GitHub Actions · Checked November 3, 2026

GitHub Actions: "Input required and not supplied"

The action asked for an input it cannot work without, and the value was empty. The check is in the action's own code (the getInput function of GitHub's actions toolkit, which most JavaScript actions use), and an input set to an expression that comes out empty counts the same as one that was never written. Most often that expression is a secret that this run cannot see.

What it looks like

From a scheduled run in a fork on November 1, 2026 (dbx #14055):

##[group]Run actions/checkout@v7
with:
  repository: Gaiokane/dbx
  ...
##[endgroup]
##[error]Input required and not supplied: token

• The workflow had token: ${{ secrets.MCP_RELEASE_TOKEN || secrets.PROJECT_AUTOMATION_TOKEN }}. Neither secret exists in the fork, so the value was empty, and in that log token is not even listed under with:.
• The name after the colon is the input the action asked for, spelled as the action spells it. If your workflow sets an input with a similar name, compare the spelling (see below).

A secret this run cannot see

• A pull request from a fork: GitHub's documentation says "With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository."
• A run started by Dependabot: "Secrets are populated from Dependabot secrets. GitHub Actions secrets are not available." In October, a registry login failed this way with username on Dependabot's pull requests (model-validation-operator #196), and a secrets manager step with access_token (ianua-silvae #51).
• A workflow running in a fork's own repository, such as a scheduled one in a fork whose owner turned Actions on. Secrets are not copied to forks, so the run above failed every Sunday and mailed the fork's owner each time.
• A secret that was never created in this repository, or whose name in the workflow is spelled differently.

An input the action no longer has

After a major version bump, the input you set may have a new name, and the required one is then empty. actions/first-interaction v2 and later read issue_message, pr_message and repo_token, so the old issue-message fails with "Input required and not supplied: issue_message" (ellmos-voice-io #1). Its v3 code also requires both messages, even in a workflow that only greets issues (cognee #5374). The same step usually also warns "Unexpected input(s)" with the old name (the "Unexpected input(s)" warning).

Instead of failing

Fall back to the workflow's own token where it is enough. actions/checkout already defaults to it, so an empty secret in token: only makes things worse (RE-UE4SS #1):

- uses: actions/checkout@v7
  with:
    token: ${{ secrets.RELEASE_PAT || github.token }}

Skip the step when the secret is missing. secrets cannot be used in if:, so test it in the job's env (why):

jobs:
  upload:
    runs-on: ubuntu-latest
    env:
      HAS_TOKEN: ${{ secrets.UPLOAD_TOKEN != '' }}
    steps:
      - name: Upload preview
        if: env.HAS_TOKEN == 'true'
        uses: example/upload-action@v2
        with:
          token: ${{ secrets.UPLOAD_TOKEN }}

• Only for Dependabot: add the same secret under Settings, Secrets and variables, Dependabot, or skip the job with if: github.actor != 'dependabot[bot]'.
• Only in forks: run the job in your own repository only, with if: github.repository == 'owner/repo', or for pull requests, if: github.event.pull_request.head.repo.full_name == github.repository.

Telling it apart

• "Unexpected input(s) ..." is a warning about a name the action does not know. "Input required and not supplied" is the error about the one it needed. After a rename you often get both.
• "Resource not accessible by integration": the token was there but lacks a permission ("Resource not accessible by integration").
• The runner itself does not check required: true in action.yml, a request open since 2020 (actions/runner #1070). So a composite action (runs: using: composite) with a missing input just gets an empty value, and a later command fails with its own message.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: The "Unexpected input(s)" warning · "Resource not accessible by integration" · "Invalid workflow file" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語