without a rate_limiter
builds a default one (a permissive bucket fronting a reactive BudgetGovernor) instead
of running unprotected. Because octo-sts mints the token against one installation for
the whole company, an unprotected client would degrade every other consumer.

- Add github_async/defaults.py with default_github_rate_limiter and
  log_rate_limit_events (GitHub-shaped defaults; the rate_limiting module stays
  provider-agnostic).
- Observe response headers before raise_for_status so a failed response's rate-limit
  signal is learned even when the caller swallows the exception.
- Retry header-confirmed rate-limit responses (403/429) in _request; re-acquiring the
  limiter is the backoff, so there is no sleep or backoff math in the client. Transport
  errors and non-rate-limit statuses are never retried; RateLimitWaitAbandoned
  propagates. Bounded by max_rate_limit_retries (default 2).
- Lower MAX_WAIT_ITERATIONS to 100 now that the time budget guards real floods.

Author: AAraKKe

ddev/changelog.d/24179.added

@@ -0,0 +1 @@
+Add GitHub API rate limiting to the Dispatcher.

ddev/pyproject.toml

@@ -26,6 +26,7 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
+    "aiolimiter==1.2.1",
     "anthropic>=0.18.0",
     "click~=8.1.6",
     "coverage",

ddev/src/ddev/cli/ci/tests/rate_limiting.py

@@ -0,0 +1,131 @@
+# (C) Datadog, Inc. 2026-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+"""Dispatcher-specific rate limiter factory."""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Callable
+
+from aiolimiter import AsyncLimiter
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+from ddev.utils.rate_limiting import (
+    RATE_LIMIT_TIME_PERIOD,
+    BudgetGovernor,
+    InstrumentedAsyncLimiter,
+    RateLimitEvent,
+    RateLimitEventType,
+)
+
+SECONDS_PER_HOUR = 3600.0
+
+
+def event_logger(logger: logging.Logger) -> Callable[[RateLimitEvent], None]:
+    """Build an on_event handler that logs the informative rate-limit events at debug level."""
+
+    def handle(event: RateLimitEvent) -> None:
+        if event.type is RateLimitEventType.BUDGET and event.is_low:
+            logger.debug(
+                "GitHub rate-limit budget low: %s/%s remaining, resets in %.1fs",
+                event.remaining,
+                event.limit,
+                event.reset_in_seconds,
+            )
+        elif event.type is RateLimitEventType.SECONDARY_LIMIT:
+            logger.debug("GitHub secondary rate limit hit, retry after %.1fs", event.retry_after_seconds)
+        elif event.type is RateLimitEventType.BUCKET and event.throttled:
+            logger.debug("%s rate limiter throttling request", event.name)
+
+    return handle
+
+
+class RateLimiterConfig(BaseModel):
+    """Rate limit configuration for a single limiter tier."""
+
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    max_rate: float = Field(gt=0)
+    time_period: float = Field(default=RATE_LIMIT_TIME_PERIOD, gt=0)
+
+    @property
+    def hourly_rate(self) -> float:
+        """Effective rate expressed in requests per hour."""
+        return self.max_rate / self.time_period * SECONDS_PER_HOUR
+
+
+class RateLimiterFactoryConfig(BaseModel):
+    """Configuration for the Dispatcher's two-tier rate limiter factory.
+
+    Each tier defines its own max_rate and time_period. The combined hourly rate of
+    both tiers must not exceed total_hourly_max_rate.
+
+    Default values:
+    - default: 360 req/hr — typical integrations
+    - slow: 120 req/hr — integrations with long-running tests
+    - total_hourly_max_rate: 1,500 req/hr — = 15k octo-sts budget / 10 max concurrent runs
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    default: RateLimiterConfig = RateLimiterConfig(max_rate=360.0)
+    slow: RateLimiterConfig = RateLimiterConfig(max_rate=120.0)
+    total_hourly_max_rate: float = Field(default=1500.0, gt=0)
+    slow_integrations: frozenset[str] = frozenset()
+    reserve_fraction: float = Field(default=0.15, gt=0, le=1)
+    budget_buffer_seconds: float = Field(default=1.0, ge=0)
+
+    @model_validator(mode="after")
+    def validate_combined_rate(self) -> RateLimiterFactoryConfig:
+        combined = self.default.hourly_rate + self.slow.hourly_rate
+        if combined > self.total_hourly_max_rate:
+            raise ValueError(
+                f"default ({self.default.hourly_rate} req/hr) + slow ({self.slow.hourly_rate} req/hr) = "
+                f"{combined} exceeds total_hourly_max_rate ({self.total_hourly_max_rate} req/hr)"
+            )
+        return self
+
+
+class RateLimiterFactory:
+    """Creates and vends rate limiters for the Dispatcher.
+
+    Holds exactly two shared InstrumentedAsyncLimiter instances — one for
+    the default tier and one for the slow tier. All processors in a dispatcher
+    run share the same factory, so they compete for the same token buckets and
+    the per-run combined rate stays bounded.
+    """
+
+    def __init__(
+        self,
+        config: RateLimiterFactoryConfig | None = None,
+        logger: logging.Logger | None = None,
+    ) -> None:
+        cfg = config or RateLimiterFactoryConfig()
+        self.slow_integrations = cfg.slow_integrations
+        on_event = event_logger(logger) if logger else None
+        budget_governor = BudgetGovernor(
+            reserve_fraction=cfg.reserve_fraction,
+            buffer_seconds=cfg.budget_buffer_seconds,
+            on_event=on_event,
+        )
+        self.default = InstrumentedAsyncLimiter(
+            AsyncLimiter(cfg.default.max_rate, cfg.default.time_period),
+            on_event=on_event,
+            budget_governor=budget_governor,
+            name="default",
+        )
+        self.slow = InstrumentedAsyncLimiter(
+            AsyncLimiter(cfg.slow.max_rate, cfg.slow.time_period),
+            on_event=on_event,
+            budget_governor=budget_governor,
+            name="slow",
+        )
+
+    def get_limiter(self, integrations: frozenset[str]) -> InstrumentedAsyncLimiter:
+        """Return the appropriate rate limiter for the given set of integrations.
+
+        Returns the slow limiter if any integration appears in the slow list,
+        otherwise returns the default limiter.
+        """
+        return self.slow if integrations & self.slow_integrations else self.default

