From 20d39314279502ec3bc1bba40f4a4614f9d218c0 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 5 Aug 2024 09:11:25 -0700
Subject: [PATCH 001/301] tmp

---
 pkg/cmd/attestation/artifact/artifact.go   |  13 ++-
 pkg/cmd/attestation/artifact/image.go      |   9 +-
 pkg/cmd/attestation/artifact/oci/client.go | 130 +++++++++++++++++++--
 pkg/cmd/attestation/verify/verify.go       |  10 ++
 4 files changed, 146 insertions(+), 16 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/artifact.go b/pkg/cmd/attestation/artifact/artifact.go
index de354b947..f9302b439 100644
--- a/pkg/cmd/attestation/artifact/artifact.go
+++ b/pkg/cmd/attestation/artifact/artifact.go
@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
+
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 )
 
@@ -19,9 +21,10 @@ const (
 
 // DigestedArtifact abstracts the software artifact being verified
 type DigestedArtifact struct {
-	URL       string
-	digest    string
-	digestAlg string
+	URL          string
+	digest       string
+	digestAlg    string
+	attestations []*api.Attestation
 }
 
 func normalizeReference(reference string, pathSeparator rune) (normalized string, artifactType artifactType, err error) {
@@ -77,3 +80,7 @@ func (a *DigestedArtifact) Algorithm() string {
 func (a *DigestedArtifact) DigestWithAlg() string {
 	return fmt.Sprintf("%s:%s", a.digestAlg, a.digest)
 }
+
+func (a *DigestedArtifact) Attestations() []*api.Attestation {
+	return a.attestations
+}
diff --git a/pkg/cmd/attestation/artifact/image.go b/pkg/cmd/attestation/artifact/image.go
index 2af13e723..45e3104c2 100644
--- a/pkg/cmd/attestation/artifact/image.go
+++ b/pkg/cmd/attestation/artifact/image.go
@@ -15,14 +15,15 @@ func digestContainerImageArtifact(url string, client oci.Client) (*DigestedArtif
 		return nil, fmt.Errorf("artifact %s is not a valid registry reference: %v", url, err)
 	}
 
-	digest, err := client.GetImageDigest(named.String())
+	digest, attestations, err := client.GetImageDigest(named.String())
 	if err != nil {
 		return nil, err
 	}
 
 	return &DigestedArtifact{
-		URL:       fmt.Sprintf("oci://%s", named.String()),
-		digest:    digest.Hex,
-		digestAlg: digest.Algorithm,
+		URL:          fmt.Sprintf("oci://%s", named.String()),
+		digest:       digest.Hex,
+		digestAlg:    digest.Algorithm,
+		attestations: attestations,
 	}, nil
 }
diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 5b8d8cf7a..e0a497e40 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -1,21 +1,27 @@
 package oci
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
+	"io"
 
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/google/go-containerregistry/pkg/v1"
+	"github.com/sigstore/sigstore-go/pkg/bundle"
+
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
+	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
 )
 
 var ErrDenied = errors.New("the provided token was denied access to the requested resource, please check the token's expiration and repository access")
 var ErrRegistryAuthz = errors.New("remote registry authorization failed, please authenticate with the registry and try again")
 
 type Client interface {
-	GetImageDigest(imgName string) (*v1.Hash, error)
+	GetImageDigest(imgName string) (*v1.Hash, []*api.Attestation, error)
 }
 
 func checkForUnauthorizedOrDeniedErr(err transport.Error) error {
@@ -36,27 +42,133 @@ type LiveClient struct {
 }
 
 // where name is formed like ghcr.io/github/my-image-repo
-func (c LiveClient) GetImageDigest(imgName string) (*v1.Hash, error) {
-	name, err := c.parseReference(imgName)
+func (c LiveClient) GetImageDigest(imgName string) (*v1.Hash, []*api.Attestation, error) {
+	nameFirst, err := c.parseReference(imgName)
+	var buf bytes.Buffer
+	attestations := []*api.Attestation{}
+
 	if err != nil {
-		return nil, fmt.Errorf("failed to create image tag: %v", err)
+		return nil, attestations, fmt.Errorf("failed to create image tag: %v", err)
 	}
 
 	// The user must already be authenticated with the container registry
 	// The authn.DefaultKeychain argument indicates that Get should checks the
 	// user's configuration for the registry credentials
-	desc, err := c.get(name, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	desc, err := c.get(nameFirst, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 	if err != nil {
 		var transportErr *transport.Error
 		if errors.As(err, &transportErr) {
 			if accessErr := checkForUnauthorizedOrDeniedErr(*transportErr); accessErr != nil {
-				return nil, accessErr
+				return nil, attestations, accessErr
 			}
 		}
-		return nil, fmt.Errorf("failed to fetch remote image: %v", err)
+		return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
 
-	return &desc.Digest, nil
+	dgst := nameFirst.Context().Digest(desc.Digest.String())
+
+	ref, err := remote.Referrers(dgst, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	indexManifest, err := ref.IndexManifest()
+	if err != nil {
+		return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+	}
+	manifests := indexManifest.Manifests
+
+	for _, m := range manifests {
+		allowedArtifactTypes := []string{"application/vnd.dev.sigstore.bundle.v0.3+json"}
+
+		for _, allowedType := range allowedArtifactTypes {
+			if allowedType == m.ArtifactType {
+				manifestDigest := m.Digest.String()
+
+				manifestURL := fmt.Sprintf("%s/manifests/%s", imgName, manifestDigest)
+				fmt.Println(manifestURL)
+
+				digest2 := nameFirst.Context().Digest(manifestDigest)
+				// replace to use GET for more correc type
+				img2, err := remote.Image(digest2, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+				if err != nil {
+					return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+				}
+				// manifest2, err := ref2.Manifest()
+				// if err != nil {
+				// 	return nil, fmt.Errorf("failed to fetch remote image: %v", err)
+				// }
+
+				// fmt.Println(manifest2.MediaType)
+				// Step 4: Get the layers
+				layers, err := img2.Layers()
+				if err != nil {
+					fmt.Println("Error getting layers: %v", err)
+					return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+
+				}
+
+				// For simplicity, we'll just fetch the first layer
+				if len(layers) > 0 {
+					fmt.Println("how many layers?", len(layers))
+					layer := layers[0]
+
+					// Step 5: Read the blob (layer) content
+					rc, err := layer.Compressed()
+					if err != nil {
+						fmt.Println("Error getting compressed layer: %v", err)
+						return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+
+					}
+					defer rc.Close()
+
+					layerBytes, err := io.ReadAll(rc)
+
+					if err != nil {
+						// If creating a gzip reader fails, it might not be compressed
+						fmt.Println("Layer is not gzip-compressed. Reading raw content.")
+						// fmt.Println("Blob content:", buf.String())
+
+						var bundle bundle.ProtobufBundle
+						bundle.Bundle = new(protobundle.Bundle)
+						err = bundle.UnmarshalJSON(layerBytes)
+						fmt.Println("")
+						fmt.Println("JSON Content:", string(layerBytes))
+						fmt.Println("")
+
+						if err != nil {
+							fmt.Println("failed to unmarshal bundle from JSON: %v", err)
+						} else {
+							fmt.Println("Bundle content:", bundle.String())
+						}
+
+						a := api.Attestation{Bundle: &bundle}
+						attestations = append(attestations, &a)
+
+					} else {
+						defer gz.Close()
+
+						var decompressed bytes.Buffer
+						if _, err := io.Copy(&decompressed, gz); err != nil {
+							fmt.Println("Error decompressing layer content: %v", err)
+						}
+
+						// Now you have the decompressed blob content in 'decompressed' buffer
+						fmt.Println("Decompressed blob content:", decompressed.String())
+					}
+
+					// Now you have the decompressed blob content in 'decompressed' buffer
+					// fmt.Println("Blob content:", decompressed.String())
+				} else {
+					fmt.Println("No layers found in the image.")
+				}
+			}
+		}
+	}
+
+	// msgName, err := c.parseReference(msg)
+	// fmt.Println()
+	// if err != nil {
+	// 	return nil, err
+	// }
+
+	return &desc.Digest, attestations, nil
 }
 
 // Unlike other parts of this command set, we cannot pass a custom HTTP client
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index e1a5b1c50..990de3985 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -204,6 +204,16 @@ func runVerify(opts *Options) error {
 		return err
 	}
 
+	attestationsFromOCI := artifact.Attestations()
+	if len(attestationsFromOCI) > 0 {
+		attestations = append(attestations, attestationsFromOCI...)
+
+		for _, attestation := range attestations {
+			// ja, err := attestation.Bundle.String()
+			opts.Logger.Printf("Loaded attestation from OCI registry: %s\n", attestation.Bundle.String())
+		}
+	}
+
 	pluralAttestation := text.Pluralize(len(attestations), "attestation")
 	if c.IsBundleProvided() {
 		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.BundlePath)

From 8d17896080cb6e0b117203be9c7014b7f3a533f0 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 5 Aug 2024 12:25:52 -0700
Subject: [PATCH 002/301] refactor the logic and logging

---
 pkg/cmd/attestation/artifact/artifact.go      |   4 +-
 pkg/cmd/attestation/artifact/image.go         |  35 +++++-
 pkg/cmd/attestation/artifact/oci/client.go    | 114 ++++++------------
 pkg/cmd/attestation/download/download.go      |   2 +-
 pkg/cmd/attestation/inspect/inspect.go        |   2 +-
 .../attestation/verification/attestation.go   |  18 ++-
 pkg/cmd/attestation/verify/options.go         |  43 +++----
 pkg/cmd/attestation/verify/verify.go          |  30 ++---
 8 files changed, 120 insertions(+), 128 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/artifact.go b/pkg/cmd/attestation/artifact/artifact.go
index f9302b439..e8e0ea095 100644
--- a/pkg/cmd/attestation/artifact/artifact.go
+++ b/pkg/cmd/attestation/artifact/artifact.go
@@ -54,14 +54,14 @@ func normalizeReference(reference string, pathSeparator rune) (normalized string
 	return filepath.Clean(reference), fileArtifactType, nil
 }
 
