fix: authenticate cross-repo git via gh, guard clone failures (readme-refresh) - #1067
Conversation
The first live run of readme-refresh failed to clone the target repos: fatal: could not read Username for 'https://github.com' GitHub's git-over-HTTPS rejects both the `x-access-token:<PAT>@` URL form and an `Authorization: Bearer <PAT>` extraHeader for a classic/fine-grained PAT, so git fell back to an interactive prompt and died. Because the clone failure was unguarded, the script continued and ran `git -C <dir> diff --cached` outside any repo (the `unknown option cached` / no-index noise), silently producing no PR. Fix: - Configure git's github.com credentials via `gh auth setup-git` (token-type agnostic; authenticates both the clone and the push through GH_TOKEN). - Clone with a plain https URL and GUARD it: on failure, warn and skip the repo instead of generating into an empty directory. Verified: shellcheck --severity=warning -x clean; isolated dry-run (throwaway GIT_CONFIG_GLOBAL) clones both repos, generates all four READMEs, and renders correct diff stats with no git errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAsu1rBxAkMnAqFZaWKV6t
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThe script's repo cloning logic was changed to remove inline Changesgh Auth Setup Migration
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Script as aw-readme-refresh.sh
participant GH as gh CLI
participant Git as git clone
Script->>Script: isolate GIT_CONFIG_GLOBAL to temp file
Script->>GH: gh auth setup-git --hostname github.com
GH-->>Script: success or failure (warn)
Script->>Git: git clone (GIT_TERMINAL_PROMPT=0)
Git-->>Script: clone result
alt clone fails or .git missing
Script->>Script: warn and skip repo
else clone succeeds
Script->>Script: proceed with repo processing
end
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates scripts/aw-readme-refresh.sh to route GitHub credentials through gh auth setup-git instead of using an explicit authorization header during git clone. It also adds a guard to skip a repository if the clone fails. The review feedback points out that returning 0 on clone failure masks the error from the caller, which expects a non-zero exit status to log the failure, and suggests returning 1 instead.
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-03T22:28:19Z. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR fixes authentication and failure-handling for the readme-refresh automation by switching cross-repo git auth to gh auth setup-git (token-type-agnostic) and guarding clone failures so the script doesn’t proceed in a non-repo directory.
Changes:
- Replace git-over-HTTPS
Authorization: Bearer ...header cloning with plainhttps://cloning authenticated viagh’s git credential helper. - Guard
git clonefailures and skip the affected repo instead of continuing and producing misleading git errors.
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Superseded by automated re-review at
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1067 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 1666fc8eeb35b77e3cd0a9d18c165daf1dac42b4
Review mode: triage-approved (single reviewer)
Summary
Fixes the readme-refresh cross-repo clone failure by routing git credentials through gh auth setup-git (token-type-agnostic) instead of an http.extraHeader Bearer token, and guards the clone (GIT_TERMINAL_PROMPT=0, warn + skip on failure) so it fails fast instead of silently generating into an empty directory. This is a re-review after the prior fix-requested review at 5f70311: the single follow-up commit (+7/-1) resolves both prior findings — (1) GIT_TERMINAL_PROMPT=0 now prefixes the clone so an ineffective credential helper fails fast rather than falling back to the interactive prompt that caused the original incident, and (2) gh auth setup-git config writes are isolated to a throwaway GIT_CONFIG_GLOBAL temp file when unset, so local runs no longer mutate ~/.gitconfig. No new issues introduced.
Linked issue analysis
No linked issues (closingIssuesReferences is empty). The PR addresses a concrete failure in the first live readme-refresh run (actions run 28683616091: fatal: could not read Username for 'https://github.com'). The root-cause analysis in the PR body is sound, the fix matches it, and verification (clean shellcheck, isolated local dry-run) is documented.
Findings
Prior findings — all resolved:
[Copilot] Prefix clone with— resolved inGIT_TERMINAL_PROMPT=0to fail fast if the credential helper is ineffective1666fc8(line 211); thread resolved.[Copilot]— resolved ingh auth setup-gitmutates the developer's~/.gitconfigon local runs1666fc8: script now exports amktemp-backedGIT_CONFIG_GLOBALwhen unset (CI already sets its own); thread resolved.[gemini-code-assist] Unguarded clone masked failure— resolved earlier in5f70311; thread resolved.
New issues: none. All three review threads are resolved (and outdated by the fix commits).
Other notes (non-blocking):
- Secret scan:
run_secret_scanningMCP tool unavailable in this environment; CI gitleaks check passed. The diff introduces no credentials — it removes an embedded token header from thegit clonecommand line (credential-hygiene improvement). - shellcheck of the full script at head SHA
1666fc8: clean (--severity=warning -x).
