search

swfz / gh-annotations

list of annotations from the recently executed Workflow
13 stars 2 forks source link

Add support for secure token storage #8

Open samcoe opened 1 year ago

samcoe commented 1 year ago

Token storage change in latest release of gh

This is a message from the GitHub CLI team, maintainers of gh, writing to inform you that the most recent release of gh contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file. The keyrings that are supported are:

This has huge security benefits for the users of our tool and was one of our oldest outstanding issues. Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.

In order to have continued compatibility with gh there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.

Extensions built in Go using go-gh:

  1. Upgrade your go-gh version to v1.2.1, the latest version.

    • This can be done using go get github.com/cli/go-gh@v1.2.1

  2. Verify that in your extension retrieval of the user authentication token is done using the auth.TokenForHost function.

    • If you were previously accessing the authentication token using any other method it will no longer work.
    • Automatic resolution of the authentication token when using the API clients will continue to work without changes.

All other extensions:

  1. Verify that in your extension retrieval of the user authentication token is done by shelling out to the gh auth token command.

    • If you were previously accessing the authentication token using the gh config get command, reading the configuration file directly, or any other methods it will no longer work.

As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a discussion in the gh repo.

Thanks, The GitHub CLI Team

massongit commented 1 year ago

In gh 2.26.0 or later, running gh annotations after running gh auth login will fail. However, if I run gh auth login with --insecure-storage and then run gh annotations, it will succeed.

[My environment]

$ sw_vers
ProductName:    macOS
ProductVersion: 12.6.4
BuildVersion:   21G526

[gh 2.28.0 (via homebrew)]

$ gh --version
gh version 2.28.0 (2023-04-25)
https://github.com/cli/cli/releases/tag/v2.28.0

$ gh auth login
...

$ gh annotations -repo org/repo
authentication token not found for host github.com

$ gh auth login --insecure-storage
...

$ gh annotations -repo org/repo
Reposi...  Workflow  Event  Job  JobSt...  JobCo...  Concl...  Annot...  Message

[gh 2.26.0]

$ path/to/gh_2.26.0_macOS_arm64/bin/gh --version
gh version 2.26.0 (2023-04-04)
https://github.com/cli/cli/releases/tag/v2.26.0

$ path/to/gh_2.26.0_macOS_arm64/bin/gh auth login
...

$ path/to/gh_2.26.0_macOS_arm64/bin/gh annotations -repo org/repo
authentication token not found for host github.com

$ path/to/gh_2.26.0_macOS_arm64/bin/gh auth login --insecure-storage
...

$ path/to/gh_2.26.0_macOS_arm64/bin/gh annotations -repo org/repo
Repository  Workflow  Event  Job  JobStartedAt  JobCompletedAt  Conclusion  AnnotationLevel  Message

[gh 2.25.1]

$ path/to/gh_2.25.1_macOS_arm64/bin/gh --version
gh version 2.25.1 (2023-03-21)
https://github.com/cli/cli/releases/tag/v2.25.1

$ path/to/gh_2.25.1_macOS_arm64/bin/gh auth login
...

$ path/to/gh_2.25.1_macOS_arm64/bin/gh annotations -repo org/repo
Repository  Workflow  Event  Job  JobStartedAt  JobCompletedAt  Conclusion  AnnotationLevel  Message
massongit commented 1 year ago

https://github.com/swfz/gh-annotations/issues/8#issuecomment-1524182814 seems to have already been resolved by https://github.com/swfz/gh-annotations/pull/12. Therefore, please release it.

swfz commented 1 year ago

@massongit Thank you for your confirmation, https://github.com/swfz/gh-annotations/releases/tag/v1.0.1 has been released!

massongit commented 1 year ago

Thank you for new release! I confirmed that v1.0.1 had resolved https://github.com/swfz/gh-annotations/issues/8#issuecomment-1524182814.

$ gh --version
gh version 2.28.0 (2023-04-25)
https://github.com/cli/cli/releases/tag/v2.28.0

$ gh auth login
...

$ gh annotations -repo org/repo
Repository  Workflow  Event  Job  JobStartedAt  JobCompletedAt  Conclusion  AnnotationLevel  Message