-func NewDigestedArtifact(client oci.Client, reference, digestAlg string) (artifact *DigestedArtifact, err error) {
+func NewDigestedArtifact(client oci.Client, reference, digestAlg string, useBundleFromRegistry bool) (artifact *DigestedArtifact, err error) {
 	normalized, artifactType, err := normalizeReference(reference, os.PathSeparator)
 	if err != nil {
 		return nil, err
 	}
 	if artifactType == ociArtifactType {
 		// TODO: should we allow custom digestAlg for OCI artifacts?
-		return digestContainerImageArtifact(normalized, client)
+		return digestContainerImageArtifact(normalized, client, useBundleFromRegistry)
 	}
 	return digestLocalFileArtifact(normalized, digestAlg)
 }
diff --git a/pkg/cmd/attestation/artifact/image.go b/pkg/cmd/attestation/artifact/image.go
index 45e3104c2..e1fba97bf 100644
--- a/pkg/cmd/attestation/artifact/image.go
+++ b/pkg/cmd/attestation/artifact/image.go
@@ -7,7 +7,7 @@ import (
 	"github.com/distribution/reference"
 )
 
-func digestContainerImageArtifact(url string, client oci.Client) (*DigestedArtifact, error) {
+func digestContainerImageArtifact(url string, client oci.Client, useBundleFromRegistry bool) (*DigestedArtifact, error) {
 	// try to parse the url as a valid registry reference
 	named, err := reference.Parse(url)
 	if err != nil {
@@ -15,15 +15,38 @@ func digestContainerImageArtifact(url string, client oci.Client) (*DigestedArtif
 		return nil, fmt.Errorf("artifact %s is not a valid registry reference: %v", url, err)
 	}
 
-	digest, attestations, err := client.GetImageDigest(named.String())
+	name, err := client.ParseReference(named.String())
+	if err != nil {
+		return nil, err
+	}
+
+	digest, err := client.GetImageDigest(name)
+
+	if err != nil {
+		return nil, err
+	}
+	if useBundleFromRegistry {
+		attestations, err := client.GetAttestations(name, digest)
+
+		if err != nil {
+			return nil, err
+		}
+
+		return &DigestedArtifact{
+			URL:          fmt.Sprintf("oci://%s", named.String()),
+			digest:       digest.Hex,
+			digestAlg:    digest.Algorithm,
+			attestations: attestations,
+		}, nil
+	}
+
 	if err != nil {
 		return nil, err
 	}
 
 	return &DigestedArtifact{
-		URL:          fmt.Sprintf("oci://%s", named.String()),
-		digest:       digest.Hex,
-		digestAlg:    digest.Algorithm,
-		attestations: attestations,
+		URL:       fmt.Sprintf("oci://%s", named.String()),
+		digest:    digest.Hex,
+		digestAlg: digest.Algorithm,
 	}, nil
 }
diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index e0a497e40..9e53c6f2b 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -1,7 +1,6 @@
 package oci
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -21,7 +20,9 @@ var ErrDenied = errors.New("the provided token was denied access to the requeste
 var ErrRegistryAuthz = errors.New("remote registry authorization failed, please authenticate with the registry and try again")
 
 type Client interface {
-	GetImageDigest(imgName string) (*v1.Hash, []*api.Attestation, error)
+	GetImageDigest(name name.Reference) (*v1.Hash, error)
+	GetAttestations(name name.Reference, digest *v1.Hash) ([]*api.Attestation, error)
+	ParseReference(ref string) (name.Reference, error)
 }
 
 func checkForUnauthorizedOrDeniedErr(err transport.Error) error {
@@ -41,36 +42,40 @@ type LiveClient struct {
 	get            func(name.Reference, ...remote.Option) (*remote.Descriptor, error)
 }
 
+func (c LiveClient) ParseReference(ref string) (name.Reference, error) {
+	return c.parseReference(ref)
+}
+
 // where name is formed like ghcr.io/github/my-image-repo
-func (c LiveClient) GetImageDigest(imgName string) (*v1.Hash, []*api.Attestation, error) {
-	nameFirst, err := c.parseReference(imgName)
-	var buf bytes.Buffer
-	attestations := []*api.Attestation{}
-
-	if err != nil {
-		return nil, attestations, fmt.Errorf("failed to create image tag: %v", err)
-	}
-
+func (c LiveClient) GetImageDigest(name name.Reference) (*v1.Hash, error) {
 	// The user must already be authenticated with the container registry
 	// The authn.DefaultKeychain argument indicates that Get should checks the
 	// user's configuration for the registry credentials
-	desc, err := c.get(nameFirst, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	desc, err := c.get(name, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 	if err != nil {
 		var transportErr *transport.Error
 		if errors.As(err, &transportErr) {
 			if accessErr := checkForUnauthorizedOrDeniedErr(*transportErr); accessErr != nil {
-				return nil, attestations, accessErr
+				return nil, accessErr
 			}
 		}
-		return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+		return nil, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
 
-	dgst := nameFirst.Context().Digest(desc.Digest.String())
+	return &desc.Digest, nil
+}
 
-	ref, err := remote.Referrers(dgst, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+func (c LiveClient) GetAttestations(name name.Reference, digest *v1.Hash) ([]*api.Attestation, error) {
+	attestations := []*api.Attestation{}
+	nameDegist := name.Context().Digest(digest.String())
+
+	ref, err := remote.Referrers(nameDegist, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	if err != nil {
+		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+	}
 	indexManifest, err := ref.IndexManifest()
 	if err != nil {
-		return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
 	manifests := indexManifest.Manifests
 
@@ -81,94 +86,55 @@ func (c LiveClient) GetImageDigest(imgName string) (*v1.Hash, []*api.Attestation
 			if allowedType == m.ArtifactType {
 				manifestDigest := m.Digest.String()
 
-				manifestURL := fmt.Sprintf("%s/manifests/%s", imgName, manifestDigest)
-				fmt.Println(manifestURL)
-
-				digest2 := nameFirst.Context().Digest(manifestDigest)
+				digest2 := nameDegist.Context().Digest(manifestDigest)
 				// replace to use GET for more correc type
 				img2, err := remote.Image(digest2, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 				if err != nil {
-					return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 				}
-				// manifest2, err := ref2.Manifest()
-				// if err != nil {
-				// 	return nil, fmt.Errorf("failed to fetch remote image: %v", err)
-				// }
 
-				// fmt.Println(manifest2.MediaType)
 				// Step 4: Get the layers
 				layers, err := img2.Layers()
 				if err != nil {
-					fmt.Println("Error getting layers: %v", err)
-					return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 
 				}
 
 				// For simplicity, we'll just fetch the first layer
 				if len(layers) > 0 {
-					fmt.Println("how many layers?", len(layers))
 					layer := layers[0]
 
 					// Step 5: Read the blob (layer) content
 					rc, err := layer.Compressed()
 					if err != nil {
-						fmt.Println("Error getting compressed layer: %v", err)
-						return nil, attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-
+						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 					}
 					defer rc.Close()
 
 					layerBytes, err := io.ReadAll(rc)
 
 					if err != nil {
-						// If creating a gzip reader fails, it might not be compressed
-						fmt.Println("Layer is not gzip-compressed. Reading raw content.")
-						// fmt.Println("Blob content:", buf.String())
-
-						var bundle bundle.ProtobufBundle
-						bundle.Bundle = new(protobundle.Bundle)
-						err = bundle.UnmarshalJSON(layerBytes)
-						fmt.Println("")
-						fmt.Println("JSON Content:", string(layerBytes))
-						fmt.Println("")
-
-						if err != nil {
-							fmt.Println("failed to unmarshal bundle from JSON: %v", err)
-						} else {
-							fmt.Println("Bundle content:", bundle.String())
-						}
-
-						a := api.Attestation{Bundle: &bundle}
-						attestations = append(attestations, &a)
-
-					} else {
-						defer gz.Close()
-
-						var decompressed bytes.Buffer
-						if _, err := io.Copy(&decompressed, gz); err != nil {
-							fmt.Println("Error decompressing layer content: %v", err)
-						}
-
-						// Now you have the decompressed blob content in 'decompressed' buffer
-						fmt.Println("Decompressed blob content:", decompressed.String())
+						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 					}
 
-					// Now you have the decompressed blob content in 'decompressed' buffer
-					// fmt.Println("Blob content:", decompressed.String())
+					var bundle bundle.ProtobufBundle
+					bundle.Bundle = new(protobundle.Bundle)
+					err = bundle.UnmarshalJSON(layerBytes)
+
+					if err != nil {
+						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+					}
+
+					a := api.Attestation{Bundle: &bundle}
+					attestations = append(attestations, &a)
+
 				} else {
-					fmt.Println("No layers found in the image.")
+					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 				}
 			}
 		}
 	}
-
-	// msgName, err := c.parseReference(msg)
-	// fmt.Println()
-	// if err != nil {
-	// 	return nil, err
-	// }
-
-	return &desc.Digest, attestations, nil
+	return attestations, nil
 }
 
 // Unlike other parts of this command set, we cannot pass a custom HTTP client
diff --git a/pkg/cmd/attestation/download/download.go b/pkg/cmd/attestation/download/download.go
index 3af3b6200..6d74027ae 100644
--- a/pkg/cmd/attestation/download/download.go
+++ b/pkg/cmd/attestation/download/download.go
@@ -111,7 +111,7 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 }
 
 func runDownload(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, false)
 	if err != nil {
 		return fmt.Errorf("failed to digest artifact: %v", err)
 	}
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index 2731ee7a4..f38181b77 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -97,7 +97,7 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 }
 
 func runInspect(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, false)
 	if err != nil {
 		return fmt.Errorf("failed to digest artifact: %s", err)
 	}
diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 52a8ff025..902657d41 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -16,12 +16,13 @@ import (
 var ErrUnrecognisedBundleExtension = errors.New("bundle file extension not supported, must be json or jsonl")
 
 type FetchAttestationsConfig struct {
-	APIClient  api.Client
-	BundlePath string
-	Digest     string
-	Limit      int
-	Owner      string
-	Repo       string
+	APIClient           api.Client
+	BundlePath          string
+	Digest              string
+	Limit               int
+	Owner               string
+	Repo                string
+	AttestationsFromOCI []*api.Attestation
 }
 
 func (c *FetchAttestationsConfig) IsBundleProvided() bool {
@@ -32,6 +33,11 @@ func GetAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error) {
 	if c.IsBundleProvided() {
 		return GetLocalAttestations(c.BundlePath)
 	}
+
+	if len(c.AttestationsFromOCI) > 0 {
+		return c.AttestationsFromOCI, nil
+	}
+
 	return GetRemoteAttestations(c)
 }
 
diff --git a/pkg/cmd/attestation/verify/options.go b/pkg/cmd/attestation/verify/options.go
index da2c7bb4e..902024b90 100644
--- a/pkg/cmd/attestation/verify/options.go
+++ b/pkg/cmd/attestation/verify/options.go
@@ -15,27 +15,28 @@ import (
 
