gh repo sync demands upstream SAML enforcement

[damieng]

Describe the bug

I have a personal fork of a repo with no SAML requirements. The upstream public repo has SAML requirements.

Using the GitHub web interface I can hit the "sync fork" button on my personal fork and it will work even though this machine has no ability to meet the SAML requirements. This makes sense, it requires no non-public permissions to the upstream to achieve a sync.

However running gh repo sync my-repo-name on this machine brings up:

GraphQL: Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization. (repository.parent)

Which then requires a authorization in my browser (which I can not do as this machine does not and can not have the required software installed on it)

Affected version

2.70.0

Steps to reproduce the behavior

1. Fork a public repo that requires SAML permissions to operate on
2. Attempt to run gh repo sync <myfork>
3. Observe error/superfluous auth request
4. (Optional) observe that the web UI does not have this problem

Expected vs actual behavior

I expect the sync operation to complete without the GraphQL SAML enforcement.

Logs

Paste the activity from your command line. Redact if needed.

* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token <redacted>
> Content-Length: 530
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.70.0

GraphQL query:
fragment repo on Repository {
    id
    name
    owner { login }
    hasIssuesEnabled
    description
    hasWikiEnabled
    viewerPermission
    defaultBranchRef {
      name
    }
  }

  query RepositoryInfo($owner: String!, $name: String!) {
    repository(owner: $owner, name: $name) {
      ...repo
      parent {
        ...repo
      }
      mergeCommitAllowed
      rebaseMergeAllowed
      squashMergeAllowed
    }
  }
GraphQL variables: {"name":"<redacted>","owner":"damieng"}

⢿< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Mon, 19 May 2025 16:11:59 GMT
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: github.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Accepted-Oauth-Scopes: repo
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.v4; param=merge-info-preview.nebula-preview; format=json
<redacted headers>

{
  "data": {
    "repository": {
      "id": "<redacted>",
      "name": "<redacted>",
      "owner": {
        "login": "damieng"
      },
      "hasIssuesEnabled": false,
      "description": "<redacted>",
      "hasWikiEnabled": false,
      "viewerPermission": "ADMIN",
      "defaultBranchRef": {
        "name": "main"
      },
      "parent": null,
      "mergeCommitAllowed": true,
      "rebaseMergeAllowed": true,
      "squashMergeAllowed": true
    }
  },
  "errors": [
    {
      "type": "FORBIDDEN",
      "path": [
        "repository",
        "parent"
      ],
      "extensions": {
        "saml_failure": true
      },
      "locations": [
        {
          "line": 18,
          "column": 4
        }
      ],
      "message": "Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization."
    }
  ]
}

* Request took 443.4428ms
GraphQL: Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization. (repository.parent)
Authorize in your web browser:  https://github.com/enterprises/<redacted>/sso?authorization_request=<redacted>

[andyfeller]

Thank you for raising this concern, @damieng! 🙇 I'd like to ask some questions and share some thoughts to figure out what is doable.

Questions

1. Are you using the GitHub CLI OAuth app for authentication?

2. If using OAuth app, do you have the ability to authorize the upstream for use?

Thoughts

Using the GitHub web interface I can hit the "sync fork" button on my personal fork and it will work even though this machine has no ability to meet the SAML requirements. This makes sense, it requires no non-public permissions to the upstream to achieve a sync.

The web experience has a simpler experience than gh repo sync because it is not leveraging the same public APIs that integrations like gh use and there are different security boundaries in place. Simply put, PATs and Apps need you the user to authoriz them for use with SAML protected orgs.

I'm curious if you have the ability to authorize the GitHub CLI OAuth app to interact with the upstream owner within the web UI.

[damieng]

I can not authorise this machine for the upstream SAML requirements. There are both technical restrictions and non-technical policy rules as to why I can not.

It seems strange that people with zero upstream permissions at all can gh repo sync and that I too can do it in the web interface but that the CLI can not.

I had a play with the GitHub GraphQL explorer. It seems that you can't even request the name of a public repo without SAML enforcement happening. I guess the GraphQL team are being somewhat over-aggressive on that front.

I'll have to stick to the web UI.

[damieng]

Annoyingly the public REST API is more than happy to supply the same information without enforcement.

gh api \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  /repos/damieng/repo-in-question

{
   ...
   "parent": {
      "name": "...",
      "full_name": "...",
      "owner": { 
          ...
      },
   ...
}