GitHub Actions · GitHub CLI · Checked November 3, 2026

GitHub Actions: gh "set the GH_TOKEN environment variable"

GitHub CLI found no token. It does not pick up the job's token by itself: it reads GH_TOKEN, then GITHUB_TOKEN, from the step's environment (gh help environment), and the credentials that actions/checkout stores for git are not among them. gh prints this text when it finds no token and GITHUB_ACTIONS is true (help.go), and exits with 4, its code for "requires authentication". The fix is one line, but in many recent cases the line was there and its value was empty.

What it looks like

gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
  env:
    GH_TOKEN: ${{ github.token }}
Error: Process completed with exit code 4.

1. No token in that step

Set it on the step, or on the job so that every step has it. Blur-AutoClicker-arch moved it to the job after one gh step in a rarely used path went without (#3).

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v7
      - run: gh release create "$GITHUB_REF_NAME" --generate-notes

github.token is the same token as secrets.GITHUB_TOKEN. Give the job the permissions the command needs: contents: write for releases, pull-requests: write for gh pr create, issues: write for gh issue create.

2. The line is there, and the value is empty

An expression for a secret that the run does not get is an empty string, and an empty GH_TOKEN is no token. In vbonk/repo-template, GH_TOKEN: ${{ secrets.PROJECT_TOKEN }} had no secret behind it, and 100 of the last 100 runs failed (#190). The usual reasons:

• The secret was never created, or it is in an environment the job does not use.
• A pull request from a fork gets no secrets, and Dependabot gets only Dependabot secrets. OS-Credexus's merge workflow failed on Dependabot's pull requests before it reached its own Dependabot skip (#8).
• A reusable workflow gets only the secrets its caller passes, and an unpassed one is empty with no error: the same empty value with AWS shows secrets: inherit and a step that stops on the empty value.

tuna-os/hive falls back to the job's token when the secret is unset (#28):

env:
  GH_TOKEN: ${{ secrets.GHCR_PRUNE_TOKEN || github.token }}

That fallback is right only when github.token can do the job. It cannot in these cases, and there a clear failure is better:

• Projects. The documentation: "GITHUB_TOKEN is scoped to the repository level and cannot access projects." Use a GitHub App or a personal access token.
• Another repository. GITHUB_TOKEN reaches only the repository the workflow runs in.
• A pull request that must start workflows. Runs for a pull request created with GITHUB_TOKEN need approval, and other events it causes start no workflows. OS-Credexus kept its own token and fails with a message that says what to add, for that reason (#8).

3. GitHub Enterprise Server

For a GitHub Enterprise Server host gh reads GH_ENTERPRISE_TOKEN, then GITHUB_ENTERPRISE_TOKEN, not GH_TOKEN. Set GH_HOST too when the host cannot be read from the repository's remote (gh help environment).

Telling it apart

• HTTP 403: Resource not accessible by integration: gh had a token, and it lacked a permission ("Resource not accessible by integration").
• HTTP 401: Bad credentials: gh had a token that GitHub did not accept, such as an expired or revoked personal access token.
• gh: command not found: gh is not installed. The GitHub-hosted images include it; self-hosted runners and container jobs may not.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub, GitHub Actions and GitHub CLI are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: "Resource not accessible by integration" · AWS "Could not load credentials from any providers" · "GH013: Repository rule violations found" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語