 // Options captures the options for the verify command
 type Options struct {
-	ArtifactPath         string
-	BundlePath           string
-	Config               func() (gh.Config, error)
-	TrustedRoot          string
-	DenySelfHostedRunner bool
-	DigestAlgorithm      string
-	Limit                int
-	NoPublicGood         bool
-	OIDCIssuer           string
-	Owner                string
-	PredicateType        string
-	Repo                 string
-	SAN                  string
-	SANRegex             string
-	SignerRepo           string
-	SignerWorkflow       string
-	APIClient            api.Client
-	Logger               *io.Handler
-	OCIClient            oci.Client
-	SigstoreVerifier     verification.SigstoreVerifier
-	exporter             cmdutil.Exporter
+	ArtifactPath          string
+	BundlePath            string
+	UseBundleFromRegistry bool
+	Config                func() (gh.Config, error)
+	TrustedRoot           string
+	DenySelfHostedRunner  bool
+	DigestAlgorithm       string
+	Limit                 int
+	NoPublicGood          bool
+	OIDCIssuer            string
+	Owner                 string
+	PredicateType         string
+	Repo                  string
+	SAN                   string
+	SANRegex              string
+	SignerRepo            string
+	SignerWorkflow        string
+	APIClient             api.Client
+	Logger                *io.Handler
+	OCIClient             oci.Client
+	SigstoreVerifier      verification.SigstoreVerifier
+	exporter              cmdutil.Exporter
 }
 
 // Clean cleans the file path option values
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 990de3985..ffa87a383 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -150,6 +150,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	// general flags
 	verifyCmd.Flags().StringVarP(&opts.BundlePath, "bundle", "b", "", "Path to bundle on disk, either a single bundle in a JSON file or a JSON lines file with multiple bundles")
 	cmdutil.DisableAuthCheckFlag(verifyCmd.Flags().Lookup("bundle"))
+	verifyCmd.Flags().BoolVarP(&opts.UseBundleFromRegistry, "bundle-from-registry", "", false, "Use the bundle from the OCI registry")
 	cmdutil.StringEnumFlag(verifyCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	verifyCmd.Flags().StringVarP(&opts.Owner, "owner", "o", "", "GitHub organization to scope attestation lookup by")
 	verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")
@@ -173,7 +174,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 }
 
 func runVerify(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, opts.UseBundleFromRegistry)
 	if err != nil {
 		opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading digest for %s failed\n"), opts.ArtifactPath)
 		return err
@@ -182,12 +183,13 @@ func runVerify(opts *Options) error {
 	opts.Logger.Printf("Loaded digest %s for %s\n", artifact.DigestWithAlg(), artifact.URL)
 
 	c := verification.FetchAttestationsConfig{
-		APIClient:  opts.APIClient,
-		BundlePath: opts.BundlePath,
-		Digest:     artifact.DigestWithAlg(),
-		Limit:      opts.Limit,
-		Owner:      opts.Owner,
-		Repo:       opts.Repo,
+		APIClient:           opts.APIClient,
+		BundlePath:          opts.BundlePath,
+		Digest:              artifact.DigestWithAlg(),
+		Limit:               opts.Limit,
+		Owner:               opts.Owner,
+		Repo:                opts.Repo,
+		AttestationsFromOCI: artifact.Attestations(),
 	}
 	attestations, err := verification.GetAttestations(c)
 	if err != nil {
@@ -198,25 +200,19 @@ func runVerify(opts *Options) error {
 
 		if c.IsBundleProvided() {
 			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading attestations from %s failed\n"), artifact.URL)
+		} else if opts.UseBundleFromRegistry {
+			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from OCI registry failed"))
 		} else {
 			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from GitHub API failed"))
 		}
 		return err
 	}
 
-	attestationsFromOCI := artifact.Attestations()
-	if len(attestationsFromOCI) > 0 {
-		attestations = append(attestations, attestationsFromOCI...)
-
-		for _, attestation := range attestations {
-			// ja, err := attestation.Bundle.String()
-			opts.Logger.Printf("Loaded attestation from OCI registry: %s\n", attestation.Bundle.String())
-		}
-	}
-
 	pluralAttestation := text.Pluralize(len(attestations), "attestation")
 	if c.IsBundleProvided() {
 		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.BundlePath)
+	} else if opts.UseBundleFromRegistry {
+		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.ArtifactPath)
 	} else {
 		opts.Logger.Printf("Loaded %s from GitHub API\n", pluralAttestation)
 	}

From 8ae4f1cfb9278530aa22e84ccb3dc789587af1ef Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 5 Aug 2024 12:53:43 -0700
Subject: [PATCH 003/301] add contain check

---
 pkg/cmd/attestation/artifact/oci/client.go | 94 ++++++++++++----------
 1 file changed, 52 insertions(+), 42 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 9e53c6f2b..0171b4187 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -65,78 +65,88 @@ func (c LiveClient) GetImageDigest(name name.Reference) (*v1.Hash, error) {
 	return &desc.Digest, nil
 }
 
+// Ref: https://github.com/github/package-security/blob/main/garden/retrieve-sigstore-bundle-from-oci-registry.md
 func (c LiveClient) GetAttestations(name name.Reference, digest *v1.Hash) ([]*api.Attestation, error) {
 	attestations := []*api.Attestation{}
 	nameDegist := name.Context().Digest(digest.String())
 
-	ref, err := remote.Referrers(nameDegist, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	imageIndex, err := remote.Referrers(nameDegist, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 	if err != nil {
 		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
-	indexManifest, err := ref.IndexManifest()
+	indexManifest, err := imageIndex.IndexManifest()
 	if err != nil {
 		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
 	manifests := indexManifest.Manifests
 
 	for _, m := range manifests {
-		allowedArtifactTypes := []string{"application/vnd.dev.sigstore.bundle.v0.3+json"}
 
-		for _, allowedType := range allowedArtifactTypes {
-			if allowedType == m.ArtifactType {
-				manifestDigest := m.Digest.String()
+		if containAllowedArtifactTypes(m.ArtifactType) {
+			manifestDigest := m.Digest.String()
+
+			digest2 := nameDegist.Context().Digest(manifestDigest)
+			// TODO: replace to use GET for more correct type
+			// OR IS IT CORRECT TO USE type IMAGE?
+			img2, err := remote.Image(digest2, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+			if err != nil {
+				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+			}
+
+			// Step 4: Get the layers
+			layers, err := img2.Layers()
+			if err != nil {
+				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+
+			}
+
+			// For simplicity, we'll just fetch the first layer
+			if len(layers) > 0 {
+				layer := layers[0]
+
+				// Step 5: Read the blob (layer) content
+				rc, err := layer.Compressed()
+				if err != nil {
+					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+				}
+				defer rc.Close()
+
+				layerBytes, err := io.ReadAll(rc)
 
-				digest2 := nameDegist.Context().Digest(manifestDigest)
-				// replace to use GET for more correc type
-				img2, err := remote.Image(digest2, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 				if err != nil {
 					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 				}
 
-				// Step 4: Get the layers
-				layers, err := img2.Layers()
+				var bundle bundle.ProtobufBundle
+				bundle.Bundle = new(protobundle.Bundle)
+				err = bundle.UnmarshalJSON(layerBytes)
+
 				if err != nil {
 					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-
 				}
 
-				// For simplicity, we'll just fetch the first layer
-				if len(layers) > 0 {
-					layer := layers[0]
+				a := api.Attestation{Bundle: &bundle}
+				attestations = append(attestations, &a)
 
-					// Step 5: Read the blob (layer) content
-					rc, err := layer.Compressed()
-					if err != nil {
-						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-					}
-					defer rc.Close()
-
-					layerBytes, err := io.ReadAll(rc)
-
-					if err != nil {
-						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-					}
-
-					var bundle bundle.ProtobufBundle
-					bundle.Bundle = new(protobundle.Bundle)
-					err = bundle.UnmarshalJSON(layerBytes)
-
-					if err != nil {
-						return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-					}
-
-					a := api.Attestation{Bundle: &bundle}
-					attestations = append(attestations, &a)
-
-				} else {
-					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-				}
+			} else {
+				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 			}
 		}
 	}
 	return attestations, nil
 }
 
+func containAllowedArtifactTypes(artifactType string) bool {
+	allowedArtifactTypes := []string{"application/vnd.dev.sigstore.bundle.v0.3+json"}
+
+	for _, allowedType := range allowedArtifactTypes {
+		if allowedType == artifactType {
+			return true
+		}
+	}
+	return false
+}
+
 // Unlike other parts of this command set, we cannot pass a custom HTTP client
 // to the go-containerregistry library. This means we have limited visibility
 // into the HTTP requests being made to container registries.

