diff --git a/lib/analyze-action.js b/lib/analyze-action.js
index 400eaccd3..f8bc178e5 100644
--- a/lib/analyze-action.js
+++ b/lib/analyze-action.js
@@ -79624,14 +79624,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -79648,7 +79648,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url2, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -79675,7 +79675,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url2, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core15.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -89751,13 +89751,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -90372,14 +90384,19 @@ async function deleteActionsCache(id) {
   });
 }
 function wrapApiConfigurationError(e) {
-  if (isHTTPError(e)) {
-    if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
-      return new ConfigurationError(e.message);
-    } else if (e.message.includes("Bad credentials") || e.message.includes("Not Found")) {
+  const httpError = asHTTPError(e);
+  if (httpError !== void 0) {
+    if (httpError.message.includes("API rate limit exceeded") || httpError.message.includes("commit not found") || httpError.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(httpError.message)) {
+      return new ConfigurationError(httpError.message);
+    }
+    if (httpError.message.includes("Bad credentials") || httpError.message.includes("Not Found")) {
       return new ConfigurationError(
         "Please check that your token is valid and has the required permissions: contents: read, security-events: write"
       );
     }
+    if (httpError.status === 429) {
+      return new ConfigurationError("API rate limit exceeded");
+    }
   }
   return e;
 }
@@ -91545,9 +91562,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -91695,7 +91713,7 @@ async function cleanupTrapCaches(config, features, logger) {
     }
     return { trap_cache_cleanup_size_bytes: totalBytesCleanedUp };
   } catch (e) {
-    if (isHTTPError(e) && e.status === 403) {
+    if (asHTTPError(e)?.status === 403) {
       logger.warning(
         `Could not cleanup TRAP caches as the token did not have the required permissions. To clean up TRAP caches, ensure the token has the "actions:write" permission. See ${"https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs" /* ASSIGNING_PERMISSIONS_TO_JOBS */} for more information.`
       );
@@ -94278,19 +94296,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core12.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core12.warning(e.message);
+            core12.warning(httpError.message);
           }
           return;
         case 404:
-          core12.warning(e.message);
+          core12.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
@@ -95684,16 +95703,17 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) {
     logger.info("Successfully uploaded results");
     return response.data.id;
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
-          core13.warning(e.message || GENERIC_403_MSG);
+          core13.warning(httpError.message || GENERIC_403_MSG);
           break;
         case 404:
-          core13.warning(e.message || GENERIC_404_MSG);
+          core13.warning(httpError.message || GENERIC_404_MSG);
           break;
         default:
-          core13.warning(e.message);
+          core13.warning(httpError.message);
           break;
       }
     }
diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js
index bf3b0f624..83379d14c 100644
--- a/lib/autobuild-action.js
+++ b/lib/autobuild-action.js
@@ -73775,14 +73775,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -73799,7 +73799,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -73826,7 +73826,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core14.debug(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -77688,13 +77688,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -78994,9 +79006,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -79928,19 +79941,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core12.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core12.warning(e.message);
+            core12.warning(httpError.message);
           }
           return;
         case 404:
-          core12.warning(e.message);
+          core12.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
diff --git a/lib/init-action-post.js b/lib/init-action-post.js
index e8b990385..c32c1a0f9 100644
--- a/lib/init-action-post.js
+++ b/lib/init-action-post.js
@@ -79624,14 +79624,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -79648,7 +79648,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url2, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -79675,7 +79675,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url2, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core18.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -128050,13 +128050,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -128603,14 +128615,19 @@ async function listActionsCaches(key, ref) {
   );
 }
 function wrapApiConfigurationError(e) {
-  if (isHTTPError(e)) {
