fix: preserve token env when switching gh account - #11
Conversation
| core.exportVariable("GH_CONFIG_DIR", ghConfigDir); | ||
| await loginWithToken(hostname, token); | ||
| clearGhTokenEnvForHost(hostname); | ||
| core.exportVariable("GH_TOKEN", token); |
There was a problem hiding this comment.
WARNING: Exported env var is wrong for GitHub Enterprise Server hosts
The removed ghTokenEnvNamesForHost/clearGhTokenEnvForHost helpers deliberately distinguished hosts: GH_TOKEN/GITHUB_TOKEN for github.com and GH_ENTERPRISE_TOKEN/GITHUB_ENTERPRISE_TOKEN for enterprise hosts. The replacement unconditionally exports GH_TOKEN.
gh only consults GH_TOKEN for the default host (github.com). For a GHES host (when github-server-url points elsewhere), exporting GH_TOKEN does not authenticate downstream gh commands against that host — it needs GH_ENTERPRISE_TOKEN. So switch-account: true with an enterprise server leaves the token un-exported (the isolated config still works, but the env-based contract described in the new README/action description does not). Additionally, unlike the old code, an externally-set stale GITHUB_ENTERPRISE_TOKEN is no longer cleared, so it can shadow the freshly-written isolated config for enterprise hosts.
Consider exporting the host-appropriate variable (e.g. GH_ENTERPRISE_TOKEN for non-github.com hosts) so switch-account works for both github.com and GHES.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous Review Summary (commit b7e8be3)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit b7e8be3)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Reviewed by glm-5.2-short · Input: 12K · Output: 3.7K · Cached: 118.1K |
fix: preserve token env when switching gh account
Root cause: PR #8 scoped the auth-status workaround too broadly and changed the switch-account contract by clearing token environment variables. That made non-switch auth ignore valid GH_TOKEN/GITHUB_TOKEN state and removed GH_TOKEN for downstream consumers.
Steps to reproduce: run setup-gh with switch-account true and an env GH_TOKEN that makes gh auth status prefer the env token over the freshly written GH_CONFIG_DIR auth. The action must report auth from the stored config without dropping the GH_TOKEN export.
Impact: restores backwards compatibility for GH_TOKEN consumers, avoids clobbering GITHUB_TOKEN/GITHUB_ENTERPRISE_TOKEN, and keeps the original self-hosted runner auth-status fix.
Validation:
References: