What causes "token is required" in stablyai/orca?

Set GH_TOKEN (preferred) or GITHUB_TOKEN to a valid PAT or the Actions GITHUB_TOKEN before running.

stablyai/orca · error · Error

token is required

Error message

token is required

What it means

Thrown by publishCompleteDraftReleases in config/scripts/publish-complete-draft-releases.mjs when the `token` option is falsy. The token is sent as `Authorization: Bearer ${token}` on every GitHub request by githubJson, so an empty token yields anonymous calls that 401 on private repos or rate-limit instantly. The guard at line 87-88 runs before fetchReleases.

Source

Thrown at config/scripts/publish-complete-draft-releases.mjs:88

  if (!Array.isArray(releases)) {
    throw new Error(`GitHub releases response for ${repo} was not an array`)
  }
  return releases
}

export async function publishCompleteDraftReleases({
  repo,
  token,
  fetchImpl = fetch,
  verifyReleaseAssets = verifyRequiredReleaseAssets,
  isDraftBuiltFromCurrentRef = ({ tag }) => isTagBuiltFromCurrentRef(tag),
  log = console.log
}) {
  if (!repo) {
    throw new Error('repo is required')
  }
  if (!token) {
    throw new Error('token is required')
  }

  const releases = await fetchReleases(repo, token, fetchImpl)
  const candidates = releases
    .filter(isReleaseCutDraft)
    .sort((a, b) => new Date(a.created_at ?? 0).getTime() - new Date(b.created_at ?? 0).getTime())

  const published = []
  const skipped = []

  for (const release of candidates) {
    const tag = release.tag_name
    if (!(await Promise.resolve(isDraftBuiltFromCurrentRef({ tag, release })))) {
      const reason = 'tag is not built from the current release ref'
      skipped.push({ tag, reason })
      log(`Skipping stale RC draft release ${tag}: ${reason}`)
      continue
    }

View on GitHub (pinned to 1136503c6a)

Solutions

Set GH_TOKEN (preferred) or GITHUB_TOKEN to a valid PAT or the Actions GITHUB_TOKEN before running.
If calling the API directly, pass `token` in the options object.
Verify the token has `contents:write` scope for the target repo.

Example fix

// before
# no token exported
node config/scripts/publish-complete-draft-releases.mjs

// after
GH_TOKEN=ghp_xxx node config/scripts/publish-complete-draft-releases.mjs

Defensive patterns

Strategy: validation

Validate before calling

const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
if (!token) throw new Error('Set GH_TOKEN or GITHUB_TOKEN before running the release publisher')

Type guard

function hasToken(env = process.env) {
  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN)
}

Prevention

In GitHub Actions, map `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` into env.
For local runs, export GH_TOKEN from a PAT with `contents:write`.
Fail fast on missing token in your wrapper before any network call.

When it happens

Trigger: Call publishCompleteDraftReleases without a token, or run the CLI with neither GH_TOKEN nor GITHUB_TOKEN set in the environment. main() at line 159 sets `token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN`, so both being unset/empty trips the guard.

Common situations: A GitHub Actions workflow forgot to pass the `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` env, a local run has no token exported, or a fine-grained PAT was cleared. The error appears before any network call, so it is the first thing to fail in a misconfigured release job.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/8a2a52038ee3cd03. Report an issue: GitHub.