Repository navigation
Conversation
Add a dedicated github-cli authentication mode with host-aware token resolution, in-memory caching, sanitized failures, tests, and documentation. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential selection can send an enterprise token to public GitHub.
3 open findings
What changed in this PR
Adds GitHub CLI authentication to Specify, allowing developers to reuse gh credentials without storing a token in Specify configuration.
Changes:
- Adds shell-free token lookup, in-memory caching, and sanitized errors.
- Passes request hostnames through authentication providers.
- Adds authentication tests and configuration documentation.
AI-generated review for the requester (identity unavailable) by GitHub Copilot (model unknown, autonomous); analysis and drafting.
| File | Description |
|---|---|
| tests/specify_cli/authentication/test_authentication.py | Tests CLI lookup, caching, failures, and request integration. |
| src/specify_cli/authentication/http.py | Passes request hostnames to providers. |
| src/specify_cli/authentication/github.py | Implements GitHub CLI credential resolution. |
| src/specify_cli/authentication/config.py | Updates a comment about field-free CLI modes. |
| src/specify_cli/authentication/bitbucket.py | Accepts the optional hostname argument. |
| src/specify_cli/authentication/base.py | Extends the provider interface with hostname context. |
| src/specify_cli/authentication/azure_devops.py | Adopts the updated provider signature. |
| docs/reference/authentication.md | Documents GitHub CLI configuration and enterprise behavior. |
🧠 Review effort: Max
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Pass explicit GitHub CLI hostnames, map configured enterprise service hosts to their instance login, and route sanitized credential failures through existing URL error handling. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
mnriem
added
the
triage-can-wait
Keep sanitized GitHub CLI credential failures distinct from offline errors in release checks and upgrade output, prove no HTTP fallback occurs, and document terminal failure caching. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Prevent GitHub CLI tokens from following redirects to a different GitHub credential host while preserving authorization across public and configured enterprise aliases. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
| def _acquire_via_gh_cli(hostname: str) -> str: | ||
| """Run the fixed GitHub CLI token command for *hostname*.""" | ||
| resolved = shutil.which("gh") | ||
| if not resolved or not os.path.isabs(resolved): |
| _StripAuthOnRedirect( | ||
| entry.hosts, | ||
| redirect_validator, | ||
| auth_hostname_validator, |
Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Remove consumer-specific error handling, redirect policy changes, and shared provider API changes. Keep GitHub CLI host selection within the GitHub provider by treating each provider entry as one credential scope. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential-scope validation and enterprise hostname selection need correction before approval.
6 open findings
2 resolved since last review
🧠 Review effort: Max
| exact_hosts = { | ||
| host.lower() | ||
| for host in entry.hosts | ||
| if "*" not in host |
Use hosts[0] as the credential hostname instead of inferring an instance from service prefixes. Document ordering and cover first-host selection, wildcard rejection, and cache isolation. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <[email protected]>
Upgrade only opentelemetry-api from 1.45.0 to 1.45.1 and regenerate its hashes to resolve CVE-2026-114603 in the committed audit snapshot. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <[email protected]>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
GitHub CLI authentication failures can bypass existing catalog and release-check error handlers.
7 open issues
GitHubAuthinstances, but none passes agithub-clientry through… · NewOSError… · New
1 resolved since last review
Review effort: Max
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Expected GitHub CLI authentication failures bypass existing HTTP error handlers and can abort catalog commands with an uncaught exception.
6 open issues
OSError…GitHubAuthinstances, but none passes agithub-clientry through…
1 resolved since last review
Review effort: Max
Exercise build_request and open_url with the registered GitHub provider and an isolated credential cache. Verify bearer headers and fail-fast acquisition errors, and cover sanitized cached PermissionError and UnicodeDecodeError failures. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <[email protected]>
Reject embedded CR and LF after trimming CLI output, before returning or caching a token. Cache only the sanitized failure diagnostic and cover CR, LF, and CRLF regressions. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <[email protected]>
Classify GitHub CLI acquisition failures as URL errors so existing catalog handlers can warn and continue, while each affected HTTP request still fails without credential or anonymous fallback. Cache the sanitized reason without nesting URL-error wrappers. Add catalog-search regression, release-check, and redirect-wiring coverage; retain the approved first-host credential contract. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <[email protected]>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The security-sensitive credential acquisition and forwarding behavior warrants final human review.
5 open issues
bearer, so readers scanning it will miss… · New
Review effort: Max
Comment on lines
62
to
+64
|
|
||
| The `github` provider supports `bearer` tokens and `github-cli` credentials | ||
| acquired on demand from GitHub CLI. |
| @staticmethod | ||
| def _credential_hostname(entry: AuthConfigEntry) -> str: | ||
| """Use the first configured host for GitHub CLI credential acquisition.""" | ||
| hostname = entry.hosts[0] |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github-cliauthentication mode backed by the fixed, shell-freegh auth tokencommandCloses #4953
Validation
uvx [email protected] check src tests— passed.venv/bin/python -m pytest tests/specify_cli/authentication/test_authentication.py -q— 204 passedLC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests -q— 12,212 passed, 71 skippedAI assistance disclosure
Implemented on behalf of @mnriem with GitHub Copilot using GPT-5.6 Sol in autonomous mode. Copilot traced the authentication flow, implemented the changes, added tests and documentation, and ran the validation commands listed above.