{"record":{"id":"b68f8926ace77b64","repo":"nikivdev/code","slug":"gh-secret-set-failed","errorCode":null,"errorMessage":"`gh secret set {}` failed","messagePattern":"`gh secret set (.+?)` failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/release_signing.rs","lineNumber":254,"sourceCode":"    // Avoid passing secrets via argv (ps); `gh secret set` reads from stdin when --body is omitted.\n\n    let mut child = cmd\n        .stdin(Stdio::piped())\n        .stdout(Stdio::null())\n        .spawn()\n        .with_context(|| format!(\"failed to spawn `gh secret set {}`\", name))?;\n\n    {\n        let stdin = child\n            .stdin\n            .as_mut()\n            .context(\"failed to open stdin for gh\")?;\n        stdin.write_all(value.as_bytes())?;\n    }\n\n    let status = child.wait()?;\n    if !status.success() {\n        bail!(\"`gh secret set {}` failed\", name);\n    }\n    Ok(())\n}\n","sourceCodeStart":236,"sourceCodeEnd":258,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/release_signing.rs#L236-L258","documentation":"gh_secret_set invokes `gh secret set <name>` (optionally piping the secret value via stdin) and bails if the child process exits non-zero. This means GitHub CLI failed to create/update the named Actions secret in the target repo.","triggerScenarios":"`gh secret set` exits non-zero while `f release signing sync` pushes signing keys to GitHub secrets.","commonSituations":"Not authenticated or token lacks repo admin scope (`gh auth login` missing / expired); wrong --repo value or repo not found; pushing to an org repo without secrets permission; network/API failure.","solutions":["Run `gh auth status` and `gh auth login` / refresh token with admin:repo (repo scope)","Set the repo explicitly: `f release signing sync --repo owner/repo` or check the detected repo","Run `gh secret set NAME -R owner/repo` manually to see the real error","Verify you have admin access to the repository"],"exampleFix":"// before (unauthenticated)\nf release signing sync\n// after\ngh auth login\nf release signing sync","handlingStrategy":"try-catch","validationCode":"// preflight: auth and repo admin access\ngh auth status || gh auth login\ngh repo view --json viewerPermission  # expect ADMIN or MAINTAIN","typeGuard":null,"tryCatchPattern":"try {\n  run([\"f\", \"release\", \"signing\", \"sync\", \"--repo\", \"owner/repo\"]);\n} catch (e) {\n  if (/gh secret set \\S+ failed/.test(String(e))) {\n    console.error(\"Check `gh auth status`, repo permissions, and pass the correct --repo.\");\n  } else throw e;\n}","preventionTips":["Run `gh auth login` and keep the token fresh with repo scope","Always pin the target repo explicitly with --repo to avoid detection mistakes","Confirm admin/maintain permission on the repo before syncing secrets"],"tags":["github","secrets","github-cli","process-exit"],"backgroundTag":"gh-secret-set-failed","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}