ddev/src/ddev/utils/github_async/client.py

@@ -8,15 +8,18 @@
 import io
 import re
 import zipfile
-from collections.abc import AsyncIterator
-from contextlib import asynccontextmanager
+from collections.abc import AsyncIterator, Callable
+from contextlib import asynccontextmanager, suppress
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Literal, Self, overload
 
 import httpx
 from pydantic import BaseModel, ConfigDict, Field
 
+from ddev.utils.rate_limiting import NULL_SNAPSHOT, BudgetSnapshot, InstrumentedAsyncLimiter
+
+from .defaults import default_github_rate_limiter
 from .models import (
     ArtifactsList,
     CheckRun,
@@ -75,24 +78,80 @@ class GitHubResponse[T](BaseModel):
     headers: dict[str, str] = Field(default_factory=dict)
 
 
+def parse_header[T](headers: httpx.Headers, key: str, cast: Callable[[str], T]) -> T | None:
+    """Return the header at *key* run through *cast*, or None if it is absent or unparseable."""
+    raw = headers.get(key)
+    if raw is None:
+        return None
+    with suppress(ValueError, TypeError):
+        return cast(raw)
+    return None
+
+
+def github_rate_limit_snapshot(headers: httpx.Headers) -> BudgetSnapshot | None:
+    """Parse GitHub's `x-ratelimit-*` / `retry-after` response headers into a BudgetSnapshot."""
+    snapshot = BudgetSnapshot(
+        limit=parse_header(headers, "x-ratelimit-limit", int),
+        remaining=parse_header(headers, "x-ratelimit-remaining", int),
+        reset_at=parse_header(headers, "x-ratelimit-reset", float),
+        retry_after=parse_header(headers, "retry-after", lambda raw: float(int(raw))),
+    )
+    return snapshot if snapshot != NULL_SNAPSHOT else None
+
+
 class AsyncGitHubClient:
     """
     Async HTTP client for the GitHub REST API.
 
