This does not answer the question. How do you find out which repo the excessive cache use is in without individually checking each one?

thanks for trying to response, unfortunately, this answer is as unhelpful as the previouse AI generated one

Thanks a lot for the extended explanation!
Found the repo, was in one org of a company where I am a member of (maybe even an admin for that)

It's not node_modules, it's Rust dependencies, terrible stuff, size-wise

Thank you - I found it that way. The gh command did NOT reveal that information.

No, thats a legitimate GitHub mail. With dkim and spf , proper return addresses and no wrong links

It also raised flags with me – app.github.media not being a known domain to me, I refrained from clicking any links therein. There's also zero personalisation in the mail; that the repo / org in question is missing is the main issue discussed here, but the greeting is also just "Hello", so the mail basically screams "ignore/delete me!"

that is the answer I got from AI when I threw in the mail header

Thanks for sharing the full header — that helps.

Quick analysis:

Return-Path: bounce@resources.github.com → legit GitHub mail infrastructure.

SPF: pass for resources.github.com.

DKIM: pass for github.com and also for us.en25.com.

DMARC: pass for github.com.

From: GitHub no-reply@github.com matches DKIM.

ARC/Google checks: also pass.

👉 So the mail really comes from GitHub (or their mailing vendor Oracle Eloqua, en25.com).
The weird part is only the unsubscribe link pointing to app.github.media. That’s not a standard GitHub domain, but it seems to be part of their email marketing setup (very likely a branded link-tracking / unsubscribe domain operated by Eloqua).

So:

The header itself is clean, no spoofing.

The app.github.media links are probably safe redirectors GitHub uses for tracking and unsubscribes.

Still: if you don’t trust it, don’t click directly — instead, log in to GitHub → Settings → Notifications and manage subscriptions there.

anyhow, strange mail, maybe thei AI went cracy :-)

See my reply above; the mail is weird. The documentation still mentions:

GitHub will remove any cache entries that have not been accessed in over 7 days. There is no limit on the number of caches you can store, but the total size of all caches in a repository is limited to 10 GB. Once a repository has reached its maximum cache storage, the cache eviction policy will create space by deleting the caches in order of last access date, from oldest to most recent.

If you exceed the limit, GitHub will save the new cache but will begin evicting caches until the total size is less than the repository limit. The cache eviction process may cause cache thrashing, where caches are created and deleted at a high frequency. To reduce this, you can review the caches for a repository and take corrective steps, such as removing caching from specific workflows. See Managing caches.

I agree that the docs seemingly not being updated together with no announcements is strange. I still don't believe this to be phishing as the sender email address appears legit and I have received emails pointing to app.github.media in the past.

I notice that most no-reply emails from github have the sender noreply@github.com while this email has no-reply@github.com though

Reading through everything again, I'm wondering if there is actually any action required by this email? It almost seems like a poorly worded sales pitch.

They already automatically evict stuff from cache when the size exceeds 10gb (although it's possible they'll be more aggressive about that going forwards?), and the size of cache available for free is not changing. The only new information provided in this email is the fact that you will be able to pay to increase the size of cache on a per-repository basis.

As long as they don't automatically extend your cache size and start billing you, it should be possible to ignore the email and everything will continue working the same as it already does.