{"record":{"id":"c532cb87f6f28a71","repo":"jdx/mise","slug":"repository-scope-requires-github-relay-read-only","errorCode":null,"errorMessage":"repository scope requires --github-relay-read-only","messagePattern":"repository scope requires --github-relay-read-only","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/github_relay.rs","lineNumber":24,"sourceCode":"#[derive(Clone, Debug, Default)]\npub(crate) struct Scope {\n    #[cfg(unix)]\n    options: Options,\n    #[cfg(any(unix, test))]\n    repositories: std::collections::BTreeSet<String>,\n    #[cfg(any(unix, test))]\n    all: bool,\n}\n\nimpl Scope {\n    pub(crate) fn from_flags(\n        enabled: bool,\n        repositories: &[String],\n        all: bool,\n    ) -> Result<Option<Self>> {\n        if !enabled {\n            if all || !repositories.is_empty() {\n                bail!(\"repository scope requires --github-relay-read-only\");\n            }\n            return Ok(None);\n        }\n        if all != repositories.is_empty() {\n            bail!(\"choose --github-relay-repo OWNER/REPO or --github-relay-all-repos, not both\");\n        }\n        let repositories: std::collections::BTreeSet<String> = repositories\n            .iter()\n            .map(|repo| repository(repo))\n            .collect::<Result<_>>()?;\n        #[cfg(not(any(unix, test)))]\n        let _ = repositories;\n        Ok(Some(Self {\n            #[cfg(unix)]\n            options: Options::default(),\n            #[cfg(any(unix, test))]\n            repositories,\n            #[cfg(any(unix, test))]","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/github_relay.rs#L6-L42","documentation":"GitHubRelay::Scope::from_flags validates the --github-relay-read-only flag combination. If the relay is NOT enabled (enabled=false) but repository scoping flags were supplied (--github-relay-all-repos or --github-relay-repo), it bails: repository scoping is meaningless without enabling read-only relay mode.","triggerScenarios":"Calling from_flags with enabled=false and either all=true or a non-empty repositories list — i.e. the CLI was given --github-relay-repo/--github-relay-all-repos without --github-relay-read-only.","commonSituations":"Copy-pasting relay scope flags from documentation or a teammate's command while forgetting the enabling --github-relay-read-only flag; scripting the relay config and omitting the enable flag.","solutions":["Add --github-relay-read-only to the command line to enable the relay","Or remove the --github-relay-repo / --github-relay-all-repos flags if relay mode is not wanted","Check flag order/naming in scripts; the scoping flags alone do not enable the relay"],"exampleFix":"// before\nmycli --github-relay-repo org/repo\n// after\nmycli --github-relay-read-only --github-relay-repo org/repo","handlingStrategy":"validation","validationCode":"// Validate flags before invoking\nlet relay_flags = [\"--github-relay-repo\", \"--github-relay-all-repos\"];\nif relay_flags.iter().any(|f| args.contains(f)) && !args.contains(&\"--github-relay-read-only\") {\n    panic!(\"add --github-relay-read-only when scoping relay repositories\");\n}","typeGuard":null,"tryCatchPattern":"match err {\n    RelayConfigError::MissingEnableFlag => eprintln!(\"relay scope flags require --github-relay-read-only\"),\n    e => return Err(e),\n}","preventionTips":["Always pair repository scoping flags with --github-relay-read-only","Keep canonical command lines in scripts/docs with both flags together","Add a shell alias or wrapper that injects the enabling flag"],"tags":["cli","github-relay","flags","configuration"],"backgroundTag":"missing-required-flag","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}