linera-io/linera-protocol · error

GITHUB_TOKEN is not set! This must be run from within CI

Error message

GITHUB_TOKEN is not set! This must be run from within CI

What it means

Thrown by Github::new when the tool runs in CI mode and env::var("GITHUB_TOKEN") returns an Err (variable absent or invalid Unicode). Octocrab, the GitHub API client, requires a personal access token in CI mode, so construction aborts before any API call is made.

Source

Thrown at linera-summary/src/github.rs:164

}

/// A GitHub client bound to a PR context, used to query workflow runs/jobs and post comments.
pub struct Github {
    octocrab: Octocrab,
    context: GithubContext,
    is_local: bool,
}

impl Github {
    /// Builds a client from the environment, in local or CI mode, for the given PR number.
    pub fn new(is_local: bool, pr_number: Option<u64>) -> Result<Self> {
        let octocrab_builder = Octocrab::builder();
        let octocrab =
            if is_local {
                octocrab_builder
            } else {
                octocrab_builder.personal_token(env::var("GITHUB_TOKEN").map_err(|_| {
                    anyhow!("GITHUB_TOKEN is not set! This must be run from within CI")
                })?)
            }
            .build()
            .map_err(|_| anyhow!("Creating Octocrab instance should not fail!"))?;

        Ok(Self {
            octocrab,
            context: GithubContext::from_env(is_local, pr_number)?,
            is_local,
        })
    }

    /// Returns the PR context this client is bound to.
    pub fn context(&self) -> &GithubContext {
        &self.context
    }

    /// Updates the tool's existing summary comment on the PR, or creates one if absent.

View on GitHub (pinned to 6c226ddcb3)

Solutions

1. Export the token in the calling environment: export GITHUB_TOKEN=$(gh auth token) locally, or env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} in a workflow
2. Verify presence before launch: test -n "$GITHUB_TOKEN" || { echo 'GITHUB_TOKEN missing'; exit 1; }
3. If the secret is workflow-scoped, confirm the job has `permissions: pull-requests: write` and the secret is not restricted to other jobs
4. For local runs, use local mode (is_local=true) which skips the token requirement

Example fix

# before
# job yaml with no env block -> Github::new fails in CI mode

# after
- name: Post PR summary
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: cargo run -p linera-summary -- --pr ${{ github.event.number }}

// Fail fast with a clear message before Github::new
if !is_local && std::env::var_os("GITHUB_TOKEN").is_none() {
    anyhow::bail!("GITHUB_TOKEN missing: export it or run with --local");
}

let gh = match Github::new(false, Some(pr)).context("building GitHub client") {
    Ok(gh) => gh,
    Err(e) if e.to_string().contains("GITHUB_TOKEN") => {
        // env problem, not a code bug: surface actionable message and stop
        return Err(e.context("run inside CI or export GITHUB_TOKEN"));
    }
    Err(e) => return Err(e),
};

When it happens

Trigger: Calling Github::new(false, Some(pr)) in a shell/container/CI job where GITHUB_TOKEN was never exported, was unset by a cleanup step, or contains non-UTF8 bytes.

Common situations: GitHub Actions job missing the automatic `env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` mapping; local test harness spawning the process with a scrubbed environment; token name typo such as GH_TOKEN or GITHUB_SECRET_TOKEN.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• GITHUB_PR_NUMBER is not a valid number: {pr_string}
• Creating Octocrab instance should not fail!
• HEAD is not on a branch - it may be detached
• Failed to open log file for writing
• owner should be different from spender

AI-assisted analysis of linera-io/linera-protocol@6c226ddcb3 (2026-08-22). Data as JSON: /api/errors/35826417d14b365d. Report an issue: GitHub.