-    if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
-      return new ConfigurationError(e.message);
-    } else if (e.message.includes("Bad credentials") || e.message.includes("Not Found")) {
+  const httpError = asHTTPError(e);
+  if (httpError !== void 0) {
+    if (httpError.message.includes("API rate limit exceeded") || httpError.message.includes("commit not found") || httpError.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(httpError.message)) {
+      return new ConfigurationError(httpError.message);
+    }
+    if (httpError.message.includes("Bad credentials") || httpError.message.includes("Not Found")) {
       return new ConfigurationError(
         "Please check that your token is valid and has the required permissions: contents: read, security-events: write"
       );
     }
+    if (httpError.status === 429) {
+      return new ConfigurationError("API rate limit exceeded");
+    }
   }
   return e;
 }
@@ -129683,9 +129700,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -131757,19 +131775,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core13.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core13.warning(e.message);
+            core13.warning(httpError.message);
           }
           return;
         case 404:
-          core13.warning(e.message);
+          core13.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
@@ -133163,16 +133182,17 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) {
     logger.info("Successfully uploaded results");
     return response.data.id;
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
-          core14.warning(e.message || GENERIC_403_MSG);
+          core14.warning(httpError.message || GENERIC_403_MSG);
           break;
         case 404:
-          core14.warning(e.message || GENERIC_404_MSG);
+          core14.warning(httpError.message || GENERIC_404_MSG);
           break;
         default:
-          core14.warning(e.message);
+          core14.warning(httpError.message);
           break;
       }
     }
diff --git a/lib/init-action.js b/lib/init-action.js
index b3e6eb983..a7d6314e5 100644
--- a/lib/init-action.js
+++ b/lib/init-action.js
@@ -80721,14 +80721,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -80745,7 +80745,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -80772,7 +80772,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core14.debug(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -85625,13 +85625,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -87450,9 +87462,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -90447,19 +90460,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core11.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core11.warning(e.message);
+            core11.warning(httpError.message);
           }
           return;
         case 404:
-          core11.warning(e.message);
+          core11.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js
index 8e528e810..66584e7f8 100644
--- a/lib/resolve-environment-action.js
+++ b/lib/resolve-environment-action.js
@@ -73775,14 +73775,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -73799,7 +73799,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -73826,7 +73826,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core13.debug(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -77681,13 +77681,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -79555,19 +79567,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core11.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core11.warning(e.message);
+            core11.warning(httpError.message);
           }
           return;
         case 404:
-          core11.warning(e.message);
+          core11.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js
index f1637415d..8ae60d832 100644
--- a/lib/setup-codeql-action.js
+++ b/lib/setup-codeql-action.js
@@ -79624,14 +79624,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -79648,7 +79648,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -79675,7 +79675,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core13.debug(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -84333,13 +84333,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -85446,9 +85458,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -87462,19 +87475,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core11.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core11.warning(e.message);
+            core11.warning(httpError.message);
           }
           return;
         case 404:
-          core11.warning(e.message);
+          core11.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js
index 0a477553c..b19f1a01f 100644
--- a/lib/start-proxy-action.js
+++ b/lib/start-proxy-action.js
@@ -22065,14 +22065,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -22089,7 +22089,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -22116,7 +22116,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core12.debug(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -94794,13 +94794,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function getCachedCodeQlVersion() {
