repository scope requires --github-relay-read-only

Error message

repository scope requires --github-relay-read-only

What it means

GitHubRelay::Scope::from_flags validates the --github-relay-read-only flag combination. If the relay is NOT enabled (enabled=false) but repository scoping flags were supplied (--github-relay-all-repos or --github-relay-repo), it bails: repository scoping is meaningless without enabling read-only relay mode.

Solutions

Add --github-relay-read-only to the command line to enable the relay
Or remove the --github-relay-repo / --github-relay-all-repos flags if relay mode is not wanted
Check flag order/naming in scripts; the scoping flags alone do not enable the relay

Example fix

// before
mycli --github-relay-repo org/repo
// after
mycli --github-relay-read-only --github-relay-repo org/repo

Defensive patterns

Strategy: validation

Validate before calling

// Validate flags before invoking
let relay_flags = ["--github-relay-repo", "--github-relay-all-repos"];
if relay_flags.iter().any(|f| args.contains(f)) && !args.contains(&"--github-relay-read-only") {
    panic!("add --github-relay-read-only when scoping relay repositories");
}

Try / catch

match err {
    RelayConfigError::MissingEnableFlag => eprintln!("relay scope flags require --github-relay-read-only"),
    e => return Err(e),
}

Prevention

Always pair repository scoping flags with --github-relay-read-only
Keep canonical command lines in scripts/docs with both flags together
Add a shell alias or wrapper that injects the enabling flag

When it happens

Trigger: Calling from_flags with enabled=false and either all=true or a non-empty repositories list — i.e. the CLI was given --github-relay-repo/--github-relay-all-repos without --github-relay-read-only.

Common situations: Copy-pasting relay scope flags from documentation or a teammate's command while forgetting the enabling --github-relay-read-only flag; scripting the relay config and omitting the enable flag.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/c532cb87f6f28a71. Report an issue: GitHub.

Appendix: source

Thrown at src/github_relay.rs:24

#[derive(Clone, Debug, Default)]
pub(crate) struct Scope {
    #[cfg(unix)]
    options: Options,
    #[cfg(any(unix, test))]
    repositories: std::collections::BTreeSet<String>,
    #[cfg(any(unix, test))]
    all: bool,
}

impl Scope {
    pub(crate) fn from_flags(
        enabled: bool,
        repositories: &[String],
        all: bool,
    ) -> Result<Option<Self>> {
        if !enabled {
            if all || !repositories.is_empty() {
                bail!("repository scope requires --github-relay-read-only");
            }
            return Ok(None);
        }
        if all != repositories.is_empty() {
            bail!("choose --github-relay-repo OWNER/REPO or --github-relay-all-repos, not both");
        }
        let repositories: std::collections::BTreeSet<String> = repositories
            .iter()
            .map(|repo| repository(repo))
            .collect::<Result<_>>()?;
        #[cfg(not(any(unix, test)))]
        let _ = repositories;
        Ok(Some(Self {
            #[cfg(unix)]
            options: Options::default(),
            #[cfg(any(unix, test))]
            repositories,
            #[cfg(any(unix, test))]

View on GitHub (pinned to 533346cc37)