This means the GitHub repo is never created, and subsequently the push-mirror sync
fails because it has no destination to push to.
Observed during e2e test on 2026-05-18: test-throwaway-001 was created on Gitea,
mirror was configured, but GitHub repo never appeared. Required manual intervention:
create GitHub repo via API, delete and recreate mirror with PAT, trigger sync manually.
Fix
Set GITHUB_PAT as a k8s secret in the routing pod deployment on koala.
internal/skills/project/handlers.go — code is correct, no changes needed
cmd/routing/main.go — config loading is correct, no changes needed
## Problem
`project_create` skips the GitHub repo creation step when `s.cfg.GitHub == nil`.
This happens when `GITHUB_PAT` is not set in the routing pod environment.
The code in `handlers.go` is correct:
```go
if s.cfg.GitHub != nil {
if err := s.callCreateGitHubRepo(ctx, args); err != nil && !errors.Is(err, githubclient.ErrAlreadyExists) {
return marshalPartial(res, stepCreateGitHub, err)
}
res.Reached = append(res.Reached, stepCreateGitHub)
}
```
But without `GITHUB_PAT` set, the GitHub client is never initialised in `cmd/routing/main.go`:
```go
if cfg.GitHubPAT != "" {
ghClient = githubclient.New(cfg.GitHubPAT)
}
```
This means the GitHub repo is never created, and subsequently the push-mirror sync
fails because it has no destination to push to.
Observed during e2e test on 2026-05-18: `test-throwaway-001` was created on Gitea,
mirror was configured, but GitHub repo never appeared. Required manual intervention:
create GitHub repo via API, delete and recreate mirror with PAT, trigger sync manually.
## Fix
Set `GITHUB_PAT` as a k8s secret in the routing pod deployment on koala.
### 1. Create the secret
```bash
kubectl create secret generic routing-github \
--namespace routing \
--from-literal=github-pat="$GITHUB_PAT"
```
Or add to the existing SOPS-encrypted secrets file for the routing pod.
### 2. Mount in deployment
In `k3s/apps/routing/deployment.yaml`, add env var from secret:
```yaml
env:
- name: GITHUB_PAT
valueFrom:
secretKeyRef:
name: routing-github
key: github-pat
```
### 3. Verify config loads correctly
After deploy, check routing pod logs on startup:
```
project_create registered ... github_pat_set=true
```
Currently logs `github_pat_set=false` which is the signal that PAT is missing.
### 4. Also set GITHUB_OWNER
Verify `GITHUB_OWNER=mathiasb` is set in the routing pod config. This is needed
for constructing the correct mirror remote URL.
## Acceptance criteria
- [ ] `GITHUB_PAT` set as k8s secret in routing namespace
- [ ] Routing pod deployment mounts secret as env var
- [ ] Routing pod startup log shows `github_pat_set=true`
- [ ] `project_create` e2e test: GitHub repo appears at `github.com/mathiasb/<name>` within 60s
- [ ] Mirror sync shows `last_error: ""` after initial sync
## Required GitHub PAT scopes
- `repo` — create private/public repos, push code via mirror
## Related
- hyperguild #11 (e2e test findings)
- `internal/skills/project/handlers.go` — code is correct, no changes needed
- `cmd/routing/main.go` — config loading is correct, no changes needed
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
project_createskips the GitHub repo creation step whens.cfg.GitHub == nil.This happens when
GITHUB_PATis not set in the routing pod environment.The code in
handlers.gois correct:But without
GITHUB_PATset, the GitHub client is never initialised incmd/routing/main.go:This means the GitHub repo is never created, and subsequently the push-mirror sync
fails because it has no destination to push to.
Observed during e2e test on 2026-05-18:
test-throwaway-001was created on Gitea,mirror was configured, but GitHub repo never appeared. Required manual intervention:
create GitHub repo via API, delete and recreate mirror with PAT, trigger sync manually.
Fix
Set
GITHUB_PATas a k8s secret in the routing pod deployment on koala.1. Create the secret
Or add to the existing SOPS-encrypted secrets file for the routing pod.
2. Mount in deployment
In
k3s/apps/routing/deployment.yaml, add env var from secret:3. Verify config loads correctly
After deploy, check routing pod logs on startup:
Currently logs
github_pat_set=falsewhich is the signal that PAT is missing.4. Also set GITHUB_OWNER
Verify
GITHUB_OWNER=mathiasbis set in the routing pod config. This is neededfor constructing the correct mirror remote URL.
Acceptance criteria
GITHUB_PATset as k8s secret in routing namespacegithub_pat_set=trueproject_createe2e test: GitHub repo appears atgithub.com/mathiasb/<name>within 60slast_error: ""after initial syncRequired GitHub PAT scopes
repo— create private/public repos, push code via mirrorRelated
internal/skills/project/handlers.go— code is correct, no changes neededcmd/routing/main.go— config loading is correct, no changes neededResolved. Verified on koala cluster 2026-05-18:
routing-secretskeys present:Deployment wires secret via
envFrom(k3s/apps/routing/deployment.yaml@fe534a6):Plus
GITHUB_OWNER=mathiasbandINFRA_REPO=infraset as literal env.Routing pod startup log confirms config loaded:
Image deployed:
gitea.d-ma.be/mathias/routing:5950ef5f0fef7a38bc29638a4514fd5b1efa4df4.All acceptance criteria met. Remaining concern —
GITHUB_PATpersistence insecrets.enc.yamlfor SOPS round-trip / rebuild survival — tracked separately in #14 (Item 2).