Closed samcoe closed 1 year ago
Thanks, @samcoe!
I think mona-actions/gh-repo-stats
is not impacted by these changes especially given work done in #39 to refactor the extension to use gh api
for API calls versus curl
. So closing this as not impacting.
Token storage change in latest release of gh
This is a message from the GitHub CLI team, maintainers of
gh
, writing to inform you that the most recent release ofgh
contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file. The keyrings that are supported are:Keychain on macOS
GNOME Keyring on Linux (Secret Service dbus interface)
Wincred on Windows
This has huge security benefits for the users of our tool and was one of our oldest outstanding issues. Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.
In order to have continued compatibility with
gh
there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.Extensions built in Go using go-gh:
Upgrade your
go-gh
version to v1.2.1, the latest version.go get github.com/cli/go-gh@v1.2.1
Verify that in your extension retrieval of the user authentication token is done using the
auth.TokenForHost
function.All other extensions:
Verify that in your extension retrieval of the user authentication token is done by shelling out to the
gh auth token
command.gh config get
command, reading the configuration file directly, or any other methods it will no longer work.As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a discussion in the gh repo.
Thanks, The GitHub CLI Team