{"record":{"id":"b5cf591905747c0e","repo":"coleam00/Archon","slug":"github-pat-mode-misconfigured-github-token-and-we","errorCode":null,"errorMessage":"GitHub PAT mode misconfigured: GITHUB_TOKEN and WEBHOOK_SECRET required","messagePattern":"GitHub PAT mode misconfigured: GITHUB_TOKEN and WEBHOOK_SECRET required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"packages/server/src/index.ts","lineNumber":478,"sourceCode":"      // Per-user comment attribution: when enabled, let the adapter author PR/\n      // issue comments under the originating user's GitHub identity. Resolver\n      // returns undefined for unconnected users → bot identity fallback.\n      const getUserToken = isPerUserGitHubEnabled()\n        ? async (userId: string): Promise<string | undefined> =>\n            (await getDecryptedAccessToken(userId)) ?? undefined\n        : undefined;\n      github = new GitHubAdapter(auth, webhookSecret, lockManager, botMention, { getUserToken });\n      await github.start();\n      activePlatforms.push('GitHub (App)');\n      getLog().info(\n        { slug: githubAppAuthProvider.slug, defaultInstallationId },\n        'github.adapter_mode_app'\n      );\n    } else if (ghAuthMode.kind === 'pat') {\n      const patToken = process.env.GITHUB_TOKEN;\n      const webhookSecret = process.env.WEBHOOK_SECRET;\n      if (!patToken || !webhookSecret) {\n        throw new Error('GitHub PAT mode misconfigured: GITHUB_TOKEN and WEBHOOK_SECRET required');\n      }\n      const botMention =\n        process.env.GITHUB_BOT_MENTION || process.env.BOT_DISPLAY_NAME || config.botName;\n      const auth: GitHubAuth = { kind: 'pat', token: patToken };\n      github = new GitHubAdapter(auth, webhookSecret, lockManager, botMention);\n      await github.start();\n      activePlatforms.push('GitHub');\n      getLog().info('github.adapter_mode_pat');\n    } else {\n      getLog().info('github_adapter_skipped');\n    }\n\n    // Initialize Gitea adapter (conditional)\n    if (process.env.GITEA_URL && process.env.GITEA_TOKEN && process.env.GITEA_WEBHOOK_SECRET) {\n      const giteaBotMention =\n        process.env.GITEA_BOT_MENTION || process.env.BOT_DISPLAY_NAME || config.botName;\n      gitea = new GiteaAdapter(\n        process.env.GITEA_URL,","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/server/src/index.ts#L460-L496","documentation":"In GitHub PAT mode, startServer requires both GITHUB_TOKEN and WEBHOOK_SECRET before constructing and starting the GitHubAdapter; if either is missing it throws. As with App mode, the mode selector should have guaranteed the token, so this guards against empty values and ensures webhook signature verification is always configured in PAT mode.","triggerScenarios":"selectGitHubAuthMode() returned kind === 'pat' but process.env.GITHUB_TOKEN or process.env.WEBHOOK_SECRET is empty/undefined inside the pat branch of startServer.","commonSituations":"GITHUB_TOKEN set but GITEA/GitLab-style secret names used instead of WEBHOOK_SECRET; token defined as empty after a failed sed/rotation; webhook secret dropped while porting a PAT setup between hosts; mixing up the repo webhook secret with the GitHub App webhook secret.","solutions":["Set GITHUB_TOKEN (a valid PAT with required scopes) and WEBHOOK_SECRET (matching the secret configured on the GitHub repo/app webhook) and restart.","Confirm the same WEBHOOK_SECRET value is configured on the GitHub webhook side, or signature verification will fail later.","Check .env and the process environment for empty definitions (`GITHUB_TOKEN=`) and correct them.","If App mode was intended instead, remove GITHUB_TOKEN and provide the App-mode variables."],"exampleFix":"# before\nGITHUB_TOKEN=ghp_xxx\n# after: add the webhook secret\nGITHUB_TOKEN=ghp_xxx\nWEBHOOK_SECRET=whsec_xxx","handlingStrategy":"validation","validationCode":"for (const k of ['GITHUB_TOKEN', 'WEBHOOK_SECRET']) {\n  const v = process.env[k];\n  if (!v || v.trim() === '') throw new Error(`${k} must be set for GitHub PAT mode`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await startServer(config);\n} catch (e) {\n  if (/GitHub PAT mode misconfigured/i.test(e?.message ?? '')) {\n    logFatal('Set GITHUB_TOKEN and WEBHOOK_SECRET (PAT mode) in the server environment.');\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Set WEBHOOK_SECRET alongside GITHUB_TOKEN from day one — the token alone is insufficient.","Keep the same secret value configured on the GitHub repo webhook.","Validate env completeness in CI or a pre-start script.","Watch for empty-string definitions when templating .env files."],"tags":["configuration","github","pat","env","startup"],"backgroundTag":"missing-env-var","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}