@@ -95704,19 +95716,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core10.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core10.warning(e.message);
+            core10.warning(httpError.message);
           }
           return;
         case 404:
-          core10.warning(e.message);
+          core10.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
diff --git a/lib/upload-lib.js b/lib/upload-lib.js
index 4d0558ff3..caf6397e7 100644
--- a/lib/upload-lib.js
+++ b/lib/upload-lib.js
@@ -80921,14 +80921,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -80945,7 +80945,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url2, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -80972,7 +80972,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url2, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core12.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -88328,13 +88328,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -88747,14 +88759,19 @@ function computeAutomationID(analysis_key, environment) {
   return automationID;
 }
 function wrapApiConfigurationError(e) {
-  if (isHTTPError(e)) {
-    if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
-      return new ConfigurationError(e.message);
-    } else if (e.message.includes("Bad credentials") || e.message.includes("Not Found")) {
+  const httpError = asHTTPError(e);
+  if (httpError !== void 0) {
+    if (httpError.message.includes("API rate limit exceeded") || httpError.message.includes("commit not found") || httpError.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(httpError.message)) {
+      return new ConfigurationError(httpError.message);
+    }
+    if (httpError.message.includes("Bad credentials") || httpError.message.includes("Not Found")) {
       return new ConfigurationError(
         "Please check that your token is valid and has the required permissions: contents: read, security-events: write"
       );
     }
+    if (httpError.status === 429) {
+      return new ConfigurationError("API rate limit exceeded");
+    }
   }
   return e;
 }
@@ -92520,16 +92537,17 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) {
     logger.info("Successfully uploaded results");
     return response.data.id;
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
-          core11.warning(e.message || GENERIC_403_MSG);
+          core11.warning(httpError.message || GENERIC_403_MSG);
           break;
         case 404:
-          core11.warning(e.message || GENERIC_404_MSG);
+          core11.warning(httpError.message || GENERIC_404_MSG);
           break;
         default:
-          core11.warning(e.message);
+          core11.warning(httpError.message);
           break;
       }
     }
diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js
index ceab6dc09..0adafa0e4 100644
--- a/lib/upload-sarif-action.js
+++ b/lib/upload-sarif-action.js
@@ -80921,14 +80921,14 @@ var require_tool_cache = __commonJS({
     var assert_1 = require("assert");
     var exec_1 = require_exec();
     var retry_helper_1 = require_retry_helper();
-    var HTTPError = class extends Error {
+    var HTTPError2 = class extends Error {
       constructor(httpStatusCode) {
         super(`Unexpected HTTP response: ${httpStatusCode}`);
         this.httpStatusCode = httpStatusCode;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
-    exports2.HTTPError = HTTPError;
+    exports2.HTTPError = HTTPError2;
     var IS_WINDOWS = process.platform === "win32";
     var IS_MAC = process.platform === "darwin";
     var userAgent = "actions/tool-cache";
@@ -80945,7 +80945,7 @@ var require_tool_cache = __commonJS({
         return yield retryHelper.execute(() => __awaiter4(this, void 0, void 0, function* () {
           return yield downloadToolAttempt(url2, dest || "", auth, headers);
         }), (err) => {
-          if (err instanceof HTTPError && err.httpStatusCode) {
+          if (err instanceof HTTPError2 && err.httpStatusCode) {
             if (err.httpStatusCode < 500 && err.httpStatusCode !== 408 && err.httpStatusCode !== 429) {
               return false;
             }
@@ -80972,7 +80972,7 @@ var require_tool_cache = __commonJS({
         }
         const response = yield http.get(url2, headers);
         if (response.message.statusCode !== 200) {
-          const err = new HTTPError(response.message.statusCode);
+          const err = new HTTPError2(response.message.statusCode);
           core14.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
@@ -88444,13 +88444,25 @@ function getRequiredEnvParam(paramName) {
   }
   return value;
 }
+var HTTPError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
 var ConfigurationError = class extends Error {
   constructor(message) {
     super(message);
   }
 };
-function isHTTPError(arg) {
-  return arg?.status !== void 0 && Number.isInteger(arg.status);
+function asHTTPError(arg) {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status);
+  }
