{"record":{"id":"402bfcdf609521c0","repo":"coleam00/Archon","slug":"provided-value-is-not-a-valid-pem-encoded-private","errorCode":null,"errorMessage":"Provided value is not a valid PEM-encoded private key (missing BEGIN/END markers).","messagePattern":"Provided value is not a valid PEM-encoded private key \\(missing BEGIN/END markers\\)\\.","errorType":"validation","errorClass":"AppPrivateKeyError","httpStatus":null,"severity":"error","filePath":"packages/core/src/github-auth/private-key.ts","lineNumber":54,"sourceCode":"      assertLooksLikePem(contents);\n      return contents;\n    } catch (err) {\n      if (err instanceof AppPrivateKeyError) throw err;\n      throw new AppPrivateKeyError(\n        `Failed to read GITHUB_APP_PRIVATE_KEY_PATH (${path}): ${(err as Error).message}`,\n        err\n      );\n    }\n  }\n  throw new AppPrivateKeyError(\n    'GITHUB_APP_ID is set but no private key was provided. ' +\n      'Set GITHUB_APP_PRIVATE_KEY (inline PEM) or GITHUB_APP_PRIVATE_KEY_PATH (path to .pem).'\n  );\n}\n\nfunction assertLooksLikePem(s: string): void {\n  if (!s.includes('BEGIN') || !s.includes('PRIVATE KEY') || !s.includes('END')) {\n    throw new AppPrivateKeyError(\n      'Provided value is not a valid PEM-encoded private key (missing BEGIN/END markers).'\n    );\n  }\n}\n","sourceCodeStart":36,"sourceCodeEnd":59,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/core/src/github-auth/private-key.ts#L36-L59","documentation":"assertLooksLikePem performs a cheap sanity check that the provided key text contains BEGIN, PRIVATE KEY, and END markers before it is used. Values failing the check raise AppPrivateKeyError, catching corrupted or wrongly-copied keys early.","triggerScenarios":"GITHUB_APP_PRIVATE_KEY contains a public key, a base64 blob without PEM armor, an escaped/mangled PEM (newlines lost), or the file at GITHUB_APP_PRIVATE_KEY_PATH does not contain a private key.","commonSituations":"Copying the .pub public key instead of the private key; single-line env var where newlines were collapsed; downloading the wrong key format; secret manager stripping newlines.","solutions":["Download the private key (.pem) from the GitHub App settings page and use that file","Ensure newlines survive: use GITHUB_APP_PRIVATE_KEY_PATH instead of inlining, or keep \\n escapes intact","Confirm the file contains '-----BEGIN RSA PRIVATE KEY-----' or '-----BEGIN PRIVATE KEY-----'","Regenerate/convert the key with openssl if it is in another format"],"exampleFix":"// before\nGITHUB_APP_PRIVATE_KEY=MIIEvQIBADANBg...\n// after\nGITHUB_APP_PRIVATE_KEY=\"-----BEGIN RSA PRIVATE KEY-----\\nMIIEvQ...\\n-----END RSA PRIVATE KEY-----\"","handlingStrategy":"validation","validationCode":"const pem = process.env.GITHUB_APP_PRIVATE_KEY;\nif (pem && !(pem.includes('BEGIN') && pem.includes('PRIVATE KEY') && pem.includes('END'))) {\n  throw new Error('GITHUB_APP_PRIVATE_KEY does not look like a PEM private key');\n}","typeGuard":null,"tryCatchPattern":"try { const key = await loadAppPrivateKey(env); } catch (e) { if (e instanceof AppPrivateKeyError && e.message.includes('PEM')) console.error('Key file is not a PEM private key; re-download the .pem from GitHub App settings'); throw e; }","preventionTips":["Reference the .pem file by path instead of pasting contents into env vars","Never use the public .pub key in place of the private key","Ensure secret managers preserve newlines in PEM values"],"tags":["configuration","pem","github-app","validation"],"backgroundTag":"invalid-pem-key","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}