docs(core): give key_for the reason that still holds - #1823
Merged
mergify[bot] merged 2 commits intoSep 11, 2026
Merged
Conversation
Member
Author
|
This pull request is part of a Mergify stack:
|
Contributor
Merge Protections🟢 All 7 merge protections satisfied — ready to merge. Show 7 satisfied protections🟢 ⛓️ Depends-On RequirementsRequirement based on the presence of
🟢 🤖 Continuous Integration
🟢 👀 Review Requirements
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 Reviews
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
sileht
marked this pull request as ready for review
September 10, 2026 15:30
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/never-send-mergify-user-token-github--f3c422ba
branch
from
September 11, 2026 13:04
a87db99 to
5ca96d3
Compare
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/give-key-reason-still-holds--bd81a3c5
branch
from
September 11, 2026 13:04
a251656 to
1af1f28
Compare
Member
Author
Revision history
|
sileht
had a problem deploying
to
func-tests-live
September 11, 2026 13:04 — with 
GitHub Actions
Error
GitHub Actions
Error
`MERGIFY_TOKEN` is the natural place to put the credential `mergify auth login` mints, and `stack` reads that same variable for its GitHub calls. A user who exports one would get `401 Bad credentials` from api.github.com, which says nothing about why. Skip it there. The cost is nothing: `mut_` is Mergify's prefix, registered with GitHub's own secret scanning, so a value carrying it was never going to authenticate against GitHub. `stack` falls through to `GITHUB_TOKEN` or `gh auth token` as it would have if the variable were unset. `gh auth token` needs the same check, and not only because somebody could have logged `gh` in with the wrong string: it prints `$GITHUB_TOKEN` when that variable is set, so skipping the variable does not, on its own, keep its value out of the request -- the fallback hands the same token straight back. That is the GitHub Actions case, where `GITHUB_TOKEN` is exported for you. So the check is on the value, wherever it came from. The failure says so, and names the variable it actually skipped. Telling someone to set `MERGIFY_TOKEN` when they have set it, and it was skipped for a reason visible only at `-vv`, is the worst version of this message -- and `GITHUB_TOKEN` can carry a `mut_` value too, since it is the variable GitHub Actions already exports and therefore at least as likely a place to paste an `auth login` token. There the old wording named `MERGIFY_TOKEN`, which is unset, and prescribed `GITHUB_TOKEN`, which is the broken one. Where `gh` is one of the sources skipped it is installed and authenticated already, so the message asks for a login to a GitHub account rather than an install. An explicit `--token` is not second-guessed. The user aimed it at this command, and quietly using a different credential instead would be the more surprising failure of the two. This is a failure mode the rest of this stack creates -- there was no reason to hold a `mut_` token before it -- which is why it lands here rather than as a separate ticket. Fixes MRGFY-8703 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: If3c422baf7dde5e912971015b991046ccbc886eb
`key_for` files `https://host/api` and `https://host/api/` under one entry, and its comment justified that by saying every request "replaces the base path outright". That stopped being true with #1819, which made `Client::join()` append a request path to the base's path prefix instead of replacing it, so GitHub Enterprise's `/api/v3` survives. The conclusion did not change, only the reason. `join()` now gives the base a trailing slash and strips the path's leading one, so both spellings send `/v1/user` to `https://host/api/v1/user`, and one credential entry for both is still right. The comment now says that. Comment only. Fixes MRGFY-8703 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Change-Id: Ibd81a3c529cb558d9e67d061ffe1d3d02dad2e34
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/give-key-reason-still-holds--bd81a3c5
branch
from
September 11, 2026 13:37
1af1f28 to
d097def
Compare
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/never-send-mergify-user-token-github--f3c422ba
branch
from
September 11, 2026 13:37
5ca96d3 to
b93aca3
Compare
sileht
had a problem deploying
to
func-tests-live
September 11, 2026 13:37 — with
GitHub Actions
Error
GitHub Actions
Error
Base automatically changed from
devs/sileht/mrgfy-8703-cli-auth-commands/never-send-mergify-user-token-github--f3c422ba
to
main
September 11, 2026 13:58
kozlek
approved these changes
Sep 11, 2026
jd
approved these changes
Sep 11, 2026
Contributor
Merge Queue Status
This pull request spent 7 minutes 36 seconds in the queue, including 7 minutes 15 seconds running CI. Required conditions to merge
|
42 tasks
mergify
Bot
deleted the
devs/sileht/mrgfy-8703-cli-auth-commands/give-key-reason-still-holds--bd81a3c5
branch
September 11, 2026 15:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
key_forfileshttps://host/apiandhttps://host/api/under oneentry, and its comment justified that by saying every request "replaces
the base path outright". That stopped being true with #1819, which made
Client::join()append a request path to the base's path prefixinstead of replacing it, so GitHub Enterprise's
/api/v3survives.The conclusion did not change, only the reason.
join()now gives thebase a trailing slash and strips the path's leading one, so both
spellings send
/v1/usertohttps://host/api/v1/user, and onecredential entry for both is still right. The comment now says that.
Comment only.
Fixes MRGFY-8703
Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Depends-On: #1808