Skip to content

Accept GH_TOKEN in vast GitHub token resolution - #25

Draft
Al-does wants to merge 1 commit into
mainfrom
cursor/vast-gh-token-23c5
Draft

Accept GH_TOKEN in vast GitHub token resolution#25
Al-does wants to merge 1 commit into
mainfrom
cursor/vast-gh-token-23c5

Conversation

@Al-does

@Al-does Al-does commented Aug 17, 2026

Copy link
Copy Markdown
Owner

Summary

Vast provisioning previously resolved GitHub credentials from GITHUB_TOKEN only. Cloud Agents and RunPod paths inject GH_TOKEN, so vast --self-destruct flows failed on agents that only had GH_TOKEN set.

This aligns vast with the shared resolution order used elsewhere in devops/:

  1. --github-token
  2. GH_TOKEN
  3. GITHUB_TOKEN
  4. gh auth token

Changes

  • devops/vast/provision.py: updated resolve_github_token() and user-facing help/error text
  • devops/vast/bootstrap.sh: normalize GH_TOKENGITHUB_TOKEN on the remote box
  • devops/vast/redaction.py and self_destruct.py: redact GH_TOKEN in logs/metadata
  • Docs/skill updates for the new resolution order
  • Tests for GH_TOKEN resolution, bootstrap normalization, and redaction

Testing

uv run pytest -q tests/test_infra_safeguards.py -k "github_token or gh_token or bootstrap_uses_token or redact_instance"
# 8 passed
Open in Web Open in Cursor 

Vast provisioning previously read GITHUB_TOKEN only, while Cloud Agents
and RunPod paths inject GH_TOKEN. Align vast with the shared resolution
order: CLI flag, GH_TOKEN, GITHUB_TOKEN, then gh auth token.

Bootstrap normalizes GH_TOKEN onto GITHUB_TOKEN for clone/push, and
redaction covers both env var names.

Co-authored-by: Alex Vardakostas <Al-does@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants