GitHub CLI 2.40.0

[github-actions[bot]]

Multiple Account Support

With the v2.40.0 release, multi-account support is introduced to gh for GitHub.com and GitHub Enterprise and it is only the beginning!

Thanks to @gabe565 for his efforts to support multi-account capabilities with gh-profile extension for this long requested feature! ❤️

This release focuses on several specific use cases:

• adding multiple accounts for GitHub.com and GitHub Enterprise with gh auth login
• switching manually between accounts for gh and git use with gh auth switch
• seeing multiple accounts with gh auth status
• logging out of accounts with gh auth logout

Future enhancements such as automatic account switching based on context and more git automatic git configuration will be planned based on community feedback.

For much more detail about the specific of multiple account support in this release as well as a discussion of the sharp edges, please see this doc.

What's changed

• Better codespaces error handling when the display name flag exceeds 48 characters by @mateusmarquezini in Added a new error handling when the display name flag exceeds 48 characters #8361
• Better error handling in auth status when there are connection issues by @tal66 in Add timeout error in gh auth status #8337
• Filtering run list results by commit sha by @nelsonchen304 in Actions: filter to workflow runs for a specific commit #8350
• More informative pr merge output when running interactively by @ffalor in print info about merge when interactive #8381
• Unification of doc mark-ups by @muzimuzhi in Unify doc mark-ups #8342
• Addition of progress indicator when installing an extension by @steiza in Add progress indicator when installing an extension #8411
• Support for multiple accounts on a single host by @williammartin in Support multiple accounts on a single host #8425

Other technical changes

• Enhance discussion triage workflow by @andyfeller in Enhance discussion triage workflow #8394
• Simplify triage workflow given GitHub Actions limitations on OSS pull requests by @andyfeller in Simplify triage workflow given GitHub Actions limitations on OSS pull requests #8412
• andyfeller/triage the final enhancements by @andyfeller in andyfeller/triage the final enhancements #8420
• Simplify git AddRemote to remove unused arg by @samcoe in Simplify git AddRemote to remove unused arg #8392

New Contributors

• @mateusmarquezini made their first contribution in Added a new error handling when the display name flag exceeds 48 characters #8361
• @tal66 made their first contribution in Add timeout error in gh auth status #8337
• @nelsonchen304 made their first contribution in Actions: filter to workflow runs for a specific commit #8350
• @steiza made their first contribution in Add progress indicator when installing an extension #8411

Full Changelog: v2.39.2...v2.40.0

---

This discussion was created from the release GitHub CLI 2.40.0.

[yermulnik]

Great long overdue feature! 🚀 Appreciate it! 👍🏻
Not a big deal, though a tiny formatting issue:

[williammartin]

Hey @yermulnik thanks for the feedback!

I'm not sure exactly what you're pointing out here? Is it that oauth_token appears in both places or that it's visually separated from the rest of the other similar key -> string value host level keys git_protocol and user?

[yermulnik]

@williammartin Oh, I got the point. That token that is right under hostname is the token of the active user (the first user in the list), whilst I was under impression that it is token of the second user in the list (inactive user). Apologies for the noise.
I'm wondering where gh stores second user's token if it is not in ~/.config/gh/hosts.yml — any clue? 🤔

[williammartin]

Yes, to preserve the forward compatibility of gh the backward compatibility of go-gh we left the host level configuration alone and when we switch user we make the token "active" by copying it in the config (if there is a token in there to copy).

Now, for quite a long time auth login has defaulted to using the secure storage, and you have to pass --insecure-storage if you really want the token to go into the hosts.yml file. So the token for your inactive user is in your system keyring.

You can see where tokens are coming from using gh auth status.

[yermulnik]

@williammartin Appreciate your prompt assistance. Now this all makes perfect sense to me. I indeed missed the storage location bit from gh auth status. Thanks a lot 👍🏻

[williammartin]

No problem, happy to help!

[electriquo]

would love to see a sub-command like gh auth whoami since gh auth status is structure-less (neither yaml, nor json, etc.). and forces one to install a yaml tool and look at ~/.config/gh/hosts.yml file such as

yq -r '."github.com".user' ~/.config/gh/hosts.yml

[williammartin]

Thanks for the feedback! Definitely something we'll consider.

Another possibility to avoid installing another tool (but at the expense of an http request) would be gh api /user --jq .login.

[yermulnik]

There's no need for yq: gh config get user -h github.com. Though, yeah, I'd agree something like gh auth whoami would be a good addition to auth set of commands.

There's also alias capability that I use to "automate" various daily usage, e.g.:

> fgrep whoami ~/.config/gh/config.yml
    whoami: api user --jq '"\(.login) (\(.name))"'
    whoami-gh-config: config get user -h github.com

[electriquo]

this is another way to do it. yet, it should be part of gh auth, gh wraps github api for convince of the cli. otherwise, one would issue a curl command to repos end-point to create a repo without the need for gh repo ;)

[williammartin]

gh config get user -h github.com that's a good one @yermulnik !

Note that in some very old versions of the CLI this was not set, and in some more recent but pre 2.40.0 release, if you logged in using --with-token the user would be set to x-access-token in the config, so it may not be totally accurate in some edge cases.

[EdenEast]

Would like to have some way to automatically set it based on some mechanism (includeIf "gitdir:....", remote hostname, git username). For now if people have multiple accounts based on remote's hostname I have an alias I can call to set it to the correct user.

[alias]
    # Returns the hostname of the remote
    remote-hostname = "!f() { git ls-remote --get-url ${1:-origin} | sed -E 's#(https://|git@)([^/:]+).*#\\2#' ; } ; f"

     # Switch to the correct user based on the remote's hostname
     gh-switch = "!f() { gh auth switch --hostname $(git remote-hostname ${1:-origin}); } ; f"

If others have more interesting ways would like to know.

[liangshihlin-leapin]

I think gh auth switch only works with SSH, when authenticated with HTTPS it doesn't switch even though it states that it is Active

[symbolicsorcerer]

As an example, if I run gh auth login again and choose the proper account, I am now able to execute pull for my current repo.

[williammartin]

Have you run gh auth setup-git?

#8678 for more reading.

[williammartin]

If that doesn't resolve your problem please create an issue describing what's going on so we can track it properly.

[giulianisanches]

I'm facing something similar here. Below the output of gh auth status:

❯ gh auth status
github.ghes.domain
  ✓ Logged in to github.ghes.domain account ghesuser (keyring)
  - Active account: true
  - Git operations protocol: ssh
  - Token: gho_************************************
  - Token scopes: 'admin:public_key', 'gist', 'read:org', 'repo'

github.ghes.anotherdomain
  ✓ Logged in to github.ghes.anotherdomain account ghesuser (keyring)
  - Active account: true
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

github.com
  ✓ Logged in to github.com account giulianisanches (keyring)
  - Active account: true
  - Git operations protocol: ssh
  - Token: gho_************************************
  - Token scopes: 'admin:public_key', 'gist', 'read:org', 'repo'

As you can see all of my three accounts are active. I try to switch but it does not work as expected:

❯ gh api /user | jq .login
"giulianisanches"

❯ gh auth switch
? What account do you want to switch to? ghesuser (github.ghes.anotherdomain) - active
✓ Switched active account for github.ghes.anotherdomain to ghesuser

❯ gh api /user | jq .login
"giulianisanches"

❯

Looks like it's logged in github.com and don't switch to my GHES. The user ghesuser is the same for both of my GHES.

I have tried to logout from all accounts and log back in, using HTTPS protocol for all of them, but the behavior is the same. I can't use SSH for all of them because one of my GHES have disabled this option.

[williammartin]

@giulianisanches gh only targets one host per command invocation, and each host has an active account that is used when targeting that host. In your situation, to target a specific host other than github.com you need to set the GH_HOST environment variable. Actually I merged a PR this week to hopefully make this more obvious #9032

[ab]

Is there any way with the current setup to support multiple fine-grained personal access tokens? I have a single github.com account that is used both for personal projects and for a github.com enterprise with orgs that my personal-scoped PAT can't access.

So I have two tokens I want to switch between on the same account: one PAT for the enterprise org, and one for all my personal orgs. Is this supported in the current accounts setup?

I guess I can manage this myself with some automation around gh auth login --with-token, but it's pretty messy.