[Python] Why is my github token truncated when retrieved from config dict in GitHub Action...

I'm encountering a strange issue with a Python script running inside a GitHub Action where the secrets.GITHUB_TOKEN seems to get truncated after being stored in a configuration dictionary, but only when a debug mode flag is enabled.

Context:

• A Python script (main.py) runs as part of a GitHub Actions workflow.
• The workflow passes secrets.GITHUB_TOKEN as an environment variable GITHUB_TOKEN.
• A config.py module reads environment variables (including GITHUB_TOKEN) into a dictionary using os.environ.get().
• main.py calls load_config() from config.py to get the dictionary, then retrieves the token from the dictionary to initialize a GitHub API client.
• I have debug logging at various stages.

Workflow Snippet (.github/workflows/...yml):

jobs:
analyze-milestones:
runs-on: ubuntu-latest
steps:
# ... checkout, setup python ...
- name: Run Milestone Assistant
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# OPENROUTER_API_KEY: ...
DEBUG: ${{ github.event.inputs.debug_mode == 'true' && '1' || '0' }} # Debug flag
run: |
cd tools/milestone-assistant
python -m src.main \
# ... other args ...
${{ github.event.inputs.debug_mode == 'true' && '--debug' || '' }}


Configuration Loading (src/config.py):

import os
import logging

logger = logging.getLogger(__name__)
DEFAULT_CONFIG = { "github": { "token": "", ... }, ... }

def load_config():
config = DEFAULT_CONFIG.copy()
github_token_env = os.environ.get("GITHUB_TOKEN")
if github_token_env:
config["github"]["token"] = github_token_env
# Log right after reading
logger.debug(f"Read token from GITHUB_TOKEN. Type: {type(github_token_env)}, Length: {len(github_token_env)}")
# ... load other config ...
return config


Main Script Snippet (src/main.py):

import argparse
import logging
import os
from .config import load_config
from .github.client import GitHubClient

logger = logging.getLogger(__name__)

def main():
args = parse_args() # Parses --debug flag
setup_logging(logging.DEBUG if args.debug else logging.INFO)

config = load_config()
config_token = config["github"]["token"]

# Log length retrieved from dict
logger.debug(f"Initializing GitHub client with token length: {len(config_token)}")

# Initialize client (fails with 401 when token is short)
github_client = GitHubClient(
token=config_token,
repository=config["github"]["repository"]
)
# ... rest of script ...

if __name__ == "__main__":
main()


The Problem:

When running the workflow with debug mode enabled (DEBUG=1, --debug flag passed), the logs show:

# Inside config.py, load_config()
DEBUG - Read token from GITHUB_TOKEN. Type: <class 'str'>, Length: 40

# Inside main.py, after config = load_config()
DEBUG - Initializing GitHub client with token length: 14 # <-- TRUNCATED!

# Inside github/client.py init
DEBUG - Initializing GitHub client with token length: 14

# API Call Result
ERROR - API access test failed: 401
ERROR - Authentication failed. Please check your GitHub token.


Workaround:

I've added a check in main.py to re-read os.environ.get("GITHUB_TOKEN") if len(config["github"]["token"]) is less than 40, which works. But I want to understand the root cause.

Continue reading...