When a push fails
A failing connection says so on the environment’s row under Integrations → GitHub Actions, and the sentence GitHub gave is printed beneath it. The sentence is the server’s own, not a summary of it — start there rather than here.
Each of these is a different answer on purpose. “It did not sync” is one message for six problems with six different fixes, and it sends everybody to look at the same wrong thing first.
GitHub no longer has this installation
GitHub no longer has this installation. The App was uninstalled, or it was never installed on that account. Install it again.
Somebody removed the app in GitHub. Everything kyvlt.sh knows about where things go is intact — install the app again on that account and it resumes.
GitHub rejected the app's own credentials
GitHub rejected the App’s own credentials. The App was deleted, or its private key no longer matches.
The app itself is gone, or its key was replaced. This is rarer and worse: the app has to be created again, because GitHub produces a private key once and never shows it a second time.
GitHub accepted the app and refused the operation
GitHub accepted the App and refused the operation. The installation may not have been granted the repositories, or the ‘secrets’ permission.
The app is valid and may not do this. Almost always the installation was not granted this repository — open the app’s installation settings in GitHub and add it. Nothing in kyvlt.sh needs changing.
GitHub has no such repository, or this app cannot see it
GitHub has no such repository, or this token cannot see it.
GitHub answers 404 for both, exactly as kyvlt.sh does for an environment that
does not exist or is not yours, and for the same reason: two answers that look
alike are what stop either being enumerated.
Check that the installation was granted it. A private repository the app was not given is indistinguishable from one that was never there.
GitHub is rate-limiting this app
GitHub is rate-limiting this token. Nothing was written.
Nothing was written, and nothing is lost — what was owed is still owed. kyvlt.sh
takes GitHub’s own Retry-After or reset time as the moment to try again,
rather than guessing, and waits.
There is nothing to do. If it recurs constantly, something else is using the same installation heavily.
GitHub could not be reached
GitHub could not be reached: …
The request never arrived: DNS, egress, a proxy, or GitHub being down. The attempt is retried with a delay that grows between attempts, so an outage costs a delay rather than a lost change.
It stopped partway
Stopped at ‘STRIPE_KEY’. 4 keys were already written and remain. …
A push is not a transaction, and nothing is rolled back. GitHub’s API writes one secret per request; there is no way to write six atomically and no way to undo the four that landed.
So this message names where it stopped and how many are already in the repository, and those stay. The next attempt starts again from the beginning — writing a secret that is already correct costs one request, and the keys after the failure are the ones that still need it.
GitHub’s public key for this repository was not usable
GitHub’s public key for this repository was … bytes, not 32.
Every value is sealed with a public key fetched from the repository before it is sent. This means the key GitHub returned was not the shape the sealing requires, which is not something a configuration change fixes. Nothing was written.
Report it — this one is a genuine surprise rather than a setting.
It says it is waiting, and nothing happens
A connection that owes a push and has no error is waiting for the worker, which runs every few seconds. If it has been waiting much longer than that:
- Check whether the same connection shows a failure — attempts back off, and by the fourth or fifth the wait between them is minutes rather than seconds.
- Check that kyvlt.sh itself is running. The worker is part of the API.
The push is never abandoned. What is owed stays owed, and the earliest unpushed change is what the age is measured from, so a connection stuck since Tuesday says Tuesday rather than restarting the clock each attempt.