     Uses a shared httpx.AsyncClient for connection pooling. Call `aclose()` when
     finished to release resources, or use the `async_github_client` context manager.
+
+    Rate-limit protection is on by default: requests are paced and, when GitHub signals a
+    rate-limit rejection, retried in reaction to the response headers. The governor supplies the
+    backoff, so there is no sleeping or backoff arithmetic in this client. The default protection
+    logs through the ``ddev.utils.github_async.defaults`` logger.
+
+    Args:
+        token: GitHub token; must be non-empty.
+        rate_limiter: Overrides the default rate limiter; it does not enable protection, which is
+            already on. None builds the default (a permissive local bucket fronting a reactive
+            BudgetGovernor). There is deliberately no way to disable protection: GitHub requires
+            clients to honor ``retry-after``, and persistent violations risk the shared token being
+            throttled harder or banned. Because octo-sts mints the token against one installation
+            for the whole company, a single unprotected client instance degrades every other
+            consumer of that token. Callers with special needs pass their own limiter; they do not
+            turn protection off.
+        default_timeout: Default per-request HTTP timeout in seconds. Bounds individual HTTP
+            requests only; it does not bound governor waits. To bound total wait, pass a limiter
+            whose governor sets ``max_wait_seconds``.
+        max_rate_limit_retries: Extra attempts for a header-confirmed rate-limit response (403/429).
+            Each retry is a full fresh acquisition (governor wait plus bucket token); the default of
+            2 covers the common "hit a secondary limit once, wait, succeed" case plus one repeat.
+            Only rate-limit responses are retried: transport errors and non-rate-limit statuses
+            propagate immediately, and RateLimitWaitAbandoned (the governor's ``max_wait_seconds``
+            killswitch) propagates to the caller.
+        transport: Optional custom HTTPX transport (useful for testing with MockTransport).
     """
 
     def __init__(
         self,
         token: str,
+        *,
+        rate_limiter: InstrumentedAsyncLimiter | None = None,
         default_timeout: float = 30.0,
+        max_rate_limit_retries: int = 2,
         transport: httpx.AsyncBaseTransport | None = None,
     ) -> None:
         if not token:
             raise ValueError("GitHub token must not be empty.")
 
+        # A None limiter means "use the default protection," not "no protection." The local bucket
+        # is deliberately permissive because the governor is the protection; with a healthy budget
+        # and no secondary limits the governor adds zero wait, so this default is invisible to
+        # well-behaved callers and engages only once GitHub has already signaled backpressure.
+        self._rate_limiter = rate_limiter if rate_limiter is not None else default_github_rate_limiter()
         self._default_timeout = default_timeout
+        self._max_rate_limit_retries = max_rate_limit_retries
         self._headers = {
             "Authorization": f"Bearer {token}",
             "X-GitHub-Api-Version": GITHUB_API_VERSION,
@@ -116,21 +175,71 @@ async def aclose(self) -> None:
     def _effective_timeout(self, timeout: float | None) -> float:
         return timeout if timeout is not None else self._default_timeout
 
-    async def _request(
+    @staticmethod
+    def _is_rate_limit_response(response: httpx.Response) -> bool:
+        """Whether *response* is a retryable rate-limit rejection, by GitHub's own discrimination rule.
+
+        A 403 is also used for plain permission denials, which waiting cannot fix; retrying one would
+        sleep out a pause (up to a full window) and then fail identically. Only header-confirmed
+        rate-limit responses are retryable.
+        """
+        if response.status_code not in (403, 429):
+            return False
+        return "retry-after" in response.headers or response.headers.get("x-ratelimit-remaining") == "0"
+
+    async def _execute_request(
         self,
         method: str,
         endpoint: str,
-        timeout: float | None = None,
+        timeout: float,
         **kwargs: Any,
     ) -> httpx.Response:
-        effective_timeout = self._effective_timeout(timeout)
         try:
-            response = await self._client.request(method, endpoint, timeout=effective_timeout, **kwargs)
+            response = await self._client.request(method, endpoint, timeout=timeout, **kwargs)
         except httpx.TransportError as exc:
             raise type(exc)(f"{method} {endpoint}: {exc}") from exc
+        # Observe before raise_for_status, never after: learning must not be gated on success. A
+        # failed response's rate-limit headers arm the shared pause even if the caller swallows the
+        # exception, so one request's 403 protects every other in-flight and future request in this
+        # process.
+        snapshot = github_rate_limit_snapshot(response.headers)
+        if snapshot is not None:
+            self._rate_limiter.observe(snapshot)
         response.raise_for_status()
         return response
 
