Repository navigation
feat(gh auth login): hint at --expiring when no preference is set - #14798
Merged
Merged
Conversation
Print a one line hint on stderr pointing users to --expiring and the changelog post (https://gh.io/gh-expiring-tokens). The hint only shows when stderr is a TTY, neither --expiring nor expiring_credentials is set, and the host is not GitHub Enterprise Server. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ac178b5a-5b62-49bd-9e83-4796c7ddec46
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The hint can appear during non-interactive logins when stderr remains attached to a terminal, violating the stated output compatibility guarantee.
1 open issue
What changed in this PR
This PR makes expiring OAuth credentials easier to discover by adding a --expiring hint to the existing authentication flow.
Changes:
- Adds a stderr hint with a link to more information.
- Suppresses the hint for explicit flag choices, enabled configuration, and Enterprise Server hosts.
- Adds table-driven tests for hint visibility.
Contribution eligibility remains unverified and needs clarification from @cli/code-reviewers.
| File | Description |
|---|---|
pkg/cmd/auth/login/login.go |
Adds the conditional expiring-token hint before login. |
pkg/cmd/auth/login/login_test.go |
Tests visibility based on terminal state, preference, and host. |
Review effort: Balanced
BagToad
approved these changes
Oct 23, 2026
This was referenced Oct 23, 2026
Merged
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
gh auth loginsupports requesting expiring, auto-refreshing OAuth tokens with--expiring(or theexpiring_credentialsconfig), but it is strictly opt-in, so users who have not read the changelog have no way of discovering it from the login flow itself.This adds a one-line hint to the login output pointing at the flag and the changelog post:
The hint is printed on stderr only when all of the following hold:
--expiringwas not passed (including--expiring=false, which is an explicit choice) andexpiring_credentialsis not enabled for the host.--with-tokenor environment-variable login; both of those paths return before the hint.How did you test this change?
I built
ghfrom this branch and rangh auth loginin a terminal againstgithub.com, a*.ghe.comhost, and an unknown (Enterprise Server style) host, each with theexpiring_credentialsconfig both enabled and unset, and with and without the--expiring/--expiring=falseflags. I saw:github.comor*.ghe.com, no flag, config unsetgithub.comor*.ghe.com, no flag, config enabledgithub.comor*.ghe.com,--expiringgithub.comor*.ghe.com,--expiring=falseKey points
gh auth loginis run rarely per user, so tracking whether the hint was already shown in the state directory is not worth the extra state.--hostname, the hint appears after the host selection prompt, because it needs the hostname to skip Enterprise Server hosts and to read the per-host config. With--hostnameor--webit is the first line of output.Notes for reviewers
The change is the block right before
shared.Logininpkg/cmd/auth/login/login.go; the test isTest_loginRun_expiringHintinlogin_test.go.Authorship and follow-up
Who wrote this:
Who answers review comments: