I'm seeing a weird error in PR CI (https://github.com/pantsbuild/pants/pull/12890/checks?check_run_id=3657406781) that looks like a configuration issue, or maybe just something transient:

23:09:35.17 [WARN] [rules] Failed to load Toolchain token from env var 'TOOLCHAIN_AUTH_TOKEN'. Please make sure the env var is set in your environment.
23:09:35.17 [INFO] [rules] Acquire restricted access token: {'repo_slug': 'pantsbuild/pants', 'env': {'GITHUB_ACTIONS': 'true', 'GITHUB_RUN_ID': '1255477684', 'GITHUB_REF': 'refs/pull/12890/merge', 'GITHUB_EVENT_NAME': 'pull_request', 'GITHUB_SHA': '6d88f59c53a251eb50f9c45bec971f185ec16370', 'GITHUB_REPOSITORY': 'pantsbuild/pants', 'GITHUB_WORKFLOW': 'Pull Request CI', 'GITHUB_JOB': 'lint_python'}}
23:09:35.73 [WARN] Error loading access token: AuthError('[rules] Auth rejected by server request_id=d66ee1b707d2eba195a5aa43a80279a3')
Error: Process completed with exit code 1.

Maybe that your plugin version of Toolchain is still

this is safe to ignore.

ohh @bored-art-40741 scroll up for the actual errors, MyPy

we currently only issue access tokens to the toolchain service for toolchain engineers, hence the server refuses to allocation an access token for your PR.

oh okay

no one else is seeing this, right? because i also needed to refresh the CI token last week.

Not sure, but Eric pointed out that I was just reading trailing warnings; the root cause was a regular mypy failure

yea. @hundreds-father-404: can you confirm that you have access in your CI runs?

this is unrelated to the CI token which is only used in branch builds not PR builds.

got it.

Since PRs can be submitted by anyone on the internet, we don't trust them (by default) and don't allow them to access the toolchain SasS.

yea, makes sense. would be good to silence the warning… i expect other contributors have seen this, and might have thought it was broken (i had been confused by it when looking at a contributor’s PR at one point)

I have a ticket to improve the DX... will be working on it soon.

thank you!