🔑 Rotate TRAFFIC_PAT — 2 day(s) until expiry

TRAFFIC_PAT was last rotated on 2026-09-12 (5 days ago). It expires in 2 day(s).

Rotate it

1. Go to https://github.com/settings/tokens?type=beta and regenerate TRAFFIC_PAT (8-day rotating). Keep all repo access plus Administration: Read and Metadata: Read. Set expiry to 8 days.
2. Authorize SSO on the token. Skipping this is the most common cause of a silent failure.
3. gh secret set TRAFFIC_PAT --repo microsoft/Analytics-Hub
4. gh workflow run traffic-snapshot.yml --repo microsoft/Analytics-Hub to confirm it works.

The ledger now syncs itself from the secret's updated_at, so there is no file to bump by hand.

If this lapses

The nightly traffic-snapshot workflow fails with HTTP 403 across every microsoft/* repo. Data captured before the failure is still committed (fixed Aug 2026), but repo traffic for the missed days is lost — GitHub serves only a rolling 14-day window, so a gap longer than that is unrecoverable.

Auto-opened by .github/workflows/pat-rotation-reminder.yml.

Start with the token settings link and the rotation steps in this issue, then inspect .github/workflows/traffic-snapshot.yml and .github/workflows/pat-rotation-reminder.yml. The work is done when TRAFFIC_PAT is updated with SSO authorization, the repository secret is set, and the manually triggered traffic-snapshot workflow succeeds.