Repository navigation
Conversation
Add a dedicated github-cli authentication mode with host-aware token resolution, in-memory caching, sanitized failures, tests, and documentation. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential selection can send an enterprise token to public GitHub.
3 open findings
What changed in this PR
Adds GitHub CLI authentication to Specify, allowing developers to reuse gh credentials without storing a token in Specify configuration.
Changes:
- Adds shell-free token lookup, in-memory caching, and sanitized errors.
- Passes request hostnames through authentication providers.
- Adds authentication tests and configuration documentation.
AI-generated review for the requester (identity unavailable) by GitHub Copilot (model unknown, autonomous); analysis and drafting.
| File | Description |
|---|---|
| tests/specify_cli/authentication/test_authentication.py | Tests CLI lookup, caching, failures, and request integration. |
| src/specify_cli/authentication/http.py | Passes request hostnames to providers. |
| src/specify_cli/authentication/github.py | Implements GitHub CLI credential resolution. |
| src/specify_cli/authentication/config.py | Updates a comment about field-free CLI modes. |
| src/specify_cli/authentication/bitbucket.py | Accepts the optional hostname argument. |
| src/specify_cli/authentication/base.py | Extends the provider interface with hostname context. |
| src/specify_cli/authentication/azure_devops.py | Adopts the updated provider signature. |
| docs/reference/authentication.md | Documents GitHub CLI configuration and enterprise behavior. |
🧠 Review effort: Max
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Pass explicit GitHub CLI hostnames, map configured enterprise service hosts to their instance login, and route sanitized credential failures through existing URL error handling. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
mnriem
added
the
triage-can-wait
Keep sanitized GitHub CLI credential failures distinct from offline errors in release checks and upgrade output, prove no HTTP fallback occurs, and document terminal failure caching. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Prevent GitHub CLI tokens from following redirects to a different GitHub credential host while preserving authorization across public and configured enterprise aliases. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
| def _acquire_via_gh_cli(hostname: str) -> str: | ||
| """Run the fixed GitHub CLI token command for *hostname*.""" | ||
| resolved = shutil.which("gh") | ||
| if not resolved or not os.path.isabs(resolved): |
| _StripAuthOnRedirect( | ||
| entry.hosts, | ||
| redirect_validator, | ||
| auth_hostname_validator, |
Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
| f"GitHub CLI returned an empty token for {hostname!r}. " | ||
| f"Run 'gh auth login --hostname {hostname}'." | ||
| ) | ||
| return token |
Remove consumer-specific error handling, redirect policy changes, and shared provider API changes. Keep GitHub CLI host selection within the GitHub provider by treating each provider entry as one credential scope. Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 434e2508-0633-4d40-8e0d-5edb92cbc177
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential-scope validation and enterprise hostname selection need correction before approval.
6 open findings
2 resolved since last review
🧠 Review effort: Max
| exact_hosts = { | ||
| host.lower() | ||
| for host in entry.hosts | ||
| if "*" not in host |
Comment on lines
+129
to
+130
| List exactly one bare enterprise host plus any service aliases that share its | ||
| credential: |
Comment on lines
+101
to
+105
| bare_hosts = { | ||
| host | ||
| for host in exact_hosts | ||
| if not host.startswith(_GITHUB_SERVICE_PREFIXES) | ||
| } |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github-cliauthentication mode backed by the fixed, shell-freegh auth tokencommandCloses #4953
Validation
uvx ruff@0.15.0 check src tests— passed.venv/bin/python -m pytest tests/specify_cli/authentication/test_authentication.py -q— 204 passedLC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests -q— 12,212 passed, 71 skippedAI assistance disclosure
Implemented on behalf of @mnriem with GitHub Copilot using GPT-5.6 Sol in autonomous mode. Copilot traced the authentication flow, implemented the changes, added tests and documentation, and ran the validation commands listed above.