fix(core): never send a Mergify user token to GitHub

[sileht]

MERGIFY_TOKEN is the natural place to put the credential
mergify auth login mints, and stack reads that same variable for its
GitHub calls. A user who exports one would get 401 Bad credentials from
api.github.com, which says nothing about why.

Skip it there. The cost is nothing: mut_ is Mergify's prefix,
registered with GitHub's own secret scanning, so a value carrying it was
never going to authenticate against GitHub. stack falls through to
GITHUB_TOKEN or gh auth token as it would have if the variable were
unset.

gh auth token needs the same check, and not only because somebody
could have logged gh in with the wrong string: it prints
$GITHUB_TOKEN when that variable is set, so skipping the variable
does not, on its own, keep its value out of the request -- the
fallback hands the same token straight back. That is the GitHub
Actions case, where GITHUB_TOKEN is exported for you. So the check
is on the value, wherever it came from.

The failure says so, and names the variable it actually skipped.
Telling someone to set MERGIFY_TOKEN when they have set it, and it
was skipped for a reason visible only at -vv, is the worst version
of this message -- and GITHUB_TOKEN can carry a mut_ value too,
since it is the variable GitHub Actions already exports and therefore
at least as likely a place to paste an auth login token. There the
old wording named MERGIFY_TOKEN, which is unset, and prescribed
GITHUB_TOKEN, which is the broken one. Where gh is one of the
sources skipped it is installed and authenticated already, so the
message asks for a login to a GitHub account rather than an install.

An explicit --token is not second-guessed. The user aimed it at this
command, and quietly using a different credential instead would be the
more surprising failure of the two.

This is a failure mode the rest of this stack creates -- there was no
reason to hold a mut_ token before it -- which is why it lands here
rather than as a separate ticket.

Fixes MRGFY-8703

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[sileht]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	fix(core): never send a Mergify user token to GitHub	#1808	👈
2	docs(core): give key_for the reason that still holds	#1823

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=ci-gate

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by>=2
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	56c3bb4		2026-09-04 23:40 UTC
2	rebase	56c3bb4 → e5c6417 (rebase only)		2026-09-04 23:40 UTC
3	content	e5c6417 → 8674722		2026-09-08 14:57 UTC
4	rebase	8674722 → 7f19c7b (rebase only)		2026-09-09 06:32 UTC
5	rebase	7f19c7b → d255dfd (rebase only)		2026-09-09 08:33 UTC
6	rebase	d255dfd → 834552e (rebase only)		2026-09-09 19:27 UTC
7	rebase	834552e → a87db99 (rebase only)		2026-09-10 12:39 UTC
8	rebase	a87db99 → 5ca96d3 (rebase only)		2026-09-11 13:04 UTC
9	content	5ca96d3 → b93aca3		2026-09-11 13:37 UTC

[mergify]

@sileht this pull request is now in conflict 😩

[Copilot]

🟡 Changes recommended

The gh auth token fallback can still send a mut_ credential, and related documentation is incomplete.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates GitHub token resolution to avoid sending Mergify mut_ tokens and improves diagnostics, tests, and documentation.

Changes:

• Filters Mergify tokens from environment credentials.
• Adds clearer failure diagnostics and regression tests.
• Documents the token-handling behavior.

File summaries

File	Summary
README.md	Documents token filtering, but does not cover both environment variables.
crates/mergify-core/src/auth.rs	Filters environment tokens and adds tests; the gh auth token fallback and resolver documentation still need updates.

Review details

Suppressed comments (1)

crates/mergify-core/src/auth.rs:253

• This changes the resolver contract, but the module-level //! documentation still describes resolve_github_token as exactly the unfiltered --token → MERGIFY_TOKEN → GITHUB_TOKEN → gh auth token chain and says nothing is new. Update that contract documentation to mention that non-explicit mut_ environment credentials are skipped (and the gh fallback if the preceding issue is fixed), so the public resolver docs do not contradict this behavior.

    // Which variables were skipped, in the order they were tried, so
    // the failure below can name them. Both can carry a `mut_`
    // value: somebody who pastes their `auth login` token into
    // `GITHUB_TOKEN` — the variable GitHub Actions already exports —
    // gets the same skip.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-11 13:58 UTC · Rule: default · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-09-11 13:58 UTC · at e1f1c113fca8c196d19d32857a5328d459058613 · squash

This pull request spent 13 seconds in the queue, including 1 second running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub branch protection]
  • fix(core): never send a Mergify user token to GitHub #1808
• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • fix(core): never send a Mergify user token to GitHub #1808
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • fix(core): never send a Mergify user token to GitHub #1808
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by>=2
      • fix(core): never send a Mergify user token to GitHub #1808
    • author = dependabot[bot]
      • fix(core): never send a Mergify user token to GitHub #1808
    • author = mergify-ci-bot
      • fix(core): never send a Mergify user token to GitHub #1808
    • author = renovate[bot]
      • fix(core): never send a Mergify user token to GitHub #1808
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • fix(core): never send a Mergify user token to GitHub #1808
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • fix(core): never send a Mergify user token to GitHub #1808
  • #review-requested = 0
    • fix(core): never send a Mergify user token to GitHub #1808
  • #review-threads-unresolved = 0
    • fix(core): never send a Mergify user token to GitHub #1808
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success=ci-gate