{"record":{"id":"0d2ac8da237b32ac","repo":"golang-migrate/migrate","slug":"no-access-token","errorCode":null,"errorMessage":"no access token","messagePattern":"no access token","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"source/github/github.go","lineNumber":25,"sourceCode":"\t\"net/http\"\n\tnurl \"net/url\"\n\t\"os\"\n\t\"path\"\n\t\"strings\"\n\n\t\"golang.org/x/oauth2\"\n\n\t\"github.com/golang-migrate/migrate/v4/source\"\n\t\"github.com/google/go-github/v39/github\"\n)\n\nfunc init() {\n\tsource.Register(\"github\", &Github{})\n}\n\nvar (\n\tErrNoUserInfo          = fmt.Errorf(\"no username:token provided\")\n\tErrNoAccessToken       = fmt.Errorf(\"no access token\")\n\tErrInvalidRepo         = fmt.Errorf(\"invalid repo\")\n\tErrInvalidGithubClient = fmt.Errorf(\"expected *github.Client\")\n\tErrNoDir               = fmt.Errorf(\"no directory\")\n)\n\ntype Github struct {\n\tconfig     *Config\n\tclient     *github.Client\n\toptions    *github.RepositoryContentGetOptions\n\tmigrations *source.Migrations\n}\n\ntype Config struct {\n\tOwner string\n\tRepo  string\n\tPath  string\n\tRef   string\n}","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/golang-migrate/migrate/blob/01a9643f1475e75bb6d6224ddeaf9d8e2434ca8a/source/github/github.go#L7-L43","documentation":"github.ErrNoAccessToken is declared in source/github/github.go as the companion credential error for the GitHub driver; it signals that no access token was supplied for authenticated access. The analogous bitbucket driver returns it when the URL userinfo has a username but no password (app password).","triggerScenarios":"In bitbucket: Open('bitbucket://user@bitbucket.org/...') where u.User.Password() fails. In github: declared at source/github/github.go:25 as the token-missing sentinel returned from Open paths lacking a token.","commonSituations":"Env-injected token missing or empty so the URL renders as 'user:@host'; rotating tokens and forgetting to update the DSN; private repos requiring auth while no token was configured.","solutions":["Supply the token/app-password in the URL: scheme://user:token@host/...","Verify the token env var is set and non-empty before building the URL","Use the driver's WithInstance constructor with an authenticated API client instead"],"exampleFix":"// before\nsource.Open(\"bitbucket://myuser@bitbucket.org/workspace/repo/migrations\")\n// after\nsource.Open(\"bitbucket://myuser:app-password@bitbucket.org/workspace/repo/migrations\")","handlingStrategy":"validation","validationCode":"if accessToken == \"\" {\n    return fmt.Errorf(\"access token env var must be set before building source url\")\n}\nsourceURL := fmt.Sprintf(\"bitbucket://user:%s@bitbucket.org/ws/repo/migrations\", accessToken)","typeGuard":"func hasAccessToken(raw string) bool {\n    u, err := url.Parse(raw)\n    if err == nil && u.User != nil {\n        pw, ok := u.User.Password()\n        return ok && pw != \"\"\n    }\n    return true // no userinfo: some drivers allow unauthenticated\n}","tryCatchPattern":"d, err := src.Open(srcURL)\nif err != nil {\n    if errors.Is(err, ErrNoAccessToken) {\n        return fmt.Errorf(\"supply token as password part of source URL\")\n    }\n    return err\n}","preventionTips":["Fail fast at startup when the token env var is empty","Rotate tokens via secret manager with a non-empty check","For private repos, never rely on unauthenticated access"],"tags":["authentication","github","bitbucket","token"],"backgroundTag":"missing-credentials","analyzedSha":"01a9643f1475e75bb6d6224ddeaf9d8e2434ca8a","analyzedAt":"2026-09-02T19:38:29.671Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}