Keyring v3

[samcoe]

Previously, upon completing gh auth login, GitHub CLI was storing the GitHub API authentication token in its ~/.config/gh/hosts.yml file:

github.com:
    user: mislav
    oauth_token: <REDACTED>
    git_protocol: https

This introduces a change where the token can now be stored in the system keyring (encrypted storage) instead:

• Keychain on macOS
• GNOME Keyring on Linux (Secret Service dbus interface)
• Wincred on Windows

We have chosen the zalando/go-keyring library for this because it's pure Go, i.e. does not require cgo to be enabled. Currently we disable cgo in our precompiled binaries to increase portability.

If none of the storage providers were found, or the store operation failed, the token will be written to the config file as before to ensure as little disruption to our users as possible should something go wrong with the new approach.

After this change, after completing gh auth login --secure-storage or gh auth refresh --secure-storage, the config file will look like this:

github.com:
    user: mislav
    git_protocol: https

Note the omission of the oauth_token key. Instead, the key is saved in encrypted storage. Note that depending on the OS and circumstances, gh communicating with encrypted store might spawn a system dialog to approve access. The recommended setting is to “always allow”.

Those who use environment variables (e.g. GH_TOKEN) to authenticate gh will not be affected, as in the case of environment variables, the token is neither read nor stored in the config file.

⚠️ This feature is currently opt-in using the --secure-storage flag but the intention is that this will be the default and only option in the near future. The reason for this intermediate step is to decrease the risk to extensions which is outlined below.

⚠️ This feature has an obvious benefit (more secure token storage), but a big downside: all Go extensions that were relying on API clients from go-gh to make API requests will be broken until they bump the go-gh version and make a new release. This is because the go-gh library often used in Go extensions reads directly from YAML config files, and after users have migrated to encrypted storage, the oauth_token key will not be found anymore.

Supersedes: #7023
Depends on: #7033
Fixes #449

[samcoe]

This is an unrelated change but was giving a diagnostics lint warning that we were using req in the function call to forwardStream. Using the loop iteration variable in function calls like that is a common source of Go bugs.

[vilmibm]

thanks for taking this work over 🙏