From 1195947d053bcc56e250122bb9febda26e03d598 Mon Sep 17 00:00:00 2001 From: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:25:51 -0500 Subject: [PATCH 1/3] fix: authenticate cross-repo git via gh, guard clone failures The first live run of readme-refresh failed to clone the target repos: fatal: could not read Username for 'https://github.com' GitHub's git-over-HTTPS rejects both the `x-access-token:@` URL form and an `Authorization: Bearer ` extraHeader for a classic/fine-grained PAT, so git fell back to an interactive prompt and died. Because the clone failure was unguarded, the script continued and ran `git -C diff --cached` outside any repo (the `unknown option cached` / no-index noise), silently producing no PR. Fix: - Configure git's github.com credentials via `gh auth setup-git` (token-type agnostic; authenticates both the clone and the push through GH_TOKEN). - Clone with a plain https URL and GUARD it: on failure, warn and skip the repo instead of generating into an empty directory. Verified: shellcheck --severity=warning -x clean; isolated dry-run (throwaway GIT_CONFIG_GLOBAL) clones both repos, generates all four READMEs, and renders correct diff stats with no git errors. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01VAsu1rBxAkMnAqFZaWKV6t --- scripts/aw-readme-refresh.sh | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/scripts/aw-readme-refresh.sh b/scripts/aw-readme-refresh.sh index 12e9e02a1..fe049c2d4 100644 --- a/scripts/aw-readme-refresh.sh +++ b/scripts/aw-readme-refresh.sh @@ -205,9 +205,13 @@ process_repo() { local LINT_WARNINGS="" log "Cloning $full_repo" - git clone --quiet \ - -c http.extraHeader="Authorization: Bearer ${GH_TOKEN}" \ - "https://github.com/${full_repo}.git" "$dir" + # Auth is handled by gh's git credential helper (configured in main via `gh auth setup-git`), + # which works for both PATs and App tokens. Guard the clone so a failure aborts this repo + # loudly instead of silently generating into an empty directory. + if ! git clone --quiet "https://github.com/${full_repo}.git" "$dir" || [ ! -d "$dir/.git" ]; then + warn "clone failed for $full_repo — skipping this repo" + return 0 + fi local default_branch default_branch="$(git -C "$dir" symbolic-ref --short HEAD)" # Rolling branch: always reset to default HEAD so the PR reflects "main + fresh READMEs". @@ -346,6 +350,13 @@ if ! command -v claude >/dev/null 2>&1; then exit 1 fi +# Route git's github.com credentials through gh (uses GH_TOKEN). This authenticates the +# cross-repo clone/push for any token type — unlike an embedded x-access-token: or +# "Authorization: Bearer" header, which GitHub rejects for a classic/fine-grained PAT. +if ! gh auth setup-git --hostname github.com >/dev/null 2>&1; then + warn "gh auth setup-git failed — cross-repo git push may not authenticate" +fi + facts_file="$(gather_facts)" EMPTY_DESC_REPOS="$(cat "$WORK_DIR/empty_desc.txt" 2>/dev/null || echo "")" log "Facts bundle assembled ($(wc -l < "$facts_file") lines); empty-desc repos: ${EMPTY_DESC_REPOS:-none}" From 5f70311899db2b27db849200a655dd8b9bd31db1 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 3 Jul 2026 21:29:01 +0000 Subject: [PATCH 2/3] fix(reviews): address review comments [skip ci-relay] --- scripts/aw-readme-refresh.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/aw-readme-refresh.sh b/scripts/aw-readme-refresh.sh index fe049c2d4..6bb110ea0 100644 --- a/scripts/aw-readme-refresh.sh +++ b/scripts/aw-readme-refresh.sh @@ -210,7 +210,7 @@ process_repo() { # loudly instead of silently generating into an empty directory. if ! git clone --quiet "https://github.com/${full_repo}.git" "$dir" || [ ! -d "$dir/.git" ]; then warn "clone failed for $full_repo — skipping this repo" - return 0 + return 1 fi local default_branch default_branch="$(git -C "$dir" symbolic-ref --short HEAD)" From 1666fc8eeb35b77e3cd0a9d18c165daf1dac42b4 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 3 Jul 2026 21:33:39 +0000 Subject: [PATCH 3/3] chore: dev-lead update (review-changes) [skip ci-relay] --- scripts/aw-readme-refresh.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/aw-readme-refresh.sh b/scripts/aw-readme-refresh.sh index 6bb110ea0..23ddae7b3 100644 --- a/scripts/aw-readme-refresh.sh +++ b/scripts/aw-readme-refresh.sh @@ -208,7 +208,7 @@ process_repo() { # Auth is handled by gh's git credential helper (configured in main via `gh auth setup-git`), # which works for both PATs and App tokens. Guard the clone so a failure aborts this repo # loudly instead of silently generating into an empty directory. - if ! git clone --quiet "https://github.com/${full_repo}.git" "$dir" || [ ! -d "$dir/.git" ]; then + if ! GIT_TERMINAL_PROMPT=0 git clone --quiet "https://github.com/${full_repo}.git" "$dir" || [ ! -d "$dir/.git" ]; then warn "clone failed for $full_repo — skipping this repo" return 1 fi @@ -353,6 +353,12 @@ fi # Route git's github.com credentials through gh (uses GH_TOKEN). This authenticates the # cross-repo clone/push for any token type — unlike an embedded x-access-token: or # "Authorization: Bearer" header, which GitHub rejects for a classic/fine-grained PAT. +# Isolate the config writes to a temp file so local runs don't mutate ~/.gitconfig; CI +# sets GIT_CONFIG_GLOBAL already, so we only override when it is unset. +if [ -z "${GIT_CONFIG_GLOBAL:-}" ]; then + _gc_tmp="$(mktemp)" + export GIT_CONFIG_GLOBAL="$_gc_tmp" +fi if ! gh auth setup-git --hostname github.com >/dev/null 2>&1; then warn "gh auth setup-git failed — cross-repo git push may not authenticate" fi