From bad127c342060eadfaa24b50604a9b8b88476706 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 5 Aug 2024 12:56:35 -0700
Subject: [PATCH 004/301] clean naming

---
 pkg/cmd/attestation/artifact/oci/client.go | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 0171b4187..8fd57af4c 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -81,30 +81,26 @@ func (c LiveClient) GetAttestations(name name.Reference, digest *v1.Hash) ([]*ap
 	manifests := indexManifest.Manifests
 
 	for _, m := range manifests {
-
 		if containAllowedArtifactTypes(m.ArtifactType) {
-			manifestDigest := m.Digest.String()
-
-			digest2 := nameDegist.Context().Digest(manifestDigest)
+			artifactManifestNameDigest := nameDegist.Context().Digest(m.Digest.String())
 			// TODO: replace to use GET for more correct type
 			// OR IS IT CORRECT TO USE type IMAGE?
-			img2, err := remote.Image(digest2, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+			artifactManifest, err := remote.Image(artifactManifestNameDigest, remote.WithAuthFromKeychain(authn.DefaultKeychain))
 			if err != nil {
 				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 			}
 
 			// Step 4: Get the layers
-			layers, err := img2.Layers()
+			layers, err := artifactManifest.Layers()
 			if err != nil {
 				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-
 			}
 
 			// For simplicity, we'll just fetch the first layer
 			if len(layers) > 0 {
 				layer := layers[0]
 
-				// Step 5: Read the blob (layer) content
+				// Step 5: Read the layer content
 				rc, err := layer.Compressed()
 				if err != nil {
 					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
@@ -127,7 +123,6 @@ func (c LiveClient) GetAttestations(name name.Reference, digest *v1.Hash) ([]*ap
 
 				a := api.Attestation{Bundle: &bundle}
 				attestations = append(attestations, &a)
-
 			} else {
 				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
 			}

From 57aea664e5d95136c4b100adacb5eee75af000d3 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Wed, 7 Aug 2024 10:10:59 -0700
Subject: [PATCH 005/301] added test

---
 pkg/cmd/attestation/artifact/artifact.go      |  18 +--
 pkg/cmd/attestation/artifact/image.go         |  28 +---
 pkg/cmd/attestation/artifact/oci/client.go    | 135 +++++++++---------
 .../attestation/artifact/oci/client_test.go   |  14 +-
 .../attestation/artifact/oci/mock_client.go   |  56 ++++++--
 pkg/cmd/attestation/download/download.go      |   2 +-
 pkg/cmd/attestation/inspect/inspect.go        |   2 +-
 .../attestation/verification/attestation.go   |  34 +++--
 pkg/cmd/attestation/verify/verify.go          |  22 +--
 pkg/cmd/attestation/verify/verify_test.go     |  27 ++++
 10 files changed, 204 insertions(+), 134 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/artifact.go b/pkg/cmd/attestation/artifact/artifact.go
index e8e0ea095..131785166 100644
--- a/pkg/cmd/attestation/artifact/artifact.go
+++ b/pkg/cmd/attestation/artifact/artifact.go
@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
+	"github.com/google/go-containerregistry/pkg/name"
 
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 )
@@ -21,10 +21,10 @@ const (
 
 // DigestedArtifact abstracts the software artifact being verified
 type DigestedArtifact struct {
-	URL          string
-	digest       string
-	digestAlg    string
-	attestations []*api.Attestation
+	URL       string
+	digest    string
+	digestAlg string
+	nameRef   name.Reference
 }
 
 func normalizeReference(reference string, pathSeparator rune) (normalized string, artifactType artifactType, err error) {
@@ -54,14 +54,14 @@ func normalizeReference(reference string, pathSeparator rune) (normalized string
 	return filepath.Clean(reference), fileArtifactType, nil
 }
 
-func NewDigestedArtifact(client oci.Client, reference, digestAlg string, useBundleFromRegistry bool) (artifact *DigestedArtifact, err error) {
+func NewDigestedArtifact(client oci.Client, reference, digestAlg string) (artifact *DigestedArtifact, err error) {
 	normalized, artifactType, err := normalizeReference(reference, os.PathSeparator)
 	if err != nil {
 		return nil, err
 	}
 	if artifactType == ociArtifactType {
 		// TODO: should we allow custom digestAlg for OCI artifacts?
-		return digestContainerImageArtifact(normalized, client, useBundleFromRegistry)
+		return digestContainerImageArtifact(normalized, client)
 	}
 	return digestLocalFileArtifact(normalized, digestAlg)
 }
@@ -81,6 +81,6 @@ func (a *DigestedArtifact) DigestWithAlg() string {
 	return fmt.Sprintf("%s:%s", a.digestAlg, a.digest)
 }
 
-func (a *DigestedArtifact) Attestations() []*api.Attestation {
-	return a.attestations
+func (a *DigestedArtifact) NameRef() name.Reference {
+	return a.nameRef
 }
diff --git a/pkg/cmd/attestation/artifact/image.go b/pkg/cmd/attestation/artifact/image.go
index e1fba97bf..dda5f65db 100644
--- a/pkg/cmd/attestation/artifact/image.go
+++ b/pkg/cmd/attestation/artifact/image.go
@@ -7,7 +7,7 @@ import (
 	"github.com/distribution/reference"
 )
 
-func digestContainerImageArtifact(url string, client oci.Client, useBundleFromRegistry bool) (*DigestedArtifact, error) {
+func digestContainerImageArtifact(url string, client oci.Client) (*DigestedArtifact, error) {
 	// try to parse the url as a valid registry reference
 	named, err := reference.Parse(url)
 	if err != nil {
@@ -15,30 +15,7 @@ func digestContainerImageArtifact(url string, client oci.Client, useBundleFromRe
 		return nil, fmt.Errorf("artifact %s is not a valid registry reference: %v", url, err)
 	}
 
-	name, err := client.ParseReference(named.String())
-	if err != nil {
-		return nil, err
-	}
-
-	digest, err := client.GetImageDigest(name)
-
-	if err != nil {
-		return nil, err
-	}
-	if useBundleFromRegistry {
-		attestations, err := client.GetAttestations(name, digest)
-
-		if err != nil {
-			return nil, err
-		}
-
-		return &DigestedArtifact{
-			URL:          fmt.Sprintf("oci://%s", named.String()),
-			digest:       digest.Hex,
-			digestAlg:    digest.Algorithm,
-			attestations: attestations,
-		}, nil
-	}
+	digest, nameRef, err := client.GetImageDigest(named.String())
 
 	if err != nil {
 		return nil, err
@@ -48,5 +25,6 @@ func digestContainerImageArtifact(url string, client oci.Client, useBundleFromRe
 		URL:       fmt.Sprintf("oci://%s", named.String()),
 		digest:    digest.Hex,
 		digestAlg: digest.Algorithm,
+		nameRef:   nameRef,
 	}, nil
 }
diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 8fd57af4c..55d74fac0 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -4,6 +4,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
+	"strings"
 
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
@@ -13,16 +15,14 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
-	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
 )
 
 var ErrDenied = errors.New("the provided token was denied access to the requested resource, please check the token's expiration and repository access")
 var ErrRegistryAuthz = errors.New("remote registry authorization failed, please authenticate with the registry and try again")
 
 type Client interface {
-	GetImageDigest(name name.Reference) (*v1.Hash, error)
-	GetAttestations(name name.Reference, digest *v1.Hash) ([]*api.Attestation, error)
-	ParseReference(ref string) (name.Reference, error)
+	GetImageDigest(imgName string) (*v1.Hash, name.Reference, error)
+	GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error)
 }
 
 func checkForUnauthorizedOrDeniedErr(err transport.Error) error {
@@ -40,6 +40,7 @@ func checkForUnauthorizedOrDeniedErr(err transport.Error) error {
 type LiveClient struct {
 	parseReference func(string, ...name.Option) (name.Reference, error)
 	get            func(name.Reference, ...remote.Option) (*remote.Descriptor, error)
+	referres       func(d name.Digest, options ...remote.Option) (v1.ImageIndex, error)
 }
 
 func (c LiveClient) ParseReference(ref string) (name.Reference, error) {
@@ -47,7 +48,11 @@ func (c LiveClient) ParseReference(ref string) (name.Reference, error) {
 }
 
 // where name is formed like ghcr.io/github/my-image-repo
-func (c LiveClient) GetImageDigest(name name.Reference) (*v1.Hash, error) {
+func (c LiveClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	name, err := c.parseReference(imgName)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create image tag: %v", err)
+	}
 	// The user must already be authenticated with the container registry
 	// The authn.DefaultKeychain argument indicates that Get should checks the
 	// user's configuration for the registry credentials
@@ -56,92 +61,92 @@ func (c LiveClient) GetImageDigest(name name.Reference) (*v1.Hash, error) {
 		var transportErr *transport.Error
 		if errors.As(err, &transportErr) {
 			if accessErr := checkForUnauthorizedOrDeniedErr(*transportErr); accessErr != nil {
-				return nil, accessErr
+				return nil, nil, accessErr
 			}
 		}
-		return nil, fmt.Errorf("failed to fetch remote image: %v", err)
+		return nil, nil, fmt.Errorf("failed to fetch remote image: %v", err)
 	}
 
-	return &desc.Digest, nil
+	return &desc.Digest, name, nil
+}
+
+type noncompliantRegistryTransport struct{}
+
+// RoundTrip will check if a request and associated response fulfill the following:
+// 1. The response returns a 406 status code
+// 2. The request path contains /referrers/
+// If both conditions are met, the response's status code will be overwritten to 404
+// This is a temporary solution to handle non compliant registries that return
+// an unexpected status code 406 when the go-containerregistry library used
+// by this code attempts to make a request to the referrers API.
+// The go-containerregistry library can handle 404 response but not a 406 response.
+// See the related go-containerregistry issue: https://github.com/google/go-containerregistry/issues/1962
+func (a *noncompliantRegistryTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := http.DefaultTransport.RoundTrip(req)
+	if resp.StatusCode == http.StatusNotAcceptable && strings.Contains(req.URL.Path, "/referrers/") {
+		resp.StatusCode = http.StatusNotFound
+	}
+
+	return resp, err
 }
 
 // Ref: https://github.com/github/package-security/blob/main/garden/retrieve-sigstore-bundle-from-oci-registry.md
-func (c LiveClient) GetAttestations(name name.Reference, digest *v1.Hash) ([]*api.Attestation, error) {
-	attestations := []*api.Attestation{}
-	nameDegist := name.Context().Digest(digest.String())
+func (c LiveClient) GetAttestations(ref name.Reference, digest string) ([]*api.Attestation, error) {
+	attestations := make([]*api.Attestation, 0)
 
-	imageIndex, err := remote.Referrers(nameDegist, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	transportOpts := []remote.Option{remote.WithTransport(&noncompliantRegistryTransport{}), remote.WithAuthFromKeychain(authn.DefaultKeychain)}
+	referrers, err := remote.Referrers(ref.Context().Digest(digest), transportOpts...)
 	if err != nil {
-		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+		return attestations, fmt.Errorf("error getting referrers: %w", err)
 	}
-	indexManifest, err := imageIndex.IndexManifest()
+	refManifest, err := referrers.IndexManifest()
 	if err != nil {
-		return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+		return attestations, fmt.Errorf("error getting referrers manifest: %w", err)
 	}
-	manifests := indexManifest.Manifests
 
