fix(core): never send a Mergify user token to GitHub - #1808
Conversation
This was referenced Sep 4, 2026
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:20 — with 
GitHub Actions
Failure
GitHub Actions
Failure
This was referenced Sep 4, 2026
Member
Author
|
This pull request is part of a Mergify stack:
|
Contributor
Merge Protections🔴 4 of 7 protections blocking · waiting on 👀 reviews, 🤖 CI and ⛓️ dependency
🔴 ⛓️ Depends-On RequirementsWaiting for
This rule is failing.Requirement based on the presence of
🔴 🤖 Continuous IntegrationWaiting for
This rule is failing.
🔴 👀 Review RequirementsWaiting for
This rule is failing.
🔴 🔎 ReviewsWaiting for
This rule is failing.
Show 3 satisfied protections🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
`MERGIFY_TOKEN` is the natural place to put the credential `mergify auth login` mints, and `stack` reads that same variable for its GitHub calls. A user who exports one would get `401 Bad credentials` from api.github.com, which says nothing about why. Skip it there. The cost is nothing: `mut_` is Mergify's prefix, registered with GitHub's own secret scanning, so a value carrying it was never going to authenticate against GitHub. `stack` falls through to `GITHUB_TOKEN` or `gh auth token` as it would have if the variable were unset. The failure says so. Telling someone to set `MERGIFY_TOKEN` when they have set it, and it was skipped for a reason visible only at `-vv`, is the worst version of this message. An explicit `--token` is not second-guessed. The user aimed it at this command, and quietly using a different credential instead would be the more surprising failure of the two. This is a failure mode the rest of this stack creates -- there was no reason to hold a `mut_` token before it -- which is why it lands here rather than as a separate ticket. Fixes MRGFY-8703 Change-Id: If3c422baf7dde5e912971015b991046ccbc886eb
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/never-send-mergify-user-token-github--f3c422ba
branch
from
September 4, 2026 23:40
56c3bb4 to
e5c6417
Compare
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/use-stored-credential-deprecate-github-token--ca890065
branch
from
September 4, 2026 23:40
b78ede8 to
320f6ae
Compare
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:40 — with
GitHub Actions
Error
GitHub Actions
Error
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:40 — with
GitHub Actions
Failure
GitHub Actions
Failure
Member
Author
Revision history
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MERGIFY_TOKENis the natural place to put the credentialmergify auth loginmints, andstackreads that same variable for itsGitHub calls. A user who exports one would get
401 Bad credentialsfromapi.github.com, which says nothing about why.
Skip it there. The cost is nothing:
mut_is Mergify's prefix,registered with GitHub's own secret scanning, so a value carrying it was
never going to authenticate against GitHub.
stackfalls through toGITHUB_TOKENorgh auth tokenas it would have if the variable wereunset.
The failure says so. Telling someone to set
MERGIFY_TOKENwhen theyhave set it, and it was skipped for a reason visible only at
-vv, isthe worst version of this message.
An explicit
--tokenis not second-guessed. The user aimed it at thiscommand, and quietly using a different credential instead would be the
more surprising failure of the two.
This is a failure mode the rest of this stack creates -- there was no
reason to hold a
mut_token before it -- which is why it lands hererather than as a separate ticket.
Fixes MRGFY-8703
Depends-On: #1807