What causes "GH_TOKEN or GITHUB_TOKEN must be set" in stablyai/orca?

Export a token locally: export GH_TOKEN=$(gh auth token) or set a PAT with repo read scope.

GH_TOKEN or GITHUB_TOKEN must be set

Error message

GH_TOKEN or GITHUB_TOKEN must be set

What it means

Usage guard in main(): the script needs a GitHub auth token to call the releases API. It checks GH_TOKEN then falls back to GITHUB_TOKEN; if neither env var is set it aborts before any network call.

Source

Thrown at config/scripts/verify-release-required-assets.mjs:151

    )
  }

  return {
    tag,
    checked: [...requiredNames].sort(),
    draft: release.draft,
    prerelease: release.prerelease
  }
}

async function main() {
  const tag = process.argv[2]
  if (!tag) {
    throw new Error('Usage: node config/scripts/verify-release-required-assets.mjs <tag>')
  }
  const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
  if (!token) {
    throw new Error('GH_TOKEN or GITHUB_TOKEN must be set')
  }
  const repo = process.env.GITHUB_REPOSITORY || 'stablyai/orca'
  const result = await verifyRequiredReleaseAssets({ repo, tag, token })
  console.log(`Verified ${result.checked.length} required release assets for ${repo}@${tag}`)
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  main().catch((error) => {
    console.error(error.message)
    process.exit(1)
  })
}

View on GitHub (pinned to 1136503c6a)

Solutions

Export a token locally: export GH_TOKEN=$(gh auth token) or set a PAT with repo read scope.
In GitHub Actions, ensure the job has permissions: contents: read and that GITHUB_TOKEN is available (it is injected automatically unless overridden).
If using a reusable workflow, pass the token explicitly via env or secrets.
Verify the env var is actually exported in the shell invoking node (printenv GH_TOKEN).

Example fix

# before
node config/scripts/verify-release-required-assets.mjs v1.2.3
# after
export GH_TOKEN="${{ secrets.GITHUB_TOKEN }}"
node config/scripts/verify-release-required-assets.mjs v1.2.3

Defensive patterns

Strategy: validation

Validate before calling

# Before running, assert the token env exists:
# - name: Verify release assets
#   env:
#     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
#   run: |
#     [ -n "$GH_TOKEN" ] || { echo 'missing token'; exit 2; }
#     node config/scripts/verify-release-required-assets.mjs "$TAG"

Prevention

Always set permissions: contents: read on the job so GITHUB_TOKEN is injected.
For reusable workflows, pass the token via env or secrets explicitly.
Prefer GH_TOKEN naming consistently to avoid fallback confusion.

When it happens

Trigger: Running locally without exporting a token; CI job whose permissions block omits contents:read or that doesn't forward the auto-generated GITHUB_TOKEN; invoking in a container or shell that strips the environment.

Common situations: Local developer machine with no gh auth or token export; reusable workflow that doesn't propagate secrets; scheduled run on a fork without a PAT; runner env reset between steps.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/c6957d0911004ed1. Report an issue: GitHub.