[mnriem]

Description

• Add a dedicated github-cli authentication mode backed by the fixed, shell-free gh auth token command.
• Pass the first configured hostname (hosts[0]) to gh auth token --hostname and use that hostname as the cache key for successful or failed lookups in memory for the current process.
• Treat every configured host or supported wildcard as an explicit destination authorized to receive that credential. Host-instance inference is intentionally not performed; use separate entries for different credentials.
• Provide sanitized missing CLI, authentication, command failure, empty or malformed output, and timeout errors.
• Document configuration, first-host ordering, enterprise behavior, and acquisition-failure versus HTTP fallback behavior.

Closes #4953

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

The exact template commands above were not run in this review round. Focused checks at 1dfc5244:

• .venv/bin/python -m pytest tests/specify_cli/authentication -o addopts='' -q --disable-warnings — 326 passed, 33 warnings.
• ruff check --isolated --select E4,E7,E9,F,S602,S604,S605 src/specify_cli/authentication/github.py tests/specify_cli/authentication/test_authentication.py — passed.

Coverage includes first-host selection and cache isolation, missing or relative executables, sanitized subprocess and malformed-token failures, registered-provider HTTP wiring, declared-host redirect preservation and unlisted-host stripping, and catalog failure handling.

Earlier validation reported by the original implementation (not rerun in full for this description update):

• uvx ruff@0.15.0 check src tests — passed.
• .venv/bin/python -m pytest tests/specify_cli/authentication/test_authentication.py -q — 204 passed.
• LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests -q — 12,212 passed, 71 skipped.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (fill in the disclosure below)

AI disclosure: Implemented on behalf of @mnriem with GitHub Copilot using GPT-5.6 Sol in autonomous mode for the original implementation and its reported validation. Subsequent review fixes, regression tests, documentation, and validation were authored and executed by GitHub Copilot using GPT-6.1 Sol, primarily in autonomous mode, with the first-host policy directed by @mnriem. This description update and review replies use GPT-6.1 Sol in interactive mode with explicit user authorization. Reasoning-effort settings were not explicitly selected in this session. No claim of human line-by-line review is made.

[Copilot]

🟡 Changes recommended

Credential selection can send an enterprise token to public GitHub.

3 open findings

• Pass normalized hostname to gh for public GitHub requests · New
• Handle gh credential failures without aborting catalog merges · New
• Map enterprise content hosts to their configured credential host · New

What changed in this PR

Adds GitHub CLI authentication to Specify, allowing developers to reuse gh credentials without storing a token in Specify configuration.

Changes:

• Adds shell-free token lookup, in-memory caching, and sanitized errors.
• Passes request hostnames through authentication providers.
• Adds authentication tests and configuration documentation.

AI-generated review for the requester (identity unavailable) by GitHub Copilot (model unknown, autonomous); analysis and drafting.

File	Description
tests/​specify_cli/​authentication/​test_authentication.py	Tests CLI lookup, caching, failures, and request integration.
src/​specify_cli/​authentication/​http.py	Passes request hostnames to providers.
src/​specify_cli/​authentication/​github.py	Implements GitHub CLI credential resolution.
src/​specify_cli/​authentication/​config.py	Updates a comment about field-free CLI modes.
src/​specify_cli/​authentication/​bitbucket.py	Accepts the optional hostname argument.
src/​specify_cli/​authentication/​base.py	Extends the provider interface with hostname context.
src/​specify_cli/​authentication/​azure_devops.py	Adopts the updated provider signature.
docs/​reference/​authentication.md	Documents GitHub CLI configuration and enterprise behavior.

🧠 Review effort: Max

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Release checks and upgrades misreport GitHub CLI credential failures as network outages, hiding actionable authentication diagnostics.

3 open findings

• Patch opener to verify credential failures prevent HTTP requests · New
• Preserve GitHub CLI authentication errors instead of reporting offline timeout · New
• Document credential lookup fallback and failure caching behavior · New

3 resolved since last review

• Pass normalized hostname to gh for public GitHub requests
• Map enterprise content hosts to their configured credential host
• Handle gh credential failures without aborting catalog merges

🧠 Review effort: Max

[Copilot]

🟡 Changes recommended

Cross-instance redirects can forward the initial host’s credential instead of selecting the destination’s credential.

1 open finding

• Prevent token forwarding across GitHub instances · New

3 resolved since last review

• Preserve GitHub CLI authentication errors instead of reporting offline timeout
• Patch opener to verify credential failures prevent HTTP requests
• Document credential lookup fallback and failure caching behavior

🧠 Review effort: Max

[Copilot]

🔵 Needs a closer look

Credential-handling changes need human review because bundle error classification and redirect-security coverage remain unresolved.

