Github token is missing when enabling comments on plan action

[jochem725]

I'm trying to get comments working on the plan action; the actions run the plan, which is visible in the log and stored on S3;

I've updated to v5 of the action but get the following error:

time="2025-09-22T14:59:25Z" level=error msg="tfcmt failed" error="github token is missing"

Did I miss something from the documentation (such as creating a Github App)?

[milldr]

You wont need a GitHub App, but you do need additional workflow permissions to enable PR comments. Add this to the permissions block, typically defined in .github/workflows/atmos-terraform-plan.yaml

permissions:
  id-token: write # to request the JWT token as part of configure-aws-credentials
  contents: read # to checkout the repo
  pull-requests: write # to post comments to pull requests
  issues: write # to create GitHub Issue Labels, if necessary

[jochem725]

@milldr Thank you! I think this is indeed something that is missing, however it does not seem to resolve the issue.
We're seeing similar behaviour in drift detection as well.

And similarly in the issues it creates

I wonder if the downstream steps can access the GITHUB_TOKEN variable, or if it needs to be passed explicitly?

[ronaldsteen]

In addition, it seems like no env variable GITHUB_TOKEN is being set anywhere, and I don't think tfcmt can fetch it from secrets.

What chatgpt says about it:

Yes — inside GitHub Actions, every job automatically gets a token stored in the environment as GITHUB_TOKEN, but it’s only available as a secret (secrets.GITHUB_TOKEN).

So if you just run:

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

you’re essentially passing it into the environment so tfcmt (or other CLI tools) can see it.
Without that step, tfcmt won’t automatically know about the token — because tfcmt expects the token in an environment variable named GITHUB_TOKEN.

[milldr]

I was able to recreate this issue with this PR. We'll take a look

[jochem725]

@milldr would a possible solution be updating the plan action to accept a parameter for the token? That way I can just pass it along as a parameter which I hope solves the problem.

[milldr]

We're pulling in @goruha to take a look. We should have a fix pushed shortly!

[goruha]

@jochem725, thanks for raising this bug report.
We fixed that in this release https://github.com/cloudposse/github-action-atmos-terraform-plan/releases/tag/v5.3.0
Could you pls verify it solves your issue?

Thanks.

[jochem725]

Works, thanks @goruha 🚀

[goruha]

@jochem725 reopen if you will still have the problem