Skip to content

git-rg v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 10:56
· 3 commits to main since this release
v0.6.0
684eac7

git-rg v0.6.0

One token for reading and proposing changes. Remote writes remain off by default.

English

Single-token authentication

Search, refs, read, and propose --dry-run now fall back to GITRG_WRITE_TOKEN when no applicable read environment token is set. Agents can read a file, preview changes, and publish a draft PR/MR without configuring two tokens. This works with --auth auto, --auth env, GitHub, GitLab, and self-managed hosts.

Read credentials keep their priority:

  • GitHub.com: GITRG_TOKEN → GITHUB_TOKEN → GH_TOKEN → GITRG_WRITE_TOKEN.
  • GitLab.com: GITRG_TOKEN → GITLAB_TOKEN → GITRG_WRITE_TOKEN.
  • Self-managed hosts: GITRG_TOKEN → GITRG_WRITE_TOKEN.

With no applicable environment token, auto can reuse the matching gh/glab login; env continues anonymously. A rejected credential does not trigger a retry with another identity.

Upgrade behavior

This minor release changes credential selection when GITRG_WRITE_TOKEN is set without a read environment token: reads use that token before a CLI login. Set GITRG_TOKEN explicitly if you want a separate read identity. The token must have access to read the repository and its metadata; setting it does not grant additional platform permissions.

Publication still requires propose --enable-write and GITRG_WRITE_TOKEN. Read credentials are never substituted for publication credentials. Dry runs make only read requests, even alongside --enable-write. Exit codes, NDJSON schema v1, Agent identity parameters, and proposal conflict/recovery behavior are unchanged.

Validation and installation

OrbStack Linux arm64 validation passed full race tests, vet, and build. HTTP regression fixtures cover single-token GitHub/GitLab read/preview/publication flows, credential precedence, rejected credentials, and default-disabled writes. The release workflow validates all six native platform builds and installers, uses only GITRG_WRITE_TOKEN for live GitHub search/refs/read/preview checks, and retains anonymous public GitLab smoke checks. Live commit/PR/MR writes are not part of this release's smoke tests.

The release provides six archives (Linux/macOS/Windows, amd64/arm64), both installers, and checksums.txt. See Installation and Agent changes.

中文

单 token 认证

搜索、refs、read 和 propose --dry-run 在没有适用的读取环境变量时，会回退使用 GITRG_WRITE_TOKEN。Agent 只配置一个 token，即可读取文件、预览变更并发布草稿 PR/MR。此行为支持 --auth auto、--auth env、GitHub、GitLab 及自建实例。

已有读取凭证仍优先：

  • GitHub.com：GITRG_TOKEN → GITHUB_TOKEN → GH_TOKEN → GITRG_WRITE_TOKEN。
  • GitLab.com：GITRG_TOKEN → GITLAB_TOKEN → GITRG_WRITE_TOKEN。
  • 自建实例：GITRG_TOKEN → GITRG_WRITE_TOKEN。

没有适用的环境变量 token 时，auto 可复用对应 gh/glab 登录，env 则匿名继续。凭证被 API 拒绝后不会切换身份重试。

升级行为

本次 minor release 扩展了凭证选择规则：当配置 GITRG_WRITE_TOKEN 而未配置读取环境变量时，读取会先使用该 token，再考虑 CLI 登录。需要保留独立读取身份时，请显式配置 GITRG_TOKEN。token 本身必须具备读取目标仓库及元数据的权限；设置环境变量不会增加平台权限。

写入默认关闭，发布仍需 propose --enable-write 和 GITRG_WRITE_TOKEN，不会用读取凭证替代写入凭证。dry-run 即使同时传入 --enable-write 也只发出读取请求。退出码、NDJSON schema v1、Agent 身份参数及提案冲突检查/恢复行为保持兼容。

验证与安装

OrbStack Linux arm64 中通过全量 race 测试、vet 和构建。HTTP 模拟回归覆盖 GitHub/GitLab 单 token 读取、预览及发布流程、凭证优先级、认证失败和默认禁止写入。发布流程检查六个平台的原生构建和安装，仅配置 GITRG_WRITE_TOKEN 验证真实 GitHub 搜索、refs、读取和预览，并保留匿名 GitLab 公开仓库 smoke。本次 smoke 不执行真实 commit/PR/MR 写入。

发布包含 Linux/macOS/Windows 的 amd64/arm64 六个 archive、两个安装器和 checksums.txt。详见安装文档和Agent 变更文档。

完整变更记录 / Full changelog: v0.5.0...v0.6.0

Assets 11
Loading