3 open findings

• Prevent GitHub CLI auth errors from triggering availability fallback · New
• Test rejection of relative GitHub CLI executables · New
• Add redirect credential-scope wiring coverage · New

1 resolved since last review

• Prevent token forwarding across GitHub instances

🧠 Review effort: Max

[Copilot]

🔵 Needs a closer look

The subprocess credential helper and shared HTTP changes need human security review.

4 open findings

• Sanitize GitHub CLI host before invoking Windows shims · New
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• Prevent GitHub CLI auth errors from triggering availability fallback

🧠 Review effort: Max

[Copilot]

🔵 Needs a closer look

Security-sensitive authentication and redirect changes retain verified defects and require human review.

5 open findings

• Reject internal newlines in GitHub CLI tokens · New
• Preserve GitHub CLI errors for API-only configuration · New
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• Prevent GitHub CLI auth errors from triggering availability fallback

1 resolved since last review

• Sanitize GitHub CLI host before invoking Windows shims

🧠 Review effort: Max

[Copilot]

🟡 Changes recommended

Credential-scope validation and enterprise hostname selection need correction before approval.

6 open findings

• Reject mixed-instance wildcard hosts · New
• Reject internal newlines in GitHub CLI tokens
• Document supported GitHub service aliases · New
• Support enterprise hosts whose names start with service aliases · New
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables

2 resolved since last review

• Preserve GitHub CLI errors for API-only configuration
• Prevent GitHub CLI auth errors from triggering availability fallback

🧠 Review effort: Max

[Copilot]

🔵 Needs a closer look

The security-sensitive credential acquisition and forwarding behavior warrants final human review.

5 open issues

• Reject mixed-instance wildcard hosts
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• The GitHub auth-scheme table still lists only bearer, so readers scanning it will miss… · New
• The PR summary says Enterprise credentials are resolved "for the request hostname", but this… · New

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Release checks still turn actionable GitHub CLI authentication failures into misleading offline-or-timeout errors.

5 open issues

• Reject mixed-instance wildcard hosts
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• The “How it works” summary (steps 2–4, lines 329–333) describes retries and anonymous fallback… · New
• The PR summary says Enterprise credentials are resolved "for the request hostname", but this…

1 resolved since last review

• The GitHub auth-scheme table still lists only bearer, so readers scanning it will miss…

_{Review effort: Max}

[Copilot]

🟢 Approval recommended

The reviewed changes have focused positive and negative coverage, with only optional documentation improvements remaining.

4 open issues

• Reject mixed-instance wildcard hosts
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• The PR summary says Enterprise credentials are resolved "for the request hostname", but this…

1 resolved since last review

• The “How it works” summary (steps 2–4, lines 329–333) describes retries and anonymous fallback…

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Malformed Unicode CLI output can bypass sanitized authentication errors and abort catalog operations or release checks.

1 open issue

• Reject non-ASCII CLI tokens before caching · New

4 resolved since last review

• Reject mixed-instance wildcard hosts
• Add redirect credential-scope wiring coverage
• Test rejection of relative GitHub CLI executables
• The PR summary says Enterprise credentials are resolved "for the request hostname", but this…

_{Review effort: Max}

[mnriem]

Fixed in 12fe353: GitHub CLI tokens are now required to be ASCII after trimming. Non-ASCII output takes the existing sanitized malformed-token path before any successful token is cached or passed to HTTP headers. Regression cases cover both Latin-1 and non-Latin-1 Unicode, identical repeated diagnostics, and a single subprocess invocation. Documentation now states this restriction. No base-class or shared HTTP changes.

The new Unicode cases failed before the fix and pass afterward. Validation: .venv/bin/python -m pytest tests/specify_cli/authentication tests/specify_cli/integrations/test_catalog.py tests/specify_cli/test_version_release.py tests/specify_cli/test_version_execution.py tests/specify_cli/test_operation_version.py -o addopts='' -q --disable-warnings — 506 passed. Targeted Ruff checks passed.

Posted on behalf of @mnriem by GitHub Copilot (GPT-6.1 Sol, interactive session with autonomous implementation; reasoning effort not explicitly selected). AI involvement: implementation, regression tests, documentation, validation, and comment drafting.

[Copilot]

🔵 Needs a closer look

The credential-execution boundary and refreshed dependency hashes warrant final human validation beyond the available static evidence.

No open issues 🎉

1 resolved since last review

• Reject non-ASCII CLI tokens before caching

_{Review effort: Max}

[Copilot]

🔵 Needs a closer look

Credential subprocess execution and cross-module failure handling need maintainer review beyond the isolated verification performed here.

1 open issue

• Normalize whitespace before asserting wrapped diagnostic output · New

_{Review effort: Max}

[Copilot]

🔵 Needs a closer look

Subprocess-based credential acquisition and authentication-failure handling across shared request paths warrant final maintainer review.

No open issues 🎉

1 resolved since last review

• Normalize whitespace before asserting wrapped diagnostic output

_{Review effort: Max}