The http cache we have in use is bypassed because the request header Authorization does not match the cached response header (empty for Authorization). It is working fine when we make unauthorized requests (leaving the github env vars unset).

More exactly, this call to varyMatches returns false because of the Authorization header: https://github.com/gregjones/httpcache/blob/9cad4c3443a7200dd6400aef47183728de563a38/httpcache.go#L160