-	for _, m := range manifests {
-		if containAllowedArtifactTypes(m.ArtifactType) {
-			artifactManifestNameDigest := nameDegist.Context().Digest(m.Digest.String())
-			// TODO: replace to use GET for more correct type
-			// OR IS IT CORRECT TO USE type IMAGE?
-			artifactManifest, err := remote.Image(artifactManifestNameDigest, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	for _, refDesc := range refManifest.Manifests {
+		if !strings.HasPrefix(refDesc.ArtifactType, "application/vnd.dev.sigstore.bundle") {
+			continue
+		}
+
+		refImg, err := remote.Image(ref.Context().Digest(refDesc.Digest.String()), remote.WithAuthFromKeychain(authn.DefaultKeychain))
+		if err != nil {
+			return attestations, fmt.Errorf("error getting referrer image: %w", err)
+		}
+		layers, err := refImg.Layers()
+		if err != nil {
+			return attestations, fmt.Errorf("error getting referrer image: %w", err)
+		}
+
+		if len(layers) > 0 {
+			layer0, err := layers[0].Uncompressed()
 			if err != nil {
-				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+				return attestations, fmt.Errorf("error getting referrer image: %w", err)
 			}
+			defer layer0.Close()
+
+			bundleBytes, err := io.ReadAll(layer0)
 
-			// Step 4: Get the layers
-			layers, err := artifactManifest.Layers()
 			if err != nil {
-				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+				return attestations, fmt.Errorf("error getting referrer image: %w", err)
 			}
 
-			// For simplicity, we'll just fetch the first layer
-			if len(layers) > 0 {
-				layer := layers[0]
+			b := &bundle.ProtobufBundle{}
+			err = b.UnmarshalJSON(bundleBytes)
 
-				// Step 5: Read the layer content
-				rc, err := layer.Compressed()
-				if err != nil {
-					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-				}
-				defer rc.Close()
-
-				layerBytes, err := io.ReadAll(rc)
-
-				if err != nil {
-					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-				}
-
-				var bundle bundle.ProtobufBundle
-				bundle.Bundle = new(protobundle.Bundle)
-				err = bundle.UnmarshalJSON(layerBytes)
-
-				if err != nil {
-					return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
-				}
-
-				a := api.Attestation{Bundle: &bundle}
-				attestations = append(attestations, &a)
-			} else {
-				return attestations, fmt.Errorf("failed to fetch remote image: %v", err)
+			if err != nil {
+				return attestations, fmt.Errorf("error unmarshalling bundle: %w", err)
 			}
+
+			a := api.Attestation{Bundle: b}
+			attestations = append(attestations, &a)
+		} else {
+			return attestations, fmt.Errorf("error getting referrer image: no layers found")
 		}
 	}
 	return attestations, nil
 }
 
-func containAllowedArtifactTypes(artifactType string) bool {
-	allowedArtifactTypes := []string{"application/vnd.dev.sigstore.bundle.v0.3+json"}
-
-	for _, allowedType := range allowedArtifactTypes {
-		if allowedType == artifactType {
-			return true
-		}
-	}
-	return false
-}
-
 // Unlike other parts of this command set, we cannot pass a custom HTTP client
 // to the go-containerregistry library. This means we have limited visibility
 // into the HTTP requests being made to container registries.
diff --git a/pkg/cmd/attestation/artifact/oci/client_test.go b/pkg/cmd/attestation/artifact/oci/client_test.go
index 9aa415c47..a46533366 100644
--- a/pkg/cmd/attestation/artifact/oci/client_test.go
+++ b/pkg/cmd/attestation/artifact/oci/client_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/google/go-containerregistry/pkg/v1"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
 
@@ -30,9 +30,10 @@ func TestGetImageDigest_Success(t *testing.T) {
 		},
 	}
 
-	digest, err := c.GetImageDigest("test")
+	digest, nameRef, err := c.GetImageDigest("test")
 	require.NoError(t, err)
 	require.Equal(t, &expectedDigest, digest)
+	require.Equal(t, name.Tag{}, nameRef)
 }
 
 func TestGetImageDigest_ReferenceFail(t *testing.T) {
@@ -45,9 +46,10 @@ func TestGetImageDigest_ReferenceFail(t *testing.T) {
 		},
 	}
 
-	digest, err := c.GetImageDigest("test")
+	digest, nameRef, err := c.GetImageDigest("test")
 	require.Error(t, err)
 	require.Nil(t, digest)
+	require.Nil(t, nameRef)
 }
 
 func TestGetImageDigest_AuthFail(t *testing.T) {
@@ -60,10 +62,11 @@ func TestGetImageDigest_AuthFail(t *testing.T) {
 		},
 	}
 
-	digest, err := c.GetImageDigest("test")
+	digest, nameRef, err := c.GetImageDigest("test")
 	require.Error(t, err)
 	require.ErrorIs(t, err, ErrRegistryAuthz)
 	require.Nil(t, digest)
+	require.Nil(t, nameRef)
 }
 
 func TestGetImageDigest_Denied(t *testing.T) {
@@ -76,8 +79,9 @@ func TestGetImageDigest_Denied(t *testing.T) {
 		},
 	}
 
-	digest, err := c.GetImageDigest("test")
+	digest, nameRef, err := c.GetImageDigest("test")
 	require.Error(t, err)
 	require.ErrorIs(t, err, ErrDenied)
 	require.Nil(t, digest)
+	require.Nil(t, nameRef)
 }
diff --git a/pkg/cmd/attestation/artifact/oci/mock_client.go b/pkg/cmd/attestation/artifact/oci/mock_client.go
index 24368dec8..1c9bd7876 100644
--- a/pkg/cmd/attestation/artifact/oci/mock_client.go
+++ b/pkg/cmd/attestation/artifact/oci/mock_client.go
@@ -3,32 +3,70 @@ package oci
 import (
 	"fmt"
 
-	"github.com/google/go-containerregistry/pkg/v1"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/test/data"
+	"github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
 )
 
+func makeTestAttestation() api.Attestation {
+	return api.Attestation{Bundle: data.SigstoreBundle(nil)}
+}
+
 type MockClient struct{}
 
-func (c MockClient) GetImageDigest(imgName string) (*v1.Hash, error) {
+func (c MockClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
 	return &v1.Hash{
 		Hex:       "1234567890abcdef",
 		Algorithm: "sha256",
-	}, nil
+	}, nil, nil
+}
+
+func (c MockClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	att1 := makeTestAttestation()
+	att2 := makeTestAttestation()
+	return []*api.Attestation{&att1, &att2}, nil
 }
 
 type ReferenceFailClient struct{}
 
-func (c ReferenceFailClient) GetImageDigest(imgName string) (*v1.Hash, error) {
-	return nil, fmt.Errorf("failed to parse reference")
+func (c ReferenceFailClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	return nil, nil, fmt.Errorf("failed to parse reference")
+}
+
+func (c ReferenceFailClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	return nil, nil
 }
 
 type AuthFailClient struct{}
 
-func (c AuthFailClient) GetImageDigest(imgName string) (*v1.Hash, error) {
-	return nil, ErrRegistryAuthz
+func (c AuthFailClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	return nil, nil, ErrRegistryAuthz
+}
+
+func (c AuthFailClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	return nil, nil
 }
 
 type DeniedClient struct{}
 
-func (c DeniedClient) GetImageDigest(imgName string) (*v1.Hash, error) {
-	return nil, ErrDenied
+func (c DeniedClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	return nil, nil, ErrDenied
+}
+
+func (c DeniedClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	return nil, nil
+}
+
+type DeniedAttestationsClient struct{}
+
+func (c DeniedAttestationsClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	return &v1.Hash{
+		Hex:       "1234567890abcdef",
+		Algorithm: "sha256",
+	}, nil, nil
+}
+
+func (c DeniedAttestationsClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	return nil, nil
 }
diff --git a/pkg/cmd/attestation/download/download.go b/pkg/cmd/attestation/download/download.go
index 6d74027ae..3af3b6200 100644
--- a/pkg/cmd/attestation/download/download.go
+++ b/pkg/cmd/attestation/download/download.go
@@ -111,7 +111,7 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 }
 
 func runDownload(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, false)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
 	if err != nil {
 		return fmt.Errorf("failed to digest artifact: %v", err)
 	}
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index f38181b77..2731ee7a4 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -97,7 +97,7 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 }
 
 func runInspect(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, false)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
 	if err != nil {
 		return fmt.Errorf("failed to digest artifact: %s", err)
 	}
diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 902657d41..20e6a01bf 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
+	"github.com/google/go-containerregistry/pkg/name"
 	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
 	"github.com/sigstore/sigstore-go/pkg/bundle"
 )
@@ -16,13 +18,15 @@ import (
 var ErrUnrecognisedBundleExtension = errors.New("bundle file extension not supported, must be json or jsonl")
 
 type FetchAttestationsConfig struct {
-	APIClient           api.Client
-	BundlePath          string
-	Digest              string
-	Limit               int
-	Owner               string
-	Repo                string
-	AttestationsFromOCI []*api.Attestation
+	APIClient             api.Client
+	BundlePath            string
+	Digest                string
+	Limit                 int
+	Owner                 string
+	Repo                  string
+	OCIClient             oci.Client
+	UseBundleFromRegistry bool
+	NameRef               name.Reference
 }
 
 func (c *FetchAttestationsConfig) IsBundleProvided() bool {
@@ -34,8 +38,8 @@ func GetAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error) {
 		return GetLocalAttestations(c.BundlePath)
 	}
 
-	if len(c.AttestationsFromOCI) > 0 {
-		return c.AttestationsFromOCI, nil
+	if c.UseBundleFromRegistry {
+		return GetOCIAttestations(c)
 	}
 
 	return GetRemoteAttestations(c)
@@ -121,6 +125,18 @@ func GetRemoteAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error
 	return nil, fmt.Errorf("owner or repo must be provided")
 }
 
