What causes "no username:token provided" in golang-migrate/migrate?

Include the token as the password part: 'github:// : @github.com/owner/repo'

no username:token provided

Error message

no username:token provided

What it means

github.ErrNoUserInfo is returned by Github.Open when the URL contains userinfo (u.User != nil) but no password component, i.e. there is no colon-separated token. The GitHub driver uses the password part of the URL as the OAuth access token.

Source

Thrown at source/github/github.go:24

	"io"
	"net/http"
	nurl "net/url"
	"os"
	"path"
	"strings"

	"golang.org/x/oauth2"

	"github.com/golang-migrate/migrate/v4/source"
	"github.com/google/go-github/v39/github"
)

func init() {
	source.Register("github", &Github{})
}

var (
	ErrNoUserInfo          = fmt.Errorf("no username:token provided")
	ErrNoAccessToken       = fmt.Errorf("no access token")
	ErrInvalidRepo         = fmt.Errorf("invalid repo")
	ErrInvalidGithubClient = fmt.Errorf("expected *github.Client")
	ErrNoDir               = fmt.Errorf("no directory")
)

type Github struct {
	config     *Config
	client     *github.Client
	options    *github.RepositoryContentGetOptions
	migrations *source.Migrations
}

type Config struct {
	Owner string
	Repo  string
	Path  string
	Ref   string

View on GitHub (pinned to 01a9643f14)

Solutions

Include the token as the password part: 'github://<anything>:<token>@github.com/owner/repo'
Or omit userinfo entirely and rely on an unauthenticated client (rate-limited, will fail for private repos)
Or use WithInstance with a pre-configured *github.Client instead of URL auth

Example fix

// before
source.Open("github://myuser@github.com/owner/repo/migrations")
// after
source.Open("github://myuser:ghp_xxx@github.com/owner/repo/migrations")

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(sourceURL)
if err != nil {
    return err
}
if u.User != nil {
    if _, ok := u.User.Password(); !ok {
        return fmt.Errorf("github source url needs username:token, got user only")
    }
}

Type guard

func hasGitHubToken(raw string) bool {
    u, err := url.Parse(raw)
    if err != nil || u.User == nil {
        return false
    }
    pw, ok := u.User.Password()
    return ok && pw != ""
}

Try / catch

d, err := githubSource.Open(srcURL)
if err != nil {
    if errors.Is(err, source_github.ErrNoUserInfo) {
        return fmt.Errorf("embed token as password in URL: user:token@github.com")
    }
    return err
}

Prevention

Format credentials as user:token, never user-only
Inject the token from env/secrets and assert non-empty before building the URL
Prefer WithInstance with a programmatically built *github.Client for complex auth

When it happens

Trigger: Open('github://user@github.com/owner/repo') — username present, no ':token' — causes u.User.Password() to return ok=false and Open returns ErrNoUserInfo.

Common situations: Writing 'github://x@github.com/...' assuming any user works; templating that dropped the token after the colon; confusing this driver's 'username:token' format with token-only auth used elsewhere.

Related errors

AI-assisted analysis of golang-migrate/migrate@01a9643f14 (2026-09-02). Data as JSON: /api/errors/f85a9fb52d66ec15. Report an issue: GitHub.