Problem
The db-migrate GitHub Actions workflow failed before running migrations because PlanetScale returned a 403 Forbidden during the staging branch existence check.
Failing workflow run:
https://github.com/lightfastai/lightfast/actions/runs/26924643122
Failing step:
pscale branch show "$PLANETSCALE_DATABASE_NAME" "$PSCALE_BRANCH_NAME" --org "$PLANETSCALE_ORG_NAME"
Observed output included an HTML PlanetScale/API response:
The workflow then printed the generic fallback message:
staging branch missing - run the one-time bootstrap documented in db/CLAUDE.md
Important Context
The staging branch was not actually missing. Local pscale branch list lightfast --org lightfast --format json showed staging exists and is ready.
PR #792 was deployed manually by:
- Creating a temporary local PlanetScale password for
lightfast/staging.
- Running
pnpm --filter @db/app db:migrate against staging.
- Opening/deploying deploy request
#19 from staging into main.
- Running
pscale deploy-request skip-revert lightfast 19 --org lightfast.
- Verifying no temporary
codex-pr792-* password remained.
Likely Cause
The GitHub Actions PlanetScale service token may be invalid, expired, mismatched, or missing permissions for org/database access.
Secrets to verify:
PLANETSCALE_ORG_NAMEPLANETSCALE_DATABASE_NAMEPLANETSCALE_SERVICE_TOKEN_IDPLANETSCALE_SERVICE_TOKEN
The service token should be able to:
- Read database branches.
- Create/delete branch passwords on
staging.
- Create/show/deploy deploy requests from
staging to main.
Suggested Fix
- Verify or rotate the PlanetScale service token used by GitHub Actions.
- Confirm the token has the required org/database permissions.
- Improve the workflow error handling so a PlanetScale API/auth failure is not reported as “staging branch missing.”
A better check would preserve and print the pscale branch show stderr, distinguish 403 from branch-not-found, and fail with an auth/permission-specific message.
Problem
The
db-migrateGitHub Actions workflow failed before running migrations because PlanetScale returned a403 Forbiddenduring the staging branch existence check.Failing workflow run:
https://github.com/lightfastai/lightfast/actions/runs/26924643122
Failing step:
Observed output included an HTML PlanetScale/API response:
The workflow then printed the generic fallback message:
Important Context
The
stagingbranch was not actually missing. Localpscale branch list lightfast --org lightfast --format jsonshowedstagingexists and is ready.PR #792 was deployed manually by:
lightfast/staging.pnpm --filter @db/app db:migrateagainststaging.#19fromstagingintomain.pscale deploy-request skip-revert lightfast 19 --org lightfast.codex-pr792-*password remained.Likely Cause
The GitHub Actions PlanetScale service token may be invalid, expired, mismatched, or missing permissions for org/database access.
Secrets to verify:
PLANETSCALE_ORG_NAMEPLANETSCALE_DATABASE_NAMEPLANETSCALE_SERVICE_TOKEN_IDPLANETSCALE_SERVICE_TOKENThe service token should be able to:
staging.stagingtomain.Suggested Fix
A better check would preserve and print the
pscale branch showstderr, distinguish403from branch-not-found, and fail with an auth/permission-specific message.