+func GetOCIAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error) {
+
+	attestations, err := c.OCIClient.GetAttestations(c.NameRef, c.Digest)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch OCI attestations: %w", err)
+	}
+	if len(attestations) == 0 {
+		return nil, fmt.Errorf("no OCI attestations found")
+	}
+	return attestations, nil
+}
+
 type IntotoStatement struct {
 	PredicateType string `json:"predicateType"`
 }
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index ffa87a383..5f4e70fbc 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -174,7 +174,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 }
 
 func runVerify(opts *Options) error {
-	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm, opts.UseBundleFromRegistry)
+	artifact, err := artifact.NewDigestedArtifact(opts.OCIClient, opts.ArtifactPath, opts.DigestAlgorithm)
 	if err != nil {
 		opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading digest for %s failed\n"), opts.ArtifactPath)
 		return err
@@ -183,13 +183,15 @@ func runVerify(opts *Options) error {
 	opts.Logger.Printf("Loaded digest %s for %s\n", artifact.DigestWithAlg(), artifact.URL)
 
 	c := verification.FetchAttestationsConfig{
-		APIClient:           opts.APIClient,
-		BundlePath:          opts.BundlePath,
-		Digest:              artifact.DigestWithAlg(),
-		Limit:               opts.Limit,
-		Owner:               opts.Owner,
-		Repo:                opts.Repo,
-		AttestationsFromOCI: artifact.Attestations(),
+		APIClient:             opts.APIClient,
+		BundlePath:            opts.BundlePath,
+		Digest:                artifact.DigestWithAlg(),
+		Limit:                 opts.Limit,
+		Owner:                 opts.Owner,
+		Repo:                  opts.Repo,
+		OCIClient:             opts.OCIClient,
+		UseBundleFromRegistry: opts.UseBundleFromRegistry,
+		NameRef:               artifact.NameRef(),
 	}
 	attestations, err := verification.GetAttestations(c)
 	if err != nil {
@@ -200,7 +202,7 @@ func runVerify(opts *Options) error {
 
 		if c.IsBundleProvided() {
 			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading attestations from %s failed\n"), artifact.URL)
-		} else if opts.UseBundleFromRegistry {
+		} else if c.UseBundleFromRegistry {
 			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from OCI registry failed"))
 		} else {
 			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from GitHub API failed"))
@@ -211,7 +213,7 @@ func runVerify(opts *Options) error {
 	pluralAttestation := text.Pluralize(len(attestations), "attestation")
 	if c.IsBundleProvided() {
 		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.BundlePath)
-	} else if opts.UseBundleFromRegistry {
+	} else if c.UseBundleFromRegistry {
 		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.ArtifactPath)
 	} else {
 		opts.Logger.Printf("Loaded %s from GitHub API\n", pluralAttestation)
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 8d06617f3..902fbc2d4 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -463,4 +463,31 @@ func TestRunVerify(t *testing.T) {
 		customOpts.BundlePath = ""
 		require.Error(t, runVerify(&customOpts))
 	})
+
+	t.Run("with valid OCI artifact", func(t *testing.T) {
+		customOpts := publicGoodOpts
+		customOpts.ArtifactPath = "oci://ghcr.io/github/test"
+		customOpts.BundlePath = ""
+
+		require.Nil(t, runVerify(&customOpts))
+	})
+
+	t.Run("with valid OCI artifact with UseBundleFromRegistry flag", func(t *testing.T) {
+		customOpts := publicGoodOpts
+		customOpts.ArtifactPath = "oci://ghcr.io/github/test"
+		customOpts.BundlePath = ""
+		customOpts.UseBundleFromRegistry = true
+
+		require.Nil(t, runVerify(&customOpts))
+	})
+
+	t.Run("with valid OCI artifact with UseBundleFromRegistry flag but fail on fetching bundle from registry", func(t *testing.T) {
+		customOpts := publicGoodOpts
+		customOpts.ArtifactPath = "oci://ghcr.io/github/test"
+		customOpts.BundlePath = ""
+		customOpts.UseBundleFromRegistry = true
+		customOpts.OCIClient = oci.DeniedAttestationsClient{}
+
+		require.ErrorContains(t, runVerify(&customOpts), "no OCI attestations found")
+	})
 }

From d1cd69c81c10bedf6e955e934ab8f326a3535236 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Wed, 7 Aug 2024 10:16:30 -0700
Subject: [PATCH 006/301] minor fixed

---
 pkg/cmd/attestation/artifact/oci/client.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 55d74fac0..45c28cf7f 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -40,7 +40,6 @@ func checkForUnauthorizedOrDeniedErr(err transport.Error) error {
 type LiveClient struct {
 	parseReference func(string, ...name.Option) (name.Reference, error)
 	get            func(name.Reference, ...remote.Option) (*remote.Descriptor, error)
-	referres       func(d name.Digest, options ...remote.Option) (v1.ImageIndex, error)
 }
 
 func (c LiveClient) ParseReference(ref string) (name.Reference, error) {

From 832a43072cf24aac5f8daaf118fc885527dda39b Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Wed, 7 Aug 2024 10:19:47 -0700
Subject: [PATCH 007/301] minor fixed

---
 pkg/cmd/attestation/artifact/oci/client.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 45c28cf7f..046601637 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -82,6 +82,9 @@ type noncompliantRegistryTransport struct{}
 // See the related go-containerregistry issue: https://github.com/google/go-containerregistry/issues/1962
 func (a *noncompliantRegistryTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	resp, err := http.DefaultTransport.RoundTrip(req)
+	if err != nil {
+		return resp, err
+	}
 	if resp.StatusCode == http.StatusNotAcceptable && strings.Contains(req.URL.Path, "/referrers/") {
 		resp.StatusCode = http.StatusNotFound
 	}

From 5ae03d6e878fcce9743307e5b7a70f1f877e5e3d Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 12 Aug 2024 07:10:19 -0700
Subject: [PATCH 008/301] addded more test

---
 pkg/cmd/attestation/artifact/oci/client.go    |  1 -
 .../attestation/artifact/oci/mock_client.go   | 19 ++++++++++++++++---
 .../attestation/verification/attestation.go   |  1 -
 pkg/cmd/attestation/verify/verify_test.go     | 12 +++++++++++-
 4 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 046601637..5428fff2f 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -92,7 +92,6 @@ func (a *noncompliantRegistryTransport) RoundTrip(req *http.Request) (*http.Resp
 	return resp, err
 }
 
-// Ref: https://github.com/github/package-security/blob/main/garden/retrieve-sigstore-bundle-from-oci-registry.md
 func (c LiveClient) GetAttestations(ref name.Reference, digest string) ([]*api.Attestation, error) {
 	attestations := make([]*api.Attestation, 0)
 
diff --git a/pkg/cmd/attestation/artifact/oci/mock_client.go b/pkg/cmd/attestation/artifact/oci/mock_client.go
index 1c9bd7876..b869c60a9 100644
--- a/pkg/cmd/attestation/artifact/oci/mock_client.go
+++ b/pkg/cmd/attestation/artifact/oci/mock_client.go
@@ -58,15 +58,28 @@ func (c DeniedClient) GetAttestations(name name.Reference, digest string) ([]*ap
 	return nil, nil
 }
 
-type DeniedAttestationsClient struct{}
+type NoAttestationsClient struct{}
 
-func (c DeniedAttestationsClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+func (c NoAttestationsClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
 	return &v1.Hash{
 		Hex:       "1234567890abcdef",
 		Algorithm: "sha256",
 	}, nil, nil
 }
 
-func (c DeniedAttestationsClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+func (c NoAttestationsClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
 	return nil, nil
 }
+
+type FailedToFetchAttestationsClient struct{}
+
+func (c FailedToFetchAttestationsClient) GetImageDigest(imgName string) (*v1.Hash, name.Reference, error) {
+	return &v1.Hash{
+		Hex:       "1234567890abcdef",
+		Algorithm: "sha256",
+	}, nil, nil
+}
+
+func (c FailedToFetchAttestationsClient) GetAttestations(name name.Reference, digest string) ([]*api.Attestation, error) {
+	return nil, fmt.Errorf("failed to fetch attestations")
+}
diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 20e6a01bf..c1fb25b12 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -126,7 +126,6 @@ func GetRemoteAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error
 }
 
 func GetOCIAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error) {
-
 	attestations, err := c.OCIClient.GetAttestations(c.NameRef, c.Digest)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch OCI attestations: %w", err)
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 902fbc2d4..0f31d900c 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -481,12 +481,22 @@ func TestRunVerify(t *testing.T) {
 		require.Nil(t, runVerify(&customOpts))
 	})
 
+	t.Run("with valid OCI artifact with UseBundleFromRegistry flag but no bundle return from registry", func(t *testing.T) {
+		customOpts := publicGoodOpts
+		customOpts.ArtifactPath = "oci://ghcr.io/github/test"
+		customOpts.BundlePath = ""
+		customOpts.UseBundleFromRegistry = true
+		customOpts.OCIClient = oci.NoAttestationsClient{}
+
+		require.ErrorContains(t, runVerify(&customOpts), "no OCI attestations found")
+	})
+
 	t.Run("with valid OCI artifact with UseBundleFromRegistry flag but fail on fetching bundle from registry", func(t *testing.T) {
 		customOpts := publicGoodOpts
 		customOpts.ArtifactPath = "oci://ghcr.io/github/test"
 		customOpts.BundlePath = ""
 		customOpts.UseBundleFromRegistry = true
-		customOpts.OCIClient = oci.DeniedAttestationsClient{}
+		customOpts.OCIClient = oci.NoAttestationsClient{}
 
 		require.ErrorContains(t, runVerify(&customOpts), "no OCI attestations found")
 	})

From 05891965d0c8827fcee6019bf28258c64a77a3fd Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Thu, 15 Aug 2024 11:56:28 -0400
Subject: [PATCH 009/301] udpate the options

---
 pkg/cmd/attestation/verify/options.go      | 10 +++++
 pkg/cmd/attestation/verify/options_test.go | 43 ++++++++++++++++++++++
 pkg/cmd/attestation/verify/verify.go       |  2 +-
 3 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verify/options.go b/pkg/cmd/attestation/verify/options.go
index 902024b90..a21e27c58 100644
--- a/pkg/cmd/attestation/verify/options.go
+++ b/pkg/cmd/attestation/verify/options.go
@@ -84,6 +84,16 @@ func (opts *Options) AreFlagsValid() error {
 		return fmt.Errorf("limit %d not allowed, must be between 1 and 1000", opts.Limit)
 	}
 