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode);
+  }
+  return void 0;
 }
 var cachedCodeQlVersion = void 0;
 function cacheCodeQlVersion(version) {
@@ -88958,14 +88970,19 @@ function computeAutomationID(analysis_key, environment) {
   return automationID;
 }
 function wrapApiConfigurationError(e) {
-  if (isHTTPError(e)) {
-    if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
-      return new ConfigurationError(e.message);
-    } else if (e.message.includes("Bad credentials") || e.message.includes("Not Found")) {
+  const httpError = asHTTPError(e);
+  if (httpError !== void 0) {
+    if (httpError.message.includes("API rate limit exceeded") || httpError.message.includes("commit not found") || httpError.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(httpError.message)) {
+      return new ConfigurationError(httpError.message);
+    }
+    if (httpError.message.includes("Bad credentials") || httpError.message.includes("Not Found")) {
       return new ConfigurationError(
         "Please check that your token is valid and has the required permissions: contents: read, security-events: write"
       );
     }
+    if (httpError.status === 429) {
+      return new ConfigurationError("API rate limit exceeded");
+    }
   }
   return e;
 }
@@ -89698,9 +89715,10 @@ var GitHubFeatureFlags = class {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (isHTTPError(e) && e.status === 403) {
+      const httpError = asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
-          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`
+          `This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
@@ -89972,19 +89990,20 @@ async function sendStatusReport(statusReport) {
       }
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
           if (getWorkflowEventName() === "push" && process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
             core9.warning(
               `Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See ${"https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push" /* SCANNING_ON_PUSH */} for more information on how to configure these events.`
             );
           } else {
-            core9.warning(e.message);
+            core9.warning(httpError.message);
           }
           return;
         case 404:
-          core9.warning(e.message);
+          core9.warning(httpError.message);
           return;
         case 422:
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
@@ -93191,16 +93210,17 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) {
     logger.info("Successfully uploaded results");
     return response.data.id;
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== void 0) {
+      switch (httpError.status) {
         case 403:
-          core12.warning(e.message || GENERIC_403_MSG);
+          core12.warning(httpError.message || GENERIC_403_MSG);
           break;
         case 404:
-          core12.warning(e.message || GENERIC_404_MSG);
+          core12.warning(httpError.message || GENERIC_404_MSG);
           break;
         default:
-          core12.warning(e.message);
+          core12.warning(httpError.message);
           break;
       }
     }
diff --git a/src/api-client.ts b/src/api-client.ts
index 153712c7f..db66cd8ab 100644
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -7,12 +7,12 @@ import { getActionVersion, getRequiredInput } from "./actions-util";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import {
+  asHTTPError,
   ConfigurationError,
   getRequiredEnvParam,
   GITHUB_DOTCOM_URL,
   GitHubVariant,
   GitHubVersion,
-  isHTTPError,
   parseGitHubUrl,
   parseMatrixInput,
 } from "./util";
@@ -280,22 +280,27 @@ export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
 }
 
 export function wrapApiConfigurationError(e: unknown) {
-  if (isHTTPError(e)) {
+  const httpError = asHTTPError(e);
+  if (httpError !== undefined) {
     if (
-      e.message.includes("API rate limit exceeded for installation") ||
-      e.message.includes("commit not found") ||
-      e.message.includes("Resource not accessible by integration") ||
-      /ref .* not found in this repository/.test(e.message)
+      httpError.message.includes("API rate limit exceeded") ||
+      httpError.message.includes("commit not found") ||
+      httpError.message.includes("Resource not accessible by integration") ||
+      /ref .* not found in this repository/.test(httpError.message)
     ) {
-      return new ConfigurationError(e.message);
-    } else if (
-      e.message.includes("Bad credentials") ||
-      e.message.includes("Not Found")
+      return new ConfigurationError(httpError.message);
+    }
+    if (
+      httpError.message.includes("Bad credentials") ||
+      httpError.message.includes("Not Found")
     ) {
       return new ConfigurationError(
         "Please check that your token is valid and has the required permissions: contents: read, security-events: write",
       );
     }
+    if (httpError.status === 429) {
+      return new ConfigurationError("API rate limit exceeded");
