Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: cli/cli
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: trunk
Choose a base ref
...
head repository: cli/cli
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: williammartin-api-host-proxy-test
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 6 commits
  • 13 files changed
  • 2 contributors

Commits on Jul 31, 2026

  1. Add api_host gateway black box test 

    A bash harness that runs the real gh binary against a recording TLS
reverse proxy, with api.github.com blackholed, to prove that api_host in
hosts.yml routes API traffic through a gateway while still returning real
results from github.com.

It runs in a Linux container because api_host cannot carry a port, so the
gateway needs :443, and because Go only honours SSL_CERT_FILE off macOS.

Phase 1 is expected to fail today: gh derives its own endpoints in
internal/ghinstance and never consults api_host.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    5afdeb5 View commit details
    Browse the repository at this point in the history

  2. Bind before writing the gateway CA 

    A gateway that fails to bind was overwriting the CA file that a running
one is serving with, which then looks like an unrelated TLS trust failure.
Also document driving the gateway directly with curl.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    75b2ae7 View commit details
    Browse the repository at this point in the history

  3. Assert paginated requests keep the token 

    Running the harness against a naive implementation showed the follow-up
request to a gateway-provided pagination URL arriving without an
Authorization header, because the token is looked up by request host and
the gateway host has no token. It only passed because labels are public;
anything private would break.

go-gh permits authorization for the configured API host for this exact
reason, so assert it here too.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    0d62179 View commit details
    Browse the repository at this point in the history

  4. Document the pagination token trap 

    Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    2a7dc9d View commit details
    Browse the repository at this point in the history

  5. Point go-gh at the per-host api_host branch 

    This is a spike dependency on cli/go-gh#275, not a mergeable pin. It is
enough on its own to make `gh repo view` honour api_host, because
api.Client.Query hands the real hostname to go-gh's NewGraphQLClient and
the branch swaps the endpoint inside that constructor. Commands that
build their own URLs from internal/ghinstance, such as `gh api`, are
unaffected and still need work.

go mod tidy pulled transitive upgrades along with it: chroma, gojq,
timefmt-go and go-timezone-local.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    ffbb5c2 View commit details
    Browse the repository at this point in the history

  6. Send a host's token to its configured api_host 

    go-gh routes API requests for a host to that host's api_host, which is a
hostname gh is not logged in to. AddAuthTokenHeader resolves tokens by
request host, found nothing for it, and sent the request anonymously, so
`gh repo view` through a gateway got a 401.

go-gh solves this in its own headerRoundTripper, but that is inert for
us: cli/cli sets AuthToken "none" and an empty Authorization header to
opt out of go-gh's token resolution, because it needs per-request hosts
and keyring lookups that go-gh cannot express. So we resolve it again on
our side.

AuthConfig owns the api_host to host mapping, since it owns hosts.yml,
and the API transport decides to apply it. It is deliberately not folded
into ActiveToken: the git credential helper passes a hostname straight
from git, so that would hand a github.com token to whatever host is
configured as api_host for git operations, and api_host governs API
traffic only.

The mapping is a fallback used only when the request host has no token
of its own, so it can only add a token where there would have been none
and every host we already authenticate resolves exactly as before.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e37f9a3-d447-474d-a800-2922d2d09f59
    @williammartin
    williammartin and Copilot committed Jul 31, 2026
    Configuration menu
    Copy the full SHA
    37a8246 View commit details
    Browse the repository at this point in the history
Loading