+	// Check that the bundle-from-registry flag is only used with OCI artifact paths
+	if opts.UseBundleFromRegistry && !strings.HasPrefix(opts.ArtifactPath, "oci://") {
+		return fmt.Errorf("bundle-from-registry flag can only be used with OCI artifact paths")
+	}
+
+	// Check that both the bundle-from-registry and bundle-path flags are not used together
+	if opts.UseBundleFromRegistry && opts.BundlePath != "" {
+		return fmt.Errorf("bundle-from-registry flag cannot be used with bundle-path flag")
+	}
+
 	return nil
 }
 
diff --git a/pkg/cmd/attestation/verify/options_test.go b/pkg/cmd/attestation/verify/options_test.go
index aea131b27..9fd319041 100644
--- a/pkg/cmd/attestation/verify/options_test.go
+++ b/pkg/cmd/attestation/verify/options_test.go
@@ -116,4 +116,47 @@ func TestSetPolicyFlags(t *testing.T) {
 		require.Equal(t, "sigstore", opts.Owner)
 		require.Equal(t, "^https://github/foo", opts.SANRegex)
 	})
+
+	t.Run("returns error when UseBundleFromRegistry is true and ArtifactPath is not an OCI path", func(t *testing.T) {
+		opts := Options{
+			ArtifactPath:          publicGoodArtifactPath,
+			DigestAlgorithm:       "sha512",
+			Owner:                 "sigstore",
+			UseBundleFromRegistry: true,
+			Limit:                 1,
+		}
+
+		err := opts.AreFlagsValid()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "bundle-from-registry flag can only be used with OCI artifact paths")
+	})
+
+	t.Run("does not return error when UseBundleFromRegistry is true and ArtifactPath is an OCI path", func(t *testing.T) {
+		opts := Options{
+			ArtifactPath:          "oci://sigstore/sigstore-js:2.1.0",
+			DigestAlgorithm:       "sha512",
+			OIDCIssuer:            "some issuer",
+			Owner:                 "sigstore",
+			UseBundleFromRegistry: true,
+			Limit:                 1,
+		}
+
+		err := opts.AreFlagsValid()
+		require.NoError(t, err)
+	})
+
+	t.Run("returns error when UseBundleFromRegistry is true and BundlePath is provided", func(t *testing.T) {
+		opts := Options{
+			ArtifactPath:          "oci://sigstore/sigstore-js:2.1.0",
+			BundlePath:            publicGoodBundlePath,
+			DigestAlgorithm:       "sha512",
+			Owner:                 "sigstore",
+			UseBundleFromRegistry: true,
+			Limit:                 1,
+		}
+
+		err := opts.AreFlagsValid()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "bundle-from-registry flag cannot be used with bundle-path flag")
+	})
 }
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 5f4e70fbc..f77f5f822 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -150,7 +150,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	// general flags
 	verifyCmd.Flags().StringVarP(&opts.BundlePath, "bundle", "b", "", "Path to bundle on disk, either a single bundle in a JSON file or a JSON lines file with multiple bundles")
 	cmdutil.DisableAuthCheckFlag(verifyCmd.Flags().Lookup("bundle"))
-	verifyCmd.Flags().BoolVarP(&opts.UseBundleFromRegistry, "bundle-from-registry", "", false, "Use the bundle from the OCI registry")
+	verifyCmd.Flags().BoolVarP(&opts.UseBundleFromRegistry, "bundle-from-registry", "", false, "Use the bundle from the OCI registry when artifact is an OCI image")
 	cmdutil.StringEnumFlag(verifyCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	verifyCmd.Flags().StringVarP(&opts.Owner, "owner", "o", "", "GitHub organization to scope attestation lookup by")
 	verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")

From 009838a8db80f8c459be56bbc04792f58f5f72e4 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Thu, 15 Aug 2024 11:34:43 -0700
Subject: [PATCH 010/301] Always print URL scheme to stdout

Fixes #9470
---
 internal/text/text.go      |  9 +++++++--
 internal/text/text_test.go | 30 ++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/internal/text/text.go b/internal/text/text.go
index c14071c32..e5793cf04 100644
--- a/internal/text/text.go
+++ b/internal/text/text.go
@@ -65,14 +65,19 @@ func FuzzyAgoAbbr(a, b time.Time) string {
 	return b.Format("Jan _2, 2006")
 }
 
-// DisplayURL returns a copy of the string urlStr removing everything except the hostname and path.
+// DisplayURL returns a copy of the string urlStr removing everything except the scheme, hostname, and path.
+// If the scheme is not specified, "https" is assumed.
 // If there is an error parsing urlStr then urlStr is returned without modification.
 func DisplayURL(urlStr string) string {
 	u, err := url.Parse(urlStr)
 	if err != nil {
 		return urlStr
 	}
-	return u.Hostname() + u.Path
+	scheme := u.Scheme
+	if scheme == "" {
+		scheme = "https"
+	}
+	return scheme + "://" + u.Hostname() + u.Path
 }
 
 // RemoveDiacritics returns the input value without "diacritics", or accent marks
diff --git a/internal/text/text_test.go b/internal/text/text_test.go
index 46566bbf8..906a68762 100644
--- a/internal/text/text_test.go
+++ b/internal/text/text_test.go
@@ -146,3 +146,33 @@ func TestFormatSlice(t *testing.T) {
 		})
 	}
 }
+
+func TestDisplayURL(t *testing.T) {
+	tests := []struct {
+		name string
+		url  string
+		want string
+	}{
+		{
+			name: "simple",
+			url:  "https://github.com/cli/cli/issues/9470",
+			want: "https://github.com/cli/cli/issues/9470",
+		},
+		{
+			name: "without scheme",
+			url:  "github.com/cli/cli/issues/9470",
+			want: "https://github.com/cli/cli/issues/9470",
+		},
+		{
+			name: "with query param and anchor",
+			url:  "https://github.com/cli/cli/issues/9470?q=is:issue#issue-command",
+			want: "https://github.com/cli/cli/issues/9470",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, DisplayURL(tt.url))
+		})
+	}
+}

From 81f3526740085358cb1e2ccc75873f36ab85fe58 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Thu, 15 Aug 2024 11:44:26 -0700
Subject: [PATCH 011/301] Fix tests

---
 pkg/cmd/gist/create/create_test.go     |  2 +-
 pkg/cmd/issue/comment/comment_test.go  |  4 ++--
 pkg/cmd/issue/create/create_test.go    | 14 +++++++-------
 pkg/cmd/issue/list/list_test.go        |  2 +-
 pkg/cmd/issue/view/view_test.go        |  2 +-
 pkg/cmd/label/list_test.go             |  2 +-
 pkg/cmd/pr/checks/checks_test.go       |  2 +-
 pkg/cmd/pr/comment/comment_test.go     |  4 ++--
 pkg/cmd/pr/create/create_test.go       |  4 ++--
 pkg/cmd/pr/diff/diff_test.go           |  2 +-
 pkg/cmd/pr/list/list_test.go           |  2 +-
 pkg/cmd/pr/view/view_test.go           |  2 +-
 pkg/cmd/repo/view/view_test.go         |  2 +-
 pkg/cmd/ruleset/check/check_test.go    |  4 ++--
 pkg/cmd/ruleset/list/list_test.go      |  4 ++--
 pkg/cmd/ruleset/view/view_test.go      |  4 ++--
 pkg/cmd/run/view/view_test.go          |  4 ++--
 pkg/cmd/search/code/code_test.go       |  2 +-
 pkg/cmd/search/commits/commits_test.go |  2 +-
 pkg/cmd/search/repos/repos_test.go     |  2 +-
 pkg/cmd/search/shared/shared_test.go   |  2 +-
 pkg/cmd/workflow/view/view_test.go     |  6 +++---
 22 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/pkg/cmd/gist/create/create_test.go b/pkg/cmd/gist/create/create_test.go
index 40c89c0d8..237486eb3 100644
--- a/pkg/cmd/gist/create/create_test.go
+++ b/pkg/cmd/gist/create/create_test.go
@@ -296,7 +296,7 @@ func Test_createRun(t *testing.T) {
 				WebMode:   true,
 				Filenames: []string{fixtureFile},
 			},
-			wantOut:    "Opening gist.github.com/aa5a315d61ae9438b18d in your browser.\n",
+			wantOut:    "Opening https://gist.github.com/aa5a315d61ae9438b18d in your browser.\n",
 			wantStderr: "- Creating gist fixture.txt\n✓ Created secret gist fixture.txt\n",
 			wantErr:    false,
 			wantBrowse: "https://gist.github.com/aa5a315d61ae9438b18d",
diff --git a/pkg/cmd/issue/comment/comment_test.go b/pkg/cmd/issue/comment/comment_test.go
index 6ab8df050..668d758e5 100644
--- a/pkg/cmd/issue/comment/comment_test.go
+++ b/pkg/cmd/issue/comment/comment_test.go
@@ -234,7 +234,7 @@ func Test_commentRun(t *testing.T) {
 
 				OpenInBrowser: func(string) error { return nil },
 			},
-			stderr: "Opening github.com/OWNER/REPO/issues/123 in your browser.\n",
+			stderr: "Opening https://github.com/OWNER/REPO/issues/123 in your browser.\n",
 		},
 		{
 			name: "non-interactive web with edit last",
@@ -246,7 +246,7 @@ func Test_commentRun(t *testing.T) {
 
 				OpenInBrowser: func(string) error { return nil },
 			},
-			stderr: "Opening github.com/OWNER/REPO/issues/123 in your browser.\n",
+			stderr: "Opening https://github.com/OWNER/REPO/issues/123 in your browser.\n",
 		},
 		{
 			name: "non-interactive editor",
diff --git a/pkg/cmd/issue/create/create_test.go b/pkg/cmd/issue/create/create_test.go
index 9ae959c57..b95b5ef66 100644
--- a/pkg/cmd/issue/create/create_test.go
+++ b/pkg/cmd/issue/create/create_test.go
@@ -266,7 +266,7 @@ func Test_createRun(t *testing.T) {
 				WebMode: true,
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new in your browser.\n",
 		},
 		{
 			name: "title and body",
@@ -276,7 +276,7 @@ func Test_createRun(t *testing.T) {
 				Body:    "hello cli",
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new?body=hello+cli&title=myissue",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new in your browser.\n",
 		},
 		{
 			name: "assignee",
@@ -285,7 +285,7 @@ func Test_createRun(t *testing.T) {
 				Assignees: []string{"monalisa"},
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new?assignees=monalisa&body=",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new in your browser.\n",
 		},
 		{
 			name: "@me",
@@ -302,7 +302,7 @@ func Test_createRun(t *testing.T) {
 					} }`))
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new?assignees=MonaLisa&body=",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new in your browser.\n",
 		},
 		{
 			name: "project",
@@ -358,7 +358,7 @@ func Test_createRun(t *testing.T) {
 					} } } }`))
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new?body=&projects=OWNER%2FREPO%2F1",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new in your browser.\n",
 		},
 		{
 			name: "has templates",
@@ -378,7 +378,7 @@ func Test_createRun(t *testing.T) {
 				)
 			},
 			wantsBrowse: "https://github.com/OWNER/REPO/issues/new/choose",
-			wantsStderr: "Opening github.com/OWNER/REPO/issues/new/choose in your browser.\n",
+			wantsStderr: "Opening https://github.com/OWNER/REPO/issues/new/choose in your browser.\n",
 		},
 		{
 			name: "too long body",
@@ -763,7 +763,7 @@ func TestIssueCreate_continueInBrowser(t *testing.T) {
 
 		Creating issue in OWNER/REPO
 
-		Opening github.com/OWNER/REPO/issues/new in your browser.
+		Opening https://github.com/OWNER/REPO/issues/new in your browser.
 	`), output.Stderr())
 	assert.Equal(t, "https://github.com/OWNER/REPO/issues/new?body=body&title=hello", output.BrowsedURL)
 }
diff --git a/pkg/cmd/issue/list/list_test.go b/pkg/cmd/issue/list/list_test.go
index e45fc76e4..852f0a46b 100644
--- a/pkg/cmd/issue/list/list_test.go
+++ b/pkg/cmd/issue/list/list_test.go
@@ -224,7 +224,7 @@ func TestIssueList_web(t *testing.T) {
 	}
 
 	assert.Equal(t, "", stdout.String())
-	assert.Equal(t, "Opening github.com/OWNER/REPO/issues in your browser.\n", stderr.String())
+	assert.Equal(t, "Opening https://github.com/OWNER/REPO/issues in your browser.\n", stderr.String())
 	browser.Verify(t, "https://github.com/OWNER/REPO/issues?q=assignee%3Apeter+author%3Ajohn+label%3Abug+label%3Adocs+mentions%3Afrank+milestone%3Av1.1+type%3Aissue")
 }
 
diff --git a/pkg/cmd/issue/view/view_test.go b/pkg/cmd/issue/view/view_test.go
index f77db9abc..e1798af9f 100644
--- a/pkg/cmd/issue/view/view_test.go
+++ b/pkg/cmd/issue/view/view_test.go
@@ -123,7 +123,7 @@ func TestIssueView_web(t *testing.T) {
 	}
 
 	assert.Equal(t, "", stdout.String())
-	assert.Equal(t, "Opening github.com/OWNER/REPO/issues/123 in your browser.\n", stderr.String())
+	assert.Equal(t, "Opening https://github.com/OWNER/REPO/issues/123 in your browser.\n", stderr.String())
 	browser.Verify(t, "https://github.com/OWNER/REPO/issues/123")
 }
 
diff --git a/pkg/cmd/label/list_test.go b/pkg/cmd/label/list_test.go
index 37f458439..6f066da32 100644
--- a/pkg/cmd/label/list_test.go
+++ b/pkg/cmd/label/list_test.go
@@ -296,7 +296,7 @@ func TestListRun(t *testing.T) {
 			name:       "web mode",
 			tty:        true,
 			opts:       &listOptions{WebMode: true},
-			wantStderr: "Opening github.com/OWNER/REPO/labels in your browser.\n",
+			wantStderr: "Opening https://github.com/OWNER/REPO/labels in your browser.\n",
 		},
 		{
 			name: "order by name ascending",
diff --git a/pkg/cmd/pr/checks/checks_test.go b/pkg/cmd/pr/checks/checks_test.go
index cc21043ba..36ebf9b15 100644
--- a/pkg/cmd/pr/checks/checks_test.go
+++ b/pkg/cmd/pr/checks/checks_test.go
@@ -622,7 +622,7 @@ func TestChecksRun_web(t *testing.T) {
 		{
 			name:       "tty",
 			isTTY:      true,
-			wantStderr: "Opening github.com/OWNER/REPO/pull/123/checks in your browser.\n",
+			wantStderr: "Opening https://github.com/OWNER/REPO/pull/123/checks in your browser.\n",
 			wantStdout: "",
 			wantBrowse: "https://github.com/OWNER/REPO/pull/123/checks",
 		},
diff --git a/pkg/cmd/pr/comment/comment_test.go b/pkg/cmd/pr/comment/comment_test.go
index 8de1be940..56cf58d21 100644
--- a/pkg/cmd/pr/comment/comment_test.go
+++ b/pkg/cmd/pr/comment/comment_test.go
@@ -254,7 +254,7 @@ func Test_commentRun(t *testing.T) {
 
 				OpenInBrowser: func(string) error { return nil },
 			},
-			stderr: "Opening github.com/OWNER/REPO/pull/123 in your browser.\n",
+			stderr: "Opening https://github.com/OWNER/REPO/pull/123 in your browser.\n",
 		},
 		{
 			name: "non-interactive web with edit last",
@@ -266,7 +266,7 @@ func Test_commentRun(t *testing.T) {
 
 				OpenInBrowser: func(string) error { return nil },
 			},
-			stderr: "Opening github.com/OWNER/REPO/pull/123 in your browser.\n",
+			stderr: "Opening https://github.com/OWNER/REPO/pull/123 in your browser.\n",
 		},
 		{
 			name: "non-interactive editor",
diff --git a/pkg/cmd/pr/create/create_test.go b/pkg/cmd/pr/create/create_test.go
index e0347945c..cba552101 100644
--- a/pkg/cmd/pr/create/create_test.go
+++ b/pkg/cmd/pr/create/create_test.go
@@ -1080,7 +1080,7 @@ func Test_createRun(t *testing.T) {
 					}
 				}
 			},
-			expectedErrOut: "Opening github.com/OWNER/REPO/compare/master...feature in your browser.\n",
+			expectedErrOut: "Opening https://github.com/OWNER/REPO/compare/master...feature in your browser.\n",
 			expectedBrowse: "https://github.com/OWNER/REPO/compare/master...feature?body=&expand=1",
 		},
 		{
@@ -1113,7 +1113,7 @@ func Test_createRun(t *testing.T) {
 					}
 				}
 			},
-			expectedErrOut: "Opening github.com/OWNER/REPO/compare/master...feature in your browser.\n",
+			expectedErrOut: "Opening https://github.com/OWNER/REPO/compare/master...feature in your browser.\n",
 			expectedBrowse: "https://github.com/OWNER/REPO/compare/master...feature?body=&expand=1&projects=ORG%2F1",
 		},
 		{
diff --git a/pkg/cmd/pr/diff/diff_test.go b/pkg/cmd/pr/diff/diff_test.go
index be8c48428..28a83bfc4 100644
--- a/pkg/cmd/pr/diff/diff_test.go
+++ b/pkg/cmd/pr/diff/diff_test.go
@@ -218,7 +218,7 @@ func Test_diffRun(t *testing.T) {
 				BrowserMode: true,
 			},
 			wantFields:     []string{"url"},
-			wantStderr:     "Opening github.com/OWNER/REPO/pull/123/files in your browser.\n",
+			wantStderr:     "Opening https://github.com/OWNER/REPO/pull/123/files in your browser.\n",
 			wantBrowsedURL: "https://github.com/OWNER/REPO/pull/123/files",
 		},
 	}
diff --git a/pkg/cmd/pr/list/list_test.go b/pkg/cmd/pr/list/list_test.go
index 869db9c38..ecd0326b5 100644
--- a/pkg/cmd/pr/list/list_test.go
+++ b/pkg/cmd/pr/list/list_test.go
@@ -318,7 +318,7 @@ func TestPRList_web(t *testing.T) {
 			}
 
 			assert.Equal(t, "", output.String())
-			assert.Equal(t, "Opening github.com/OWNER/REPO/pulls in your browser.\n", output.Stderr())
+			assert.Equal(t, "Opening https://github.com/OWNER/REPO/pulls in your browser.\n", output.Stderr())
 			assert.Equal(t, test.expectedBrowserURL, output.BrowsedURL)
 		})
 	}
diff --git a/pkg/cmd/pr/view/view_test.go b/pkg/cmd/pr/view/view_test.go
index 2b99df931..470e3bd27 100644
--- a/pkg/cmd/pr/view/view_test.go
+++ b/pkg/cmd/pr/view/view_test.go
@@ -640,7 +640,7 @@ func TestPRView_web_currentBranch(t *testing.T) {
 	}
 
 	assert.Equal(t, "", output.String())
-	assert.Equal(t, "Opening github.com/OWNER/REPO/pull/10 in your browser.\n", output.Stderr())
+	assert.Equal(t, "Opening https://github.com/OWNER/REPO/pull/10 in your browser.\n", output.Stderr())
 	assert.Equal(t, "https://github.com/OWNER/REPO/pull/10", output.BrowsedURL)
 }
 
diff --git a/pkg/cmd/repo/view/view_test.go b/pkg/cmd/repo/view/view_test.go
index a8361e9ef..53ec93d13 100644
--- a/pkg/cmd/repo/view/view_test.go
+++ b/pkg/cmd/repo/view/view_test.go
@@ -108,7 +108,7 @@ func Test_RepoView_Web(t *testing.T) {
 		{
 			name:       "tty",
 			stdoutTTY:  true,
-			wantStderr: "Opening github.com/OWNER/REPO