can1357/oh-my-pi · critical · SystemExit

robomp orchestrator requires ROBOMP_GH_PROXY_URL and ROBOMP_

Error message

robomp orchestrator requires ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container).

What it means

_require_proxy_mode() requires ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY to be set when GITHUB_TOKEN is absent; missing either raises SystemExit at orchestrator startup because there is no way to authenticate GitHub requests without the gh-proxy sidecar.

Source

Thrown at python/robomp/src/server.py:243

                "html_url": s.html_url,
                "processed": make_issue_key(s.repo, s.number) in processed_keys,
            }
            for s in entry.issues
        ],
        "errors": [dict(error) for error in entry.errors],
        "repos": list(entry.repos),
        "cache": {"hit": cache_hit, "fetched_at": entry.fetched_at},
    }


def _require_proxy_mode(cfg: Settings) -> tuple[str, bytes]:
    if cfg.github_token is not None:
        raise SystemExit(
            "robomp orchestrator refuses to start with GITHUB_TOKEN set in env. "
            "The PAT must live only in the gh-proxy container."
        )
    if cfg.gh_proxy_url is None or cfg.gh_proxy_hmac_key is None:
        raise SystemExit(
            "robomp orchestrator requires ROBOMP_GH_PROXY_URL and "
            "ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container)."
        )
    return cfg.gh_proxy_url, cfg.gh_proxy_hmac_key.get_secret_value().encode("utf-8")


def _build_orchestrator(cfg: Settings) -> tuple[GitHubBackend, ProxyGitTransport]:
    base_url, key = _require_proxy_mode(cfg)
    github = GitHubProxyClient(base_url=base_url, hmac_key=key)
    transport = ProxyGitTransport(base_url=base_url, hmac_key=key)
    return github, transport


def _build_state(settings: Settings) -> dict[str, Any]:
    db = get_database(settings.sqlite_path)
    github, git_transport = _build_orchestrator(settings)
    natives_cache: NativesCache | None = None
    if settings.natives_cache_enabled:

View on GitHub (pinned to 9690622007)

Solutions

Set both ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY in .env / container env and restart.
Deploy the gh-proxy sibling container (compose default) and point ROBOMP_GH_PROXY_URL at it.
Compare your .env against .env.example — it is the authoritative required-var list.
Alternatively set GITHUB_TOKEN to use direct PAT mode (proxy vars then must be removed).

Example fix

// before (.env)
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
# HMAC key missing
// after (.env)
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
ROBOMP_GH_PROXY_HMAC_KEY=<same-key-as-gh-proxy-container>

Defensive patterns

Strategy: validation

Validate before calling

import os
required = ('ROBOMP_GH_PROXY_URL', 'ROBOMP_GH_PROXY_HMAC_KEY')
missing = [v for v in required if not os.environ.get(v)]
if missing and not os.environ.get('GITHUB_TOKEN'):
    raise SystemExit(f'missing env: {missing}')

Prevention

Start every deployment from .env.example (authoritative var list)
Use compose --env-file and verify with `docker compose config`
Set both proxy vars to the same values as the gh-proxy sidecar

When it happens

Trigger: Starting `robomp serve` with no GITHUB_TOKEN and either ROBOMP_GH_PROXY_URL or ROBOMP_GH_PROXY_HMAC_KEY unset/empty in Settings.

Common situations: Fresh deployment where .env was copied incompletely from .env.example; typo'd variable name (e.g. ROBOMP_GH_PROXY_KEY); running the container without --env-file; HMAC key deliberately blanked for local testing.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/f2e0168831f70c01. Report an issue: GitHub.