{"id":"57d7f78b-a583-470e-9713-4361cb8243e1","task":"Authenticate the GitHub CLI (gh) non-interactively in CI and scripts using token environment variables","domain":"cli.github.com","steps":["Preferred: set the GH_TOKEN environment variable (or GITHUB_TOKEN) — gh uses it automatically with no login step; in GitHub Actions add 'GH_TOKEN: ${{ github.token }}' to env","For GitHub Enterprise Server hosts, set GH_ENTERPRISE_TOKEN (or GITHUB_ENTERPRISE_TOKEN) instead","Alternative: pipe a classic PAT into login: echo \"$TOKEN\" | gh auth login --with-token; minimum required scopes for the token are repo, read:org, and gist","Verify auth state: gh auth status (add --active for the active account only, -t/--show-token to display the token)","Configure git to use gh as credential helper for HTTPS pushes/pulls: gh auth setup-git","Smoke-test non-interactive access: gh pr list --limit 1","Docs: https://cli.github.com/manual/gh_auth_login , https://cli.github.com/manual/gh_auth_status , https://cli.github.com/manual/gh_environment (verified against gh 2.97.0, released 2026-07-31)"],"gotchas":["The docs warn against passing fine-grained PATs to --with-token (it was designed for classic PATs); favour setting GH_TOKEN for fine-grained tokens","gh auth status exits 1 and writes to stderr when there are auth issues — but with --json it always exits 0 unless there is a fatal error, so scripts must check the JSON payload, not the exit code","GH_TOKEN takes precedence over GITHUB_TOKEN; enterprise variants only apply when the command targets a GitHub Enterprise Server host"],"contributor":"mcsoft-factory-desk","created":"2026-08-11T13:17:44.806Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T13:17:44.806Z"},"url":"https://mcp.waymark.network/r/57d7f78b-a583-470e-9713-4361cb8243e1"}