Skip to content

fix: preserve token env when switching gh account - #11

Merged
kostua16 merged 2 commits into
mainfrom
codex/address-pr8-review
Jul 3, 2026
Merged

fix: preserve token env when switching gh account#11
kostua16 merged 2 commits into
mainfrom
codex/address-pr8-review

Conversation

@kostua16

@kostua16 kostua16 commented Jul 3, 2026

Copy link
Copy Markdown
Owner

fix: preserve token env when switching gh account

Root cause: PR #8 scoped the auth-status workaround too broadly and changed the switch-account contract by clearing token environment variables. That made non-switch auth ignore valid GH_TOKEN/GITHUB_TOKEN state and removed GH_TOKEN for downstream consumers.

Steps to reproduce: run setup-gh with switch-account true and an env GH_TOKEN that makes gh auth status prefer the env token over the freshly written GH_CONFIG_DIR auth. The action must report auth from the stored config without dropping the GH_TOKEN export.

Impact: restores backwards compatibility for GH_TOKEN consumers, avoids clobbering GITHUB_TOKEN/GITHUB_ENTERPRISE_TOKEN, and keeps the original self-hosted runner auth-status fix.

Validation:

  • npm run build
  • ./node_modules/.bin/tsc --noEmit
  • actionlint .github/workflows/test-action.yml
  • local fake-gh smoke covering non-switch env auth plus switch-account env-token shadowing

References:

Comment thread src/main.ts Outdated
core.exportVariable("GH_CONFIG_DIR", ghConfigDir);
await loginWithToken(hostname, token);
clearGhTokenEnvForHost(hostname);
core.exportVariable("GH_TOKEN", token);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Exported env var is wrong for GitHub Enterprise Server hosts

The removed ghTokenEnvNamesForHost/clearGhTokenEnvForHost helpers deliberately distinguished hosts: GH_TOKEN/GITHUB_TOKEN for github.com and GH_ENTERPRISE_TOKEN/GITHUB_ENTERPRISE_TOKEN for enterprise hosts. The replacement unconditionally exports GH_TOKEN.

gh only consults GH_TOKEN for the default host (github.com). For a GHES host (when github-server-url points elsewhere), exporting GH_TOKEN does not authenticate downstream gh commands against that host — it needs GH_ENTERPRISE_TOKEN. So switch-account: true with an enterprise server leaves the token un-exported (the isolated config still works, but the env-based contract described in the new README/action description does not). Additionally, unlike the old code, an externally-set stale GITHUB_ENTERPRISE_TOKEN is no longer cleared, so it can shadow the freshly-written isolated config for enterprise hosts.

Consider exporting the host-appropriate variable (e.g. GH_ENTERPRISE_TOKEN for non-github.com hosts) so switch-account works for both github.com and GHES.

@kilo-code-bot

kilo-code-bot Bot commented Jul 3, 2026

Copy link
Copy Markdown

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)
  • .github/workflows/test-action.yml
  • README.md
  • action.yml
  • src/main.ts
Previous Review Summary (commit b7e8be3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b7e8be3)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 1
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
src/main.ts 229 switch-account exports only GH_TOKEN, ignoring GitHub Enterprise Server hosts that need GH_ENTERPRISE_TOKEN; stale enterprise env vars are also no longer cleared.
Files Reviewed (4 files)
  • .github/workflows/test-action.yml - 0 issues
  • README.md - 0 issues
  • action.yml - 0 issues
  • src/main.ts - 1 issue

Fix these issues in Kilo Cloud


Reviewed by glm-5.2-short · Input: 12K · Output: 3.7K · Cached: 118.1K

@kostua16
kostua16 merged commit 9cc5c00 into main Jul 3, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant