{"record":{"id":"c532cb87f6f28a71","repo":"jdx/mise","slug":"repository-scope-requires-github-relay-read-only","errorCode":null,"errorMessage":"repository scope requires --github-relay-read-only","messagePattern":"repository scope requires --github-relay-read-only","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/github_relay.rs","lineNumber":24,"sourceCode":"#[derive(Clone, Debug, Default)]\npub(crate) struct Scope {\n    #[cfg(unix)]\n    options: Options,\n    #[cfg(any(unix, test))]\n    repositories: std::collections::BTreeSet<String>,\n    #[cfg(any(unix, test))]\n    all: bool,\n}\n\nimpl Scope {\n    pub(crate) fn from_flags(\n        enabled: bool,\n        repositories: &[String],\n        all: bool,\n    ) -> Result<Option<Self>> {\n        if !enabled {\n            if all || !repositories.is_empty() {\n                bail!(\"repository scope requires --github-relay-read-only\");\n            }\n            return Ok(None);\n        }\n        if all != repositories.is_empty() {\n            bail!(\"choose --github-relay-repo OWNER/REPO or --github-relay-all-repos, not both\");\n        }\n        let repositories: std::collections::BTreeSet<String> = repositories\n            .iter()\n            .map(|repo| repository(repo))\n            .collect::<Result<_>>()?;\n        #[cfg(not(any(unix, test)))]\n        let _ = repositories;\n        Ok(Some(Self {\n            #[cfg(unix)]\n            options: Options::default(),\n            #[cfg(any(unix, test))]\n            repositories,\n            #[cfg(any(unix, test))]","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/github_relay.rs#L6-L42","documentation":"GitHubRelay::from_flags validates that repository scoping options are only meaningful when the relay is enabled. When --github-relay-read-only is not enabled but --github-relay-all-repos or --github-relay-repo was passed, mise rejects the combination rather than silently ignoring the repo flags.","triggerScenarios":"Calling from_flags with enabled=false while `all` is true or `repositories` is non-empty — i.e. CLI invocation like `mise --github-relay-repo owner/repo <cmd>` without `--github-relay-read-only`.","commonSituations":"Copy-pasting an older command line that used repo flags before the enable flag was introduced; assuming repo flags imply the relay is on; scripted aliases that dropped the enable flag.","solutions":["Add `--github-relay-read-only` to the command line to enable the relay.","If you don't want the relay, remove the --github-relay-repo / --github-relay-all-repos flags.","Set the relay enabled setting in mise.toml instead if you want it always on, then drop the CLI flag conflict."],"exampleFix":"// before\nmise --github-relay-repo owner/repo exec -- node build.js\n// after\nmise --github-relay-read-only --github-relay-repo owner/repo exec -- node build.js","handlingStrategy":"validation","validationCode":"# shell: fail fast before invoking mise\nif [[ -n \"$RELAY_REPOS\" || -n \"$RELAY_ALL\" ]] && ! $RELAY_ENABLED; then\n  echo \"add --github-relay-read-only or drop repo flags\" >&2; exit 1\nfi","typeGuard":"fn relay_flags_consistent(enabled: bool, repos: &[String], all: bool) -> bool {\n    !enabled == !(all || !repos.is_empty())\n}","tryCatchPattern":"match Scope::from_flags(enabled, repos, all) {\n    Err(e) if e.to_string().contains(\"requires --github-relay-read-only\") => {\n        // retry with the enable flag added\n    }\n    r => r,\n}","preventionTips":["Always pair repo/all scope flags with --github-relay-read-only.","Keep relay flags in one wrapper script so the enable flag is never dropped.","Prefer configuring [github_relay] in mise.toml over ad-hoc CLI flags."],"tags":["cli","github-relay","flags","configuration"],"backgroundTag":"missing-required-flag","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}