Skip to content

fix: authenticate cross-repo git via gh, guard clone failures (readme-refresh) #1067

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 4 commits into from
Jul 3, 2026
Merged

fix: authenticate cross-repo git via gh, guard clone failures (readme-refresh) #1067

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1195947
fix: authenticate cross-repo git via gh, guard clone failures
Jul 3, 2026
5f70311
fix(reviews): address review comments [skip ci-relay]
donpetry-bot Jul 3, 2026
1666fc8
chore: dev-lead update (review-changes) [skip ci-relay]
donpetry-bot Jul 3, 2026
26b0080
Merge branch 'main' into fix/readme-refresh-clone-auth
donpetry-bot Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions scripts/aw-readme-refresh.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,9 +205,13 @@ process_repo() {
local LINT_WARNINGS=""

log "Cloning $full_repo"
git clone --quiet \
-c http.extraHeader="Authorization: Bearer ${GH_TOKEN}" \
"https://github.com/${full_repo}.git" "$dir"
# Auth is handled by gh's git credential helper (configured in main via `gh auth setup-git`),
# which works for both PATs and App tokens. Guard the clone so a failure aborts this repo
# loudly instead of silently generating into an empty directory.
if ! GIT_TERMINAL_PROMPT=0 git clone --quiet "https://github.com/${full_repo}.git" "$dir" || [ ! -d "$dir/.git" ]; then
warn "clone failed for $full_repo — skipping this repo"
return 1
fi
local default_branch
default_branch="$(git -C "$dir" symbolic-ref --short HEAD)"
# Rolling branch: always reset to default HEAD so the PR reflects "main + fresh READMEs".
Expand Down Expand Up @@ -346,6 +350,19 @@ if ! command -v claude >/dev/null 2>&1; then
exit 1
fi

# Route git's github.com credentials through gh (uses GH_TOKEN). This authenticates the
# cross-repo clone/push for any token type — unlike an embedded x-access-token: or
# "Authorization: Bearer" header, which GitHub rejects for a classic/fine-grained PAT.
# Isolate the config writes to a temp file so local runs don't mutate ~/.gitconfig; CI
# sets GIT_CONFIG_GLOBAL already, so we only override when it is unset.
if [ -z "${GIT_CONFIG_GLOBAL:-}" ]; then
_gc_tmp="$(mktemp)"
export GIT_CONFIG_GLOBAL="$_gc_tmp"
fi
if ! gh auth setup-git --hostname github.com >/dev/null 2>&1; then
warn "gh auth setup-git failed — cross-repo git push may not authenticate"
fi
Comment on lines +362 to +364

@coderabbitai coderabbitai Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- scripts/aw-readme-refresh.sh (around lines 330-390) ---\n'
sed -n '330,390p' scripts/aw-readme-refresh.sh | cat -n

printf '\n--- search for setup-git usage and auth-related handling ---\n'
rg -n "setup-git|GIT_TERMINAL_PROMPT|auth setup|warn .*authenticate|cross-repo git" scripts/aw-readme-refresh.sh .github -S

Repository: petry-projects/.github-private

Length of output: 259

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- scripts/aw-readme-refresh.sh outline ---\n'
ast-grep outline scripts/aw-readme-refresh.sh --view expanded

printf '\n--- nearby logic for repo refresh / clone / push ---\n'
rg -n "clone|push|pull|fetch|gh auth setup-git|GIT_TERMINAL_PROMPT|token|GITHUB_TOKEN|gh repo" scripts/aw-readme-refresh.sh -n -S

Repository: petry-projects/.github-private

Length of output: 259

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Show the relevant section and any surrounding auth/setup logic.
sed -n '340,380p' scripts/aw-readme-refresh.sh | cat -n
printf '\n'
rg -n "setup-git|GIT_TERMINAL_PROMPT|clone|push|warn " scripts/aw-readme-refresh.sh -S

Repository: petry-projects/.github-private

Length of output: 3189

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '190,320p' scripts/aw-readme-refresh.sh | cat -n

Repository: petry-projects/.github-private

Length of output: 6615

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n "gh auth setup-git|credential helper|GIT_TERMINAL_PROMPT|clone failed|push --force-with-lease" scripts/aw-readme-refresh.sh -n -S

Repository: petry-projects/.github-private

Length of output: 679

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Inspect the repo-processing path and auth-related comments around clone/push.
sed -n '200,315p' scripts/aw-readme-refresh.sh | cat -n

Repository: petry-projects/.github-private

Length of output: 5795

Fail fast if gh auth setup-git fails.
With GIT_TERMINAL_PROMPT=0, this turns a global auth problem into repo-by-repo clone/push skips; aborting here surfaces the broken credential setup immediately.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/aw-readme-refresh.sh` around lines 362 - 364, The current `gh auth
setup-git` handling in the auth/bootstrap flow only warns and continues, which
hides a global credential problem. In the `aw-readme-refresh.sh` logic around
the `gh auth setup-git` check, change it to abort immediately on failure instead
of calling `warn`, so the script fails fast and surfaces the broken auth setup
before later clone/push operations run.

Source: Coding guidelines


facts_file="$(gather_facts)"
EMPTY_DESC_REPOS="$(cat "$WORK_DIR/empty_desc.txt" 2>/dev/null || echo "")"
log "Facts bundle assembled ($(wc -l < "$facts_file") lines); empty-desc repos: ${EMPTY_DESC_REPOS:-none}"
Expand Down
Loading