+    }
   }
   return e;
 }
diff --git a/src/feature-flags.ts b/src/feature-flags.ts
index 3a548ffa1..d9994b7e9 100644
--- a/src/feature-flags.ts
+++ b/src/feature-flags.ts
@@ -651,12 +651,13 @@ class GitHubFeatureFlags {
       this.hasAccessedRemoteFeatureFlags = true;
       return remoteFlags;
     } catch (e) {
-      if (util.isHTTPError(e) && e.status === 403) {
+      const httpError = util.asHTTPError(e);
+      if (httpError?.status === 403) {
         this.logger.warning(
           "This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. " +
             "As a result, it will not be opted into any experimental features. " +
             "This could be because the Action is running on a pull request from a fork. If not, " +
-            `please ensure the Action has the 'security-events: write' permission. Details: ${e.message}`,
+            `please ensure the Action has the 'security-events: write' permission. Details: ${httpError.message}`,
         );
         this.hasAccessedRemoteFeatureFlags = false;
         return {};
diff --git a/src/status-report.ts b/src/status-report.ts
index e3f442d61..b1f1acc71 100644
--- a/src/status-report.ts
+++ b/src/status-report.ts
@@ -23,7 +23,6 @@ import { getRepositoryNwo } from "./repository";
 import { ToolsSource } from "./setup-codeql";
 import {
   ConfigurationError,
-  isHTTPError,
   getRequiredEnvParam,
   getCachedCodeQlVersion,
   isInTestMode,
@@ -33,6 +32,7 @@ import {
   BuildMode,
   getErrorMessage,
   getTestingEnvironment,
+  asHTTPError,
 } from "./util";
 
 export enum ActionName {
@@ -429,8 +429,9 @@ export async function sendStatusReport<S extends StatusReportBase>(
       },
     );
   } catch (e) {
-    if (isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = asHTTPError(e);
+    if (httpError !== undefined) {
+      switch (httpError.status) {
         case 403:
           if (
             getWorkflowEventName() === "push" &&
@@ -443,11 +444,11 @@ export async function sendStatusReport<S extends StatusReportBase>(
                 `See ${DocUrl.SCANNING_ON_PUSH} for more information on how to configure these events.`,
             );
           } else {
-            core.warning(e.message);
+            core.warning(httpError.message);
           }
           return;
         case 404:
-          core.warning(e.message);
+          core.warning(httpError.message);
           return;
         case 422:
           // schema incompatibility when reporting status
diff --git a/src/trap-caching.ts b/src/trap-caching.ts
index 13b0450f1..a1eb49a56 100644
--- a/src/trap-caching.ts
+++ b/src/trap-caching.ts
@@ -13,8 +13,8 @@ import * as gitUtils from "./git-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 import {
+  asHTTPError,
   getErrorMessage,
-  isHTTPError,
   tryGetFolderBytes,
   waitForResultWithTimeLimit,
 } from "./util";
@@ -236,7 +236,7 @@ export async function cleanupTrapCaches(
     }
     return { trap_cache_cleanup_size_bytes: totalBytesCleanedUp };
   } catch (e) {
-    if (isHTTPError(e) && e.status === 403) {
+    if (asHTTPError(e)?.status === 403) {
       logger.warning(
         "Could not cleanup TRAP caches as the token did not have the required permissions. " +
           'To clean up TRAP caches, ensure the token has the "actions:write" permission. ' +
diff --git a/src/upload-lib.ts b/src/upload-lib.ts
index 26ae88f32..b765cd397 100644
--- a/src/upload-lib.ts
+++ b/src/upload-lib.ts
@@ -386,16 +386,17 @@ export async function uploadPayload(
     logger.info("Successfully uploaded results");
     return response.data.id as string;
   } catch (e) {
-    if (util.isHTTPError(e)) {
-      switch (e.status) {
+    const httpError = util.asHTTPError(e);
+    if (httpError !== undefined) {
+      switch (httpError.status) {
         case 403:
-          core.warning(e.message || GENERIC_403_MSG);
+          core.warning(httpError.message || GENERIC_403_MSG);
           break;
         case 404:
-          core.warning(e.message || GENERIC_404_MSG);
+          core.warning(httpError.message || GENERIC_404_MSG);
           break;
         default:
-          core.warning(e.message);
+          core.warning(httpError.message);
           break;
       }
     }
diff --git a/src/util.ts b/src/util.ts
index e1f7a15ec..09169c535 100644
--- a/src/util.ts
+++ b/src/util.ts
@@ -692,8 +692,15 @@ export class ConfigurationError extends Error {
   }
 }
 
-export function isHTTPError(arg: any): arg is HTTPError {
-  return arg?.status !== undefined && Number.isInteger(arg.status);
+export function asHTTPError(arg: any): HTTPError | undefined {
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message as string, arg.status as number);
+  }
+  // See https://github.com/actions/toolkit/blob/acb230b99a46ed33a3f04a758cd68b47b9a82908/packages/tool-cache/src/tool-cache.ts#L19
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message as string, arg.httpStatusCode as number);
+  }
+  return undefined;
 }
 
 let cachedCodeQlVersion: undefined | VersionInfo = undefined;