CI status
All checks green at head SHA 1666fc8: Lint, ShellCheck (×3), bats, unit-tests, gh-aw-compile, Compile agentic workflows, template-drift, validate-agent-profiles, AW spec/docs validation, issue-triage tests, Agent Security Scan, AgentShield, Secret scan (gitleaks), CodeQL (actions + python), SonarCloud, CodeRabbit, holdout-guard, guard — success. Dependency-audit sub-jobs skipped (no matching ecosystems). The only cancelled entries are superseded review-agent trigger jobs from earlier pushes. Branch is BEHIND main but MERGEABLE.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/aw-readme-refresh.sh`:
- Around line 362-364: The current `gh auth setup-git` handling in the
auth/bootstrap flow only warns and continues, which hides a global credential
problem. In the `aw-readme-refresh.sh` logic around the `gh auth setup-git`
check, change it to abort immediately on failure instead of calling `warn`, so
the script fails fast and surfaces the broken auth setup before later clone/push
operations run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7ecd9165-7460-40a4-83bb-b8a3335c8dc3
📒 Files selected for processing (1)
scripts/aw-readme-refresh.sh
| if ! gh auth setup-git --hostname github.com >/dev/null 2>&1; then | ||
| warn "gh auth setup-git failed — cross-repo git push may not authenticate" | ||
| fi |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- scripts/aw-readme-refresh.sh (around lines 330-390) ---\n'
sed -n '330,390p' scripts/aw-readme-refresh.sh | cat -n
printf '\n--- search for setup-git usage and auth-related handling ---\n'
rg -n "setup-git|GIT_TERMINAL_PROMPT|auth setup|warn .*authenticate|cross-repo git" scripts/aw-readme-refresh.sh .github -SRepository: petry-projects/.github-private
Length of output: 259
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- scripts/aw-readme-refresh.sh outline ---\n'
ast-grep outline scripts/aw-readme-refresh.sh --view expanded
printf '\n--- nearby logic for repo refresh / clone / push ---\n'
rg -n "clone|push|pull|fetch|gh auth setup-git|GIT_TERMINAL_PROMPT|token|GITHUB_TOKEN|gh repo" scripts/aw-readme-refresh.sh -n -SRepository: petry-projects/.github-private
Length of output: 259
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Show the relevant section and any surrounding auth/setup logic.
sed -n '340,380p' scripts/aw-readme-refresh.sh | cat -n
printf '\n'
rg -n "setup-git|GIT_TERMINAL_PROMPT|clone|push|warn " scripts/aw-readme-refresh.sh -SRepository: petry-projects/.github-private
Length of output: 3189
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
sed -n '190,320p' scripts/aw-readme-refresh.sh | cat -nRepository: petry-projects/.github-private
Length of output: 6615
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n "gh auth setup-git|credential helper|GIT_TERMINAL_PROMPT|clone failed|push --force-with-lease" scripts/aw-readme-refresh.sh -n -SRepository: petry-projects/.github-private
Length of output: 679
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Inspect the repo-processing path and auth-related comments around clone/push.
sed -n '200,315p' scripts/aw-readme-refresh.sh | cat -nRepository: petry-projects/.github-private
Length of output: 5795
Fail fast if gh auth setup-git fails.
With GIT_TERMINAL_PROMPT=0, this turns a global auth problem into repo-by-repo clone/push skips; aborting here surfaces the broken credential setup immediately.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/aw-readme-refresh.sh` around lines 362 - 364, The current `gh auth
setup-git` handling in the auth/bootstrap flow only warns and continues, which
hides a global credential problem. In the `aw-readme-refresh.sh` logic around
the `gh auth setup-git` check, change it to abort immediately on failure instead
of calling `warn`, so the script fails fast and surfaces the broken auth setup
before later clone/push operations run.
Source: Coding guidelines
Summary
Fixes the first live
readme-refreshrun (triggered post-merge of #1062), which failed to clone the target repos:Root cause
GitHub's git-over-HTTPS rejects both the
https://x-access-token:<PAT>@…URL form and anAuthorization: Bearer <PAT>extraHeader when the credential is a classic/fine-grained PAT (DON_PETRY_BOT_GH_PAT) rather than a GitHub App / Actions token. Git then fell back to an interactive username prompt and died. Because the clone was unguarded, the script kept going and rangit -C <dir> diff --cachedoutside any repository — producing theerror: unknown option 'cached'/git diff --no-indexnoise seen in run 28683616091 — and silently opened no PR while still exiting 0.Fix
github.comcredentials throughgh auth setup-git(usesGH_TOKEN; token-type-agnostic — authenticates both the clone and the push).https://URL and guard it: on failure,warnand skip that repo instead of generating into an empty directory.Verification
shellcheck --severity=warning -x— clean.GIT_CONFIG_GLOBALso the real gitconfig is untouched): clones both repos, generates all four READMEs, and renders correct diff stats (README.md | 34 +++,profile/README.md | 4 +++-) with no git errors.After merge
Re-run the dry run to confirm the clone/auth path is green end-to-end in CI:
🤖 Generated with Claude Code
https://claude.ai/code/session_01VAsu1rBxAkMnAqFZaWKV6t
Summary by CodeRabbit