{"record":{"id":"d104745fa2d57349","repo":"can1357/oh-my-pi","slug":"gh-proxy-github-token-not-configured","errorCode":null,"errorMessage":"gh-proxy: GITHUB_TOKEN not configured","messagePattern":"gh-proxy: GITHUB_TOKEN not configured","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"critical","filePath":"python/robomp/src/proxy/server.py","lineNumber":225,"sourceCode":"\n\ndef _pool_dir(cfg: Settings, repo: str) -> Path:\n    _validate_repo_name(repo)\n    return Path(cfg.workspace_root) / \"_pool\" / repo.replace(\"/\", \"__\")\n\n\ndef _workspace_repo_dir(cfg: Settings, workspace_key: str) -> Path:\n    # Defense-in-depth: workspace_key is constructed by `sandbox.workspace_key`\n    # as `<repo_with_underscores>__<number>`. Reject anything outside that shape.\n    if \"/\" in workspace_key or workspace_key.startswith(\".\") or \"..\" in workspace_key:\n        raise HTTPException(400, f\"invalid workspace_key {workspace_key!r}\")\n    return Path(cfg.workspace_root) / workspace_key / \"repo\"\n\n\ndef _resolve_token(cfg: Settings) -> str:\n    if cfg.github_token is None:\n        # Will already have been caught at startup, but stay defensive.\n        raise HTTPException(500, \"gh-proxy: GITHUB_TOKEN not configured\")\n    return cfg.github_token.get_secret_value()\n\n\ndef _resolve_hmac_key(cfg: Settings) -> bytes:\n    if cfg.gh_proxy_hmac_key is None:\n        raise HTTPException(500, \"gh-proxy: ROBOMP_GH_PROXY_HMAC_KEY not configured\")\n    return cfg.gh_proxy_hmac_key.get_secret_value().encode(\"utf-8\")\n\n\n_ORIGIN_READ_TIMEOUT_SECONDS = 5.0\n\n\n_REMOTE_HELPER_RE = re.compile(r\"^[A-Za-z][A-Za-z0-9+.-]*::\")\n_FORBIDDEN_URL_BYTES_RE = re.compile(r\"[\\x00-\\x1f\\x7f]|%(?:00|0a|0d)\", re.IGNORECASE)\n_GITHUB_REPO_RE = re.compile(r\"^[A-Za-z0-9][A-Za-z0-9-]{0,38}/[A-Za-z0-9._-]+$\")\n_GIT_PROBE_SCRUBBED_ENV_KEYS = (\n    \"ROBOMP_GIT_HTTP_AUTH\",\n    \"GITHUB_TOKEN\",","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/python/robomp/src/proxy/server.py#L207-L243","documentation":"The proxy requires a GitHub token (Settings.github_token, from GITHUB_TOKEN) to authenticate git operations. `_resolve_token` raises this HTTP 500 defensively when the token is missing at request time, even though startup validation should have caught it.","triggerScenarios":"Calling any of the git endpoints (clone, fetch, fetch_ref, fetch_pr_head, push) while the service was started without the GITHUB_TOKEN environment variable/settings field populated.","commonSituations":"Deployments missing the env var in the compose/k8s manifest; secrets mount failed so the settings loader saw None; running the proxy locally without a .env file; token deliberately unset for public-repo-only use, which this proxy does not support.","solutions":["Set the GITHUB_TOKEN environment variable (a PAT with repo access) and restart the proxy.","Verify the settings/secret file the loader reads actually contains github_token (e.g. ROBOMP secrets file or .env).","Check service logs/startup health — if startup validation passed, confirm the right Settings profile is loaded in this environment.","Use a fine-grained or classic PAT; ensure it is not empty/whitespace, which may parse to None upstream."],"exampleFix":"// before\n$ robomp-proxy  # GITHUB_TOKEN unset\n// after\n$ GITHUB_TOKEN=ghp_xxx robomp-proxy  # or export in the deployment manifest","handlingStrategy":"fallback","validationCode":"import os\ntoken = os.environ.get(\"GITHUB_TOKEN\")\nif not token:\n    raise RuntimeError(\"GITHUB_TOKEN must be set before starting gh-proxy\")","typeGuard":"def has_github_token(cfg: object) -> TypeGuard[object]:\n    return getattr(cfg, \"github_token\", None) is not None","tryCatchPattern":"try:\n    resp = http.post(f\"{base}/git/clone\", json=payload)\n    resp.raise_for_status()\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 500 and \"GITHUB_TOKEN not configured\" in e.response.text:\n        raise RuntimeError(\"gh-proxy is missing GITHUB_TOKEN; set it in the server env and restart\") from e\n    raise","preventionTips":["Add a startup readiness check that fails fast when GITHUB_TOKEN is unset","Keep the token in the deployment manifest/secrets manager, not just local shells","Document required env vars next to the run command","Distinguish proxy-side 500s (server config) from client-side 400s (payload) when triaging"],"tags":["http-500","configuration","github-token","server-error"],"backgroundTag":"missing-env-var","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}