+    async def _request(
+        self,
+        method: str,
+        endpoint: str,
+        timeout: float | None = None,
+        **kwargs: Any,
+    ) -> httpx.Response:
+        effective_timeout = self._effective_timeout(timeout)
+        # Rate-limit-aware retry lives here, not in _execute_request: re-entering the limiter IS the
+        # backoff. The failed response's headers were observed inside _execute_request before the
+        # exception propagated, so the governor already holds the pause this very 403 armed;
+        # re-acquiring waits it out exactly (retry-after plus buffer for secondary limits, until
+        # reset for an exhausted window). Hence no sleeps or backoff math. A loop inside
+        # _execute_request would be wrong: it would retry while still holding the acquisition,
+        # without re-consulting the governor. Concurrent retries also serialize behind the same
+        # shared pause instead of stampeding, which is what GitHub's secondary-limit guidance asks
+        # for. RateLimitWaitAbandoned raised while (re-)acquiring propagates untouched from here: it
+        # is the caller-configured killswitch, and counting it as an attempt would defeat it.
+        for attempt in range(self._max_rate_limit_retries + 1):
+            async with self._rate_limiter:
+                try:
+                    return await self._execute_request(method, endpoint, effective_timeout, **kwargs)
+                except httpx.HTTPStatusError as exc:
+                    # A rate-limit 403/429 is safe to retry for every endpoint, including
+                    # non-idempotent POSTs, precisely because GitHub rejected it without performing
+                    # the action. (Transport errors are never retried, and are not caught here: after
+                    # one we cannot know whether the action executed.) Give up on the last attempt or
+                    # on a non-rate-limit status, which waiting cannot fix.
+                    if attempt == self._max_rate_limit_retries or not self._is_rate_limit_response(exc.response):
+                        raise
+        raise RuntimeError("unreachable: the retry loop always returns or raises")  # pragma: no cover
+
     async def _paginated_request(
         self,
         method: str,
@@ -598,13 +707,17 @@ async def _resolve_artifact_redirect(
         timeout: float | None = None,
     ) -> str:
         """Authenticated GET; return the unauthenticated signed URL from the 302 Location header."""
-        effective_timeout = self._effective_timeout(timeout)
-        redirect_response = await self._client.request(
-            "GET",
-            archive_download_url,
-            timeout=effective_timeout,
-            follow_redirects=False,
-        )
+        try:
+            redirect_response = await self._request(
+                "GET", archive_download_url, timeout=timeout, follow_redirects=False
+            )
+        except httpx.HTTPStatusError as exc:
+            # httpx.raise_for_status() treats the expected 302 as an error since it isn't a 2xx;
+            # recover the response from the exception so the redirect can still be inspected below.
+            # The retry layer in _request is deliberately transparent here: a 302 is not a rate-limit
+            # response by _is_rate_limit_response, so it is never retried and surfaces on the first
+            # attempt exactly as before.
+            redirect_response = exc.response
         if redirect_response.status_code != 302:
             redirect_response.raise_for_status()
             raise httpx.HTTPError(
@@ -678,21 +791,41 @@ async def download_artifact(
 @asynccontextmanager
 async def async_github_client(
     token: str,
+    *,
+    rate_limiter: InstrumentedAsyncLimiter | None = None,
     default_timeout: float = 30.0,
+    max_rate_limit_retries: int = 2,
     transport: httpx.AsyncBaseTransport | None = None,
 ) -> AsyncIterator[AsyncGitHubClient]:
     """
     Async context manager that creates an AsyncGitHubClient and ensures it is closed on exit.
 
+    Rate-limit protection is on by default; the governor paces requests and supplies the backoff for
+    retries. Header-confirmed rate-limit responses (403/429) are retried, transport errors and
+    non-rate-limit statuses are not, and RateLimitWaitAbandoned propagates to the caller when the
+    governor is configured with a wait budget. The default protection logs through the
+    ``ddev.utils.github_async.defaults`` logger.
+
     Args:
         token: GitHub personal access token or app token.
-        default_timeout: Default request timeout in seconds.
+        rate_limiter: Overrides the default rate limiter; None uses the built-in default. This
+            selects which limiter to use, it does not enable or disable protection (protection is
+            always on).
+        default_timeout: Default per-request HTTP timeout in seconds. Bounds individual HTTP
+            requests only, not governor waits.
+        max_rate_limit_retries: Extra attempts for a header-confirmed rate-limit response.
         transport: Optional custom HTTPX transport (useful for testing with MockTransport).
 
     Yields:
         AsyncGitHubClient: A ready-to-use async GitHub client.
     """
-    client = AsyncGitHubClient(token=token, default_timeout=default_timeout, transport=transport)
+    client = AsyncGitHubClient(
+        token=token,
+        rate_limiter=rate_limiter,
+        default_timeout=default_timeout,
+        max_rate_limit_retries=max_rate_limit_retries,
+        transport=transport,
+    )
     try:
         yield client
     finally: