can1357/oh-my-pi · critical · HTTPException

gh-proxy: GITHUB_TOKEN not configured

Error message

gh-proxy: GITHUB_TOKEN not configured

What it means

The proxy requires a GitHub token (Settings.github_token, from GITHUB_TOKEN) to authenticate git operations. `_resolve_token` raises this HTTP 500 defensively when the token is missing at request time, even though startup validation should have caught it.

Source

Thrown at python/robomp/src/proxy/server.py:225

def _pool_dir(cfg: Settings, repo: str) -> Path:
    _validate_repo_name(repo)
    return Path(cfg.workspace_root) / "_pool" / repo.replace("/", "__")


def _workspace_repo_dir(cfg: Settings, workspace_key: str) -> Path:
    # Defense-in-depth: workspace_key is constructed by `sandbox.workspace_key`
    # as `<repo_with_underscores>__<number>`. Reject anything outside that shape.
    if "/" in workspace_key or workspace_key.startswith(".") or ".." in workspace_key:
        raise HTTPException(400, f"invalid workspace_key {workspace_key!r}")
    return Path(cfg.workspace_root) / workspace_key / "repo"


def _resolve_token(cfg: Settings) -> str:
    if cfg.github_token is None:
        # Will already have been caught at startup, but stay defensive.
        raise HTTPException(500, "gh-proxy: GITHUB_TOKEN not configured")
    return cfg.github_token.get_secret_value()


def _resolve_hmac_key(cfg: Settings) -> bytes:
    if cfg.gh_proxy_hmac_key is None:
        raise HTTPException(500, "gh-proxy: ROBOMP_GH_PROXY_HMAC_KEY not configured")
    return cfg.gh_proxy_hmac_key.get_secret_value().encode("utf-8")


_ORIGIN_READ_TIMEOUT_SECONDS = 5.0


_REMOTE_HELPER_RE = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*::")
_FORBIDDEN_URL_BYTES_RE = re.compile(r"[\x00-\x1f\x7f]|%(?:00|0a|0d)", re.IGNORECASE)
_GITHUB_REPO_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9-]{0,38}/[A-Za-z0-9._-]+$")
_GIT_PROBE_SCRUBBED_ENV_KEYS = (
    "ROBOMP_GIT_HTTP_AUTH",
    "GITHUB_TOKEN",

View on GitHub (pinned to 9690622007)

Solutions

1. Set the GITHUB_TOKEN environment variable (a PAT with repo access) and restart the proxy.
2. Verify the settings/secret file the loader reads actually contains github_token (e.g. ROBOMP secrets file or .env).
3. Check service logs/startup health — if startup validation passed, confirm the right Settings profile is loaded in this environment.
4. Use a fine-grained or classic PAT; ensure it is not empty/whitespace, which may parse to None upstream.

Example fix

// before
$ robomp-proxy  # GITHUB_TOKEN unset
// after
$ GITHUB_TOKEN=ghp_xxx robomp-proxy  # or export in the deployment manifest

import os
token = os.environ.get("GITHUB_TOKEN")
if not token:
    raise RuntimeError("GITHUB_TOKEN must be set before starting gh-proxy")

def has_github_token(cfg: object) -> TypeGuard[object]:
    return getattr(cfg, "github_token", None) is not None

try:
    resp = http.post(f"{base}/git/clone", json=payload)
    resp.raise_for_status()
except httpx.HTTPStatusError as e:
    if e.response.status_code == 500 and "GITHUB_TOKEN not configured" in e.response.text:
        raise RuntimeError("gh-proxy is missing GITHUB_TOKEN; set it in the server env and restart") from e
    raise

When it happens

Trigger: Calling any of the git endpoints (clone, fetch, fetch_ref, fetch_pr_head, push) while the service was started without the GITHUB_TOKEN environment variable/settings field populated.

Common situations: Deployments missing the env var in the compose/k8s manifest; secrets mount failed so the settings loader saw None; running the proxy locally without a .env file; token deliberately unset for public-repo-only use, which this proxy does not support.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• gh-proxy: ROBOMP_GH_PROXY_HMAC_KEY not configured
• No model configured
• Azure OpenAI base URL is required. Set AZURE_OPENAI_BASE_URL
• formatCompactionV2Failure(event, type)
• Cannot register custom API "${api}": built-in API names are

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/d104745fa2d57349. Report an issue: GitHub.