GitHub enforces undocumented-by-value secondary rate limits separately from the primary hourly quota. They cover concurrent request count, requests per minute to a single endpoint, and content-creating actions such as opening issues or comments. The response is HTTP 403 or 429 with a message containing 'You have exceeded a secondary rate limit'.
The distinguishing signal is the headers. A primary limit exhaustion sets x-ratelimit-remaining to 0 and x-ratelimit-reset to a UTC epoch-second timestamp. A secondary limit usually sets retry-after with a number of seconds and leaves x-ratelimit-remaining above zero. Retrying immediately on a secondary limit gets the client throttled harder.
GitHub's published guidance is to make requests serially rather than concurrently for the same account, wait at least one second between write requests to the same repository, and if retry-after is present sleep exactly that long before retrying. If it is absent, back off exponentially starting at a minute. Any client doing bulk writes should implement both paths.