Bug: Grumpy Code Wants GH_AW_GITHUB_TOKEN

[veverkap]

I installed Grumpy and /grumpy on a PR and it errored out.

I have a COPILOT_GITHUB_TOKEN on the repo (which the next check checks for)

Run actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
  with:
    script: const { main } = require('/opt/gh-aw/actions/generate_aw_info.cjs');
  await main(core, context);
  
    github-token: ***
    debug: false
    user-agent: actions/github-script
    result-encoding: json
    retries: 0
    retry-exempt-status-codes: 400,401,403,404,422
  env:
    GH_AW_INFO_ENGINE_ID: copilot
    GH_AW_INFO_ENGINE_NAME: GitHub Copilot CLI
    GH_AW_INFO_MODEL: 
    GH_AW_INFO_VERSION: 
    GH_AW_INFO_AGENT_VERSION: latest
    GH_AW_INFO_CLI_VERSION: v0.58.3
    GH_AW_INFO_WORKFLOW_NAME: Grumpy Code Reviewer 🔥
    GH_AW_INFO_EXPERIMENTAL: false
    GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: true
    GH_AW_INFO_STAGED: false
    GH_AW_INFO_ALLOWED_DOMAINS: ["defaults"]
    GH_AW_INFO_FIREWALL_ENABLED: true
    GH_AW_INFO_AWF_VERSION: v0.24.1
    GH_AW_INFO_AWMG_VERSION: 
    GH_AW_INFO_FIREWALL_TYPE: squid
    GH_AW_COMPILED_STRICT: true
    GITHUB_MCP_LOCKDOWN_EXPLICIT: true
    GH_AW_GITHUB_TOKEN: 
    GH_AW_GITHUB_MCP_SERVER_TOKEN: 
Starting context variable validation...
✓ github.event.issue.number is valid: 215
✓ github.event.comment.id is valid: 4068850122
✓ github.event.organization.id is valid: 50306600
✓ github.event.repository.id is valid: 1181007645
✓ github.event.sender.id is valid: 22348
Validated 5 context variables
✅ All context variables validated successfully
Lockdown mode is explicitly enabled, validating requirements...
GH_AW_GITHUB_TOKEN configured: false
GH_AW_GITHUB_MCP_SERVER_TOKEN configured: false
Custom github-token configured: false
Error: Lockdown mode is enabled (lockdown: true) but no custom GitHub token is configured.\n\nPlease configure one of the following as a repository secret:\n  - GH_AW_GITHUB_TOKEN (recommended)\n  - GH_AW_GITHUB_MCP_SERVER_TOKEN (alternative)\n  - Custom github-token in your workflow frontmatter\n\nSee: [https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx\n\nTo](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx/n/nTo) set a token:\n  gh aw secrets set GH_AW_GITHUB_TOKEN --value "YOUR_FINE_GRAINED_PAT"
Error: Lockdown mode is enabled (lockdown: true) but no custom GitHub token is configured.\n\nPlease configure one of the following as a repository secret:\n  - GH_AW_GITHUB_TOKEN (recommended)\n  - GH_AW_GITHUB_MCP_SERVER_TOKEN (alternative)\n  - Custom github-token in your workflow frontmatter\n\nSee: [https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx\n\nTo](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx/n/nTo) set a token:\n  gh aw secrets set GH_AW_GITHUB_TOKEN --value "YOUR_FINE_GRAINED_PAT"
    at validateLockdownRequirements (/opt/gh-aw/actions/validate_lockdown_requirements.cjs:59:13)
    at main (/opt/gh-aw/actions/generate_aw_info.cjs:33:3)
    at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/ed597411d8f924073f98dfc5c65a23a2325f34cd/dist/index.js:36187:16), <anonymous>:4:1)
    at async main (/home/runner/work/_actions/actions/github-script/ed597411d8f924073f98dfc5c65a23a2325f34cd/dist/index.js:36285:20)
Error: Unhandled error: Error: Lockdown mode is enabled (lockdown: true) but no custom GitHub token is configured.\n\nPlease configure one of the following as a repository secret:\n  - GH_AW_GITHUB_TOKEN (recommended)\n  - GH_AW_GITHUB_MCP_SERVER_TOKEN (alternative)\n  - Custom github-token in your workflow frontmatter\n\nSee: [https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx\n\nTo](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx/n/nTo) set a token:\n  gh aw secrets set GH_AW_GITHUB_TOKEN --value "YOUR_FINE_GRAINED_PAT"

[pelikhan]

This is a guardrail and a limitation (GitHub MCP server lockdown mode does not support GitHub action token). Working on fixing this .

[veverkap]

@pelikhan is there a workaround? Like setting this?

[pelikhan]

I just merged a fix. Set github.lockdown: false