setup-github-auth.sh

#!/usr/bin/env bash
# ---------------------------------------------------------------------
# setup-github-auth.sh
# Non-interactively authenticate GitHub CLI ("gh") inside a devcontainer
# using a fine-grained Personal Access Token (PAT).
#
# Reads the PAT from $GITHUB_PAT (in containerEnv or localEnv expansion)
# and the username from $GITHUB_USER.
#
# After running, `gh auth status` and `git push` should both work.
# ---------------------------------------------------------------------

set -euo pipefail

echo "[setup-github-auth] Starting setup..."

# Ensure gh is installed
if ! command -v gh >/dev/null 2>&1; then
  echo "[setup-github-auth] ERROR: gh CLI not installed in container."
  exit 0  # not fatal, container may not use gh
fi

# Helper function to install gh CLI extensions
install_gh_extensions() {
  echo "[setup-github-auth] Installing gh CLI extensions..."

  # Install gh-sub-issue for issue hierarchy management
  echo "[setup-github-auth] Installing gh-sub-issue extension..."
  if gh extension install yahsan2/gh-sub-issue 2>/dev/null; then
    echo "[setup-github-auth] gh-sub-issue installed successfully"
  else
    # Extension might already be installed, check if it exists
    if gh extension list | grep -q "yahsan2/gh-sub-issue"; then
      echo "[setup-github-auth] gh-sub-issue already installed"
    else
      echo "[setup-github-auth] WARNING: Failed to install gh-sub-issue extension"
    fi
  fi
}

# Check if already authenticated (common in Codespaces)
SKIP_GH_AUTH=false
if gh auth status >/dev/null 2>&1; then
  echo "[setup-github-auth] Already authenticated via gh. Skipping re-authentication."
  SKIP_GH_AUTH=true

  # Install extensions now since gh is authenticated
  install_gh_extensions
fi

# Determine which token source is populated
# Priority: GITHUB_TOKEN (Codespaces auto-auth) > GITHUB_PAT (local) > GH_PAT (legacy)
if [[ -n "${GITHUB_TOKEN:-}" ]]; then
  TOKEN_SOURCE="GitHub Codespaces (GITHUB_TOKEN)"
  TOKEN_VALUE="$GITHUB_TOKEN"
  # Set GITHUB_PAT for consistency
  export GITHUB_PAT="$GITHUB_TOKEN"
elif [[ -n "${GITHUB_PAT:-}" ]]; then
  TOKEN_SOURCE="Docker Compose environment (GITHUB_PAT)"
  TOKEN_VALUE="$GITHUB_PAT"
elif [[ -n "${GH_PAT:-}" ]]; then
  TOKEN_SOURCE="Codespaces secrets (GH_PAT)"
  TOKEN_VALUE="$GH_PAT"
  # Set GITHUB_PAT for consistency
  export GITHUB_PAT="$GH_PAT"
else
  # If already authenticated but no token available, skip git credential setup
  if [[ "$SKIP_GH_AUTH" == "true" ]]; then
    echo "[setup-github-auth] No token environment variable found, but gh is authenticated."
    echo "[setup-github-auth] Git credential setup will be skipped."
    exit 0
  fi
  echo "[setup-github-auth] No GITHUB_TOKEN, GITHUB_PAT, or GH_PAT found. Skipping gh auth."
  exit 0
fi

echo "[setup-github-auth] Using token from $TOKEN_SOURCE."

# Optional: show masked token length for debugging
echo "[setup-github-auth] Token length: ${#TOKEN_VALUE}"

# Authenticate gh non-interactively (skip if already authenticated)
if [[ "$SKIP_GH_AUTH" == "false" ]]; then
  if printf "%s" "$TOKEN_VALUE" | gh auth login --with-token >/tmp/gh-auth.log 2>&1; then
    echo "[setup-github-auth] gh authenticated successfully."
  else
    echo "[setup-github-auth] gh authentication failed; see /tmp/gh-auth.log"
    cat /tmp/gh-auth.log || true
    exit 1
  fi
else
  echo "[setup-github-auth] Skipped gh authentication (already authenticated)."
fi

# Remove any SSH URL rewrite rules and credential helpers that would bypass PAT authentication
#
# VS Code Dev Containers automatically copies your host machine's ~/.gitconfig into the container.
# If your host has a git config rule like:
#   [url "git@github.com:"]
#       insteadof = https://github.com/
# Then ALL https:// GitHub URLs get silently rewritten to git@github.com (SSH protocol).
#
# Additionally, if your host has credential helpers configured (like VSCode's credential helper
# or gh auth git-credential), these can override the PAT-based authentication we're setting up.
#
# This breaks PAT authentication because:
# - PATs only work with HTTPS protocol
# - SSH requires SSH keys, not PATs
# - The rewrite happens transparently, so "git remote -v" might show https:// but git actually uses SSH
# - Credential helpers may invoke OAuth flows instead of using the PAT
#
# This causes VS Code to pop up OAuth dialogs asking for broad GitHub access, even though you've
# provided a scoped fine-grained PAT in GITHUB_PAT.
#
# Solution: Remove the SSH rewrite rules and clear credential helpers so git actually uses HTTPS with your PAT as intended.
git config --global --unset url.git@github.com:.insteadof 2>/dev/null || true
git config --unset url.git@github.com:.insteadof 2>/dev/null || true

# Clear all existing credential helpers (both global and local)
# Note: We can't modify /etc/gitconfig (VSCode's system config), but we can override it
git config --global --unset-all credential.helper 2>/dev/null || true
git config --unset-all credential.helper 2>/dev/null || true
git config --global --unset-all credential.https://github.com.helper 2>/dev/null || true
git config --unset-all credential.https://github.com.helper 2>/dev/null || true
git config --global --unset-all credential.https://gist.github.com.helper 2>/dev/null || true
git config --unset-all credential.https://gist.github.com.helper 2>/dev/null || true

# Reset credential helper chain by setting empty string, then add store
# The empty string resets the helper list (overriding system config)
# Then we add 'store' as the only helper
git config --global --replace-all credential.helper "" ".*"
git config --global --add credential.helper store

echo "[setup-github-auth] Cleared conflicting git credential helpers."

# Configure git credentials to use same token (optional but convenient)
if command -v git >/dev/null 2>&1; then

  # Handle both GITHUB_USER (local) and GH_USER (Codespaces)
  USERNAME="${GITHUB_USER:-${GH_USER:-}}"
  if [[ -z "$USERNAME" ]]; then
    # Use gh user if available
    USERNAME="$(gh api user --jq .login 2>/dev/null || echo 'github-user')"
  fi
  printf "protocol=https\nhost=github.com\nusername=%s\npassword=%s\n\n" \
    "$USERNAME" "$TOKEN_VALUE" | git credential approve
  echo "[setup-github-auth] git credential stored for $USERNAME using 'store' helper."
fi

# Install gh CLI extensions after authentication (if not already done)
if [[ "$SKIP_GH_AUTH" != "true" ]]; then
  install_gh_extensions
fi

echo "[setup-github-auth] Done."