gh-grep will encounter an error if only authentication credentials for GitHub Enterprise Server are available. This is a problem when using GitHub Actions with GitHub Enterprise Server.

I'll describe how to reproduce the issue below.

# authorized my-github.example.com

$ gh auth status
<my-github.example.com>
  ✓ Logged in to <my-github.example.com> as <my-user> (GH_ENTERPRISE_TOKEN)
  ✓ Git operations for <my-github.example.com> configured to use https protocol.
  ✓ Token: ghp_************************************
  ✓ Token scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:pre_receive_hook, admin:public_key, admin:repo_hook, admin:ssh_signing_key, audit_log, delete:packages, delete_repo, gist, notifications, project, repo, user, workflow, write:discussion, write:packages


# run gh grep

$ gh grep --owner me test
non-200 OK status code: 401 Unauthorized body: "{\"message\":\"This endpoint requires you to be authenticated.\",\"documentation_url\":\"https://docs.github.com/graphql/guides/forming-calls-with-graphql#authenticating-with-graphql\"}"
no assets match the file pattern


# other sub commands are avaiable

$ gh repo view 'myuser/myrepo' # => ok
$ gh api graphql -f query="query { viewer { email } }" # => ok

After sign-in github.com, gh grep will work for GitHub Enterprise Server.

ref: #29

if GH_HOST is set to anything other than github.com, gh grep cannot be executed. Because it cannot retrieve the tag, as it is now set to retrieve the tag using gh-cli.

Specifically, the tag becomes an empty string, and the string for the exe becomes like gh-grep__linux_amd64. It can be reproduced with the following command.

GH_HOST=<your-github.example.com> gh grep help

Background

Repo github.com/k1LoW/gh-grep depends on github.com/k1LoW/go-github-client/[email protected].

https://github.com/k1LoW/gh-grep/blob/main/go.mod#L11

However, comparing version v39.2.2 of github.com/k1LoW/go-github-client from proxy.golang.org and github, there are inconsistencies.

commit time of the copy on github.com

"committer": {
      "name": "k1LoW",
      "email": "[email protected]",
      "date": "2022-01-31T12:31:21Z"
    }

commit time of the copy on proxy.golang.org

{"Version":"v39.2.2","Time":"2021-11-08T07:14:18Z"}

So the checksum from the code in github does not match the checksum saved in sum.golang.org. The v39.2.2 tag of github.com/k1LoW/go-github-client might have been retagged after a minor edition on github. I guess you use proxy.golang.org to get dependencies, but that also shows that your project is depending on the copy of github.com/k1LoW/[email protected] before its edition. Depending upon such inconsistent tag version may also result in some unexpected errors as well as build errors due to different proxy settings.

For example, when someone who does not use proxy.golang.org, say GOPROXY=direct, attempts to get github.com/k1LoW/go-github-client/[email protected], the following error occurs.

go: downloading github.com/k1LoW/go-github-client/v39 v39.2.2
go: github.com/k1LoW/go-github-client/v39@v39.2.2: verifying module: checksum mismatch
        downloaded: h1:MykkzFe7dTBOWOTPfiw1gvbcRbBD0SVN1KtYWFPyftg=
        sum.golang.org: h1:BML9eBIvMnlM+u2awm8hugeaT//dd8ilR3sM5i/FzG8=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

So, this is a reminder in the hope that you can get rid of this problematic version of project github.com/k1LoW/go-github-client.

Solution

1. Bump the version of dependency github.com/k1LoW/go-github-client

I would recommend bumping the version of github.com/k1LoW/go-github-client to a new release to ensure dependency copy in proxy.golang.org and github in sync.

References

• https://proxy.golang.org/

Token storage change in latest release of gh

This is a message from the GitHub CLI team, maintainers of gh, writing to inform you that the most recent release of gh contains changes which may affect your extension. The latest release introduces the feature of storing authentication tokens in the system keyring (encrypted storage) instead of in a plain text file.
The keyrings that are supported are:

• Keychain on macOS

• GNOME Keyring on Linux (Secret Service dbus interface)

• Wincred on Windows

This has huge security benefits for the users of our tool and was one of our oldest outstanding issues. Unfortunately this change has the potential to break extensions that rely on utilizing the users authentication token to work.

In order to have continued compatibility with gh there are some actions you, as an extension author, need to take. These actions will depend on the implementation of your extension.

Extensions built in Go using go-gh:

1. Upgrade your go-gh version to v1.2.1, the latest version.

   • This can be done using go get github.com/cli/[email protected]

2. Verify that in your extension retrieval of the user authentication token is done using the auth.TokenForHost function.

   • If you were previously accessing the authentication token using any other method it will no longer work.
   • Automatic resolution of the authentication token when using the API clients will continue to work without changes.

All other extensions:

1. Verify that in your extension retrieval of the user authentication token is done by shelling out to the gh auth token command.

   • If you were previously accessing the authentication token using the gh config get command, reading the configuration file directly, or any other methods it will no longer work.

As of right now storing the authentication token in the system keyring is an opt-in feature, but in the near future it will be required and at that point if the changes above are not made then your extension will be broken for all users. If you have any questions/concerns about this change please feel free to open a discussion in the gh repo.

Thanks,
The GitHub CLI Team

In my environment gh grep throws an error "Error: env GITHUB_TOKEN is not set".
Other built-in commands from gh (like gh repo) work without any error.

$ gh version
gh version 2.2.0 (2021-10-25)

$ gh auth status

github.com
  ✓ Logged in to github.com as lacolaco (***)
  ✓ Git operations for github.com configured to use https protocol.
  ✓ Token: *******************

I've just executed gh extension command for installation. Are there any additional steps?

Excellent tool! Thank you.

I've got Error: bufio.Scanner: token too long when searching a simple phrase for a very 1st hello world try.

I have no knowledge about go language, but it looks like people recommend bufio.Reader.ReadLine instead of bufio.NewScanner

https://stackoverflow.com/questions/21124327/how-to-read-a-text-file-line-by-line-in-go-when-some-lines-are-long-enough-to-ca