can1357/oh-my-pi · critical · SystemExit

robomp orchestrator refuses to start with GITHUB_TOKEN set i

Error message

robomp orchestrator refuses to start with GITHUB_TOKEN set in env. The PAT must live only in the gh-proxy container.

What it means

Before building the orchestrator, _require_proxy_mode() refuses startup (SystemExit) if GITHUB_TOKEN is set. Robomp's security model is that the PAT exists only inside the gh-proxy sidecar container; a token in the orchestrator env means GitHub credentials could leak into agent-visible processes.

Source

Thrown at python/robomp/src/server.py:238

                "author": s.author,
                "labels": list(s.labels),
                "comments": s.comments,
                "updated_at": s.updated_at,
                "created_at": s.created_at,
                "html_url": s.html_url,
                "processed": make_issue_key(s.repo, s.number) in processed_keys,
            }
            for s in entry.issues
        ],
        "errors": [dict(error) for error in entry.errors],
        "repos": list(entry.repos),
        "cache": {"hit": cache_hit, "fetched_at": entry.fetched_at},
    }


def _require_proxy_mode(cfg: Settings) -> tuple[str, bytes]:
    if cfg.github_token is not None:
        raise SystemExit(
            "robomp orchestrator refuses to start with GITHUB_TOKEN set in env. "
            "The PAT must live only in the gh-proxy container."
        )
    if cfg.gh_proxy_url is None or cfg.gh_proxy_hmac_key is None:
        raise SystemExit(
            "robomp orchestrator requires ROBOMP_GH_PROXY_URL and "
            "ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container)."
        )
    return cfg.gh_proxy_url, cfg.gh_proxy_hmac_key.get_secret_value().encode("utf-8")


def _build_orchestrator(cfg: Settings) -> tuple[GitHubBackend, ProxyGitTransport]:
    base_url, key = _require_proxy_mode(cfg)
    github = GitHubProxyClient(base_url=base_url, hmac_key=key)
    transport = ProxyGitTransport(base_url=base_url, hmac_key=key)
    return github, transport

View on GitHub (pinned to 9690622007)

Solutions

1. Unset GITHUB_TOKEN in the orchestrator environment (.env, shell profile, compose environment: block) and restart.
2. Configure gh-proxy mode instead: set ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY; keep the PAT only in the gh-proxy container.
3. Check the Docker image/compose file for baked-in GITHUB_TOKEN and remove it.
4. If you truly want PAT mode, run in the supported single-process PAT mode without the proxy vars — but the bundled deployment expects proxy mode.

Example fix

// before (.env)
GITHUB_TOKEN=ghp_xxx
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
// after (.env)
# GITHUB_TOKEN removed — PAT lives only in the gh-proxy container
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
ROBOMP_GH_PROXY_HMAC_KEY=<shared-secret>

import os
if os.environ.get('GITHUB_TOKEN'):
    raise SystemExit('Unset GITHUB_TOKEN before starting robomp in gh-proxy mode')

When it happens

Trigger: Starting `robomp serve` (via _build_orchestrator → _require_proxy_mode) with GITHUB_TOKEN (or ROBOMP-parsed github_token) present in the environment while gh-proxy mode is the intended configuration.

Common situations: Leftover GITHUB_TOKEN exported in shell or .env from another tool; GITHUB_TOKEN present in the base container image; compose `environment:` passing GITHUB_TOKEN through; switching from single-process PAT mode to gh-proxy mode without removing the old var.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• robomp orchestrator requires ROBOMP_GH_PROXY_URL and ROBOMP_
• Unable to read OMP_AUTH_BROKER_ACCOUNT_POOL_FILE at ${filePa
• Unable to resolve AWS credentials. Configure static environm
• imageUrls exposure "${name}" requires the ${name} binary on
• blob broker worker requires ${BLOB_BROKER_SOCKET_ENV} and ${

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/b65e0e091a61c681. Report an issue: GitHub.