Repository navigation
[proposal] Generate/Create GITHUB_TOKEN by gh cli #3855
Description
Describe the feature or problem you’d like to solve
I'm trying to streamline a process where my clients need to generate a GITHUB_TOKEN with a specific set of permissions for a downstream build job. Right now I have to tell them to open their browser, generate a token, and return to the script.
Proposed solution
Since gh auth login already authenticates with github with full permissions, that user should be able to generate a GITHUB_TOKEN with specific [lesser] permissions to use elsewhere. It is beneficial to CLI and its users because it allows for token creation with the correct permissions without having to leave the command line. It also allows me to verify a token has the correct permissions before moving on to further steps and getting an unexpected 401 from some downstream npm job.
gh token list
gh token create [Scopes]
gh token update [Note] [Scopes]
gh token delete [Note]
gh token describe [Note]
Additional context
Add any other context like screenshots or mockups are helpful, if applicable.
Activity
vilmibm commentedon Jun 18, 2021
We're actively discussing improvements like this 👍 there will be limits to what we can do outside of the browser, but we do hope to add some of this functionality to the
gh authcommand. I'm going to mark as blocked as there are some internal discussions we need to have to figure out the best way to add support for this.fab4100 commentedon Aug 13, 2021
This is a related question, I could not find particular documentation for it.
I am trying to understand the automatic token creation during
gh auth login(interactive). This will create a token inhosts.yml. I am trying to find this token on my github account under Settings --> Developer Settings but it does not show up. Where are these token stored and how can I see the default scope for it (does it expire?). Shouldn't those generated tokens be associated with the user github account?mislav commentedon Aug 16, 2021
@fab4100 There are roughly 3 kinds of authentication tokens on GitHub: Personal Access Token (PAT), OAuth token, and GitHub Apps token.
If you are looking here https://github.com/settings/tokens, only your PATs are listed. However,
gh auth loginweb flow mode does not create a PAT. Instead, it creates an OAuth token linked to theGitHub CLIOAuth app. This token has no expiration, but you can invalidate any OAuth token here: https://github.com/settings/applicationstekumara commentedon Aug 17, 2021
@mislav is there a way to revoke specific device OAuth tokens, or can you only revoke all device tokens?
mislav commentedon Aug 17, 2021
@tekumara There is no way to revoke specific devices; you can only revoke the app as a whole, which invalidates tokens on all devices where you've authorized that app.
rf-triegel commentedon Oct 26, 2021
@mislav It would be nice if
gh auth loginwould have an option to create tokens with a user-provided expiration date (or duration), and ideally also have an option to set a default for this expiration duration.judahrand commentedon Dec 10, 2021
I agree, it would be great to have something that behaves like
gcloud auth application-default loginbut forghHas there been any progress internally @mislav?
mislav commentedon Dec 10, 2021
Yes, it's an area we're actively looking at according to this roadmap item: github/roadmap#184
However, I'm not able to share more detailed progress updates until we have something more to announce publicly. We will for sure update this thread 👍
aslilac commentedon Jan 4, 2022
This would be incredibly nice to have for publishing Docker images to ghcr 👀 needing to go into the settings to regenerate every couple months is a little tiring
Joelsamijon commentedon Jan 4, 2022
mislav commentedon Sep 21, 2022
Closing this in favor of an earlier related issue: #2531
We still plan to do this, but we are a way off still. We might need to first convert our OAuth app to a "GitHub App" before we can improve the user experience of minting tokens with specific privileges and expiration.
@aslilac For authenticating Docker, see this workaround: #5150 (comment)