Repository navigation
[proposal] Generate/Create GITHUB_TOKEN by gh cli #3855
Description
Activity
We're actively discussing improvements like this 👍 there will be limits to what we can do outside of the browser, but we do hope to add some of this functionality to the
gh authcommand. I'm going to mark as blocked as there are some internal discussions we need to have to figure out the best way to add support for this.This is a related question, I could not find particular documentation for it.
I am trying to understand the automatic token creation during
gh auth login(interactive). This will create a token inhosts.yml. I am trying to find this token on my github account under Settings --> Developer Settings but it does not show up. Where are these token stored and how can I see the default scope for it (does it expire?). Shouldn't those generated tokens be associated with the user github account?Reacted by Aidan MelenReacted by Oliver Mannion@fab4100 There are roughly 3 kinds of authentication tokens on GitHub: Personal Access Token (PAT), OAuth token, and GitHub Apps token.
If you are looking here https://github.com/settings/tokens, only your PATs are listed. However,
gh auth loginweb flow mode does not create a PAT. Instead, it creates an OAuth token linked to theGitHub CLIOAuth app. This token has no expiration, but you can invalidate any OAuth token here: https://github.com/settings/applicationsReacted by Aidan Melen and Daniel George Holz@mislav It would be nice if
gh auth loginwould have an option to create tokens with a user-provided expiration date (or duration), and ideally also have an option to set a default for this expiration duration.Reacted by Mislav MarohnićYes, it's an area we're actively looking at according to this roadmap item: github/roadmap#184
However, I'm not able to share more detailed progress updates until we have something more to announce publicly. We will for sure update this thread 👍
This would be incredibly nice to have for publishing Docker images to ghcr 👀 needing to go into the settings to regenerate every couple months is a little tiring
Reacted by Michael Mifsud and Joe PreviteClosing this in favor of an earlier related issue: #2531
We still plan to do this, but we are a way off still. We might need to first convert our OAuth app to a "GitHub App" before we can improve the user experience of minting tokens with specific privileges and expiration.
@aslilac For authenticating Docker, see this workaround: #5150 (comment)
Describe the feature or problem you’d like to solve
I'm trying to streamline a process where my clients need to generate a
GITHUB_TOKENwith a specific set of permissions for a downstream build job. Right now I have to tell them to open their browser, generate a token, and return to the script.Proposed solution
Since
gh auth loginalready authenticates with github with full permissions, that user should be able to generate aGITHUB_TOKENwith specific [lesser] permissions to use elsewhere. It is beneficial to CLI and its users because it allows for token creation with the correct permissions without having to leave the command line. It also allows me to verify a token has the correct permissions before moving on to further steps and getting an unexpected 401 from some downstream npm job.gh token listgh token create [Scopes]gh token update [Note] [Scopes]gh token delete [Note]gh token describe [Note]Additional context
Add any other context like screenshots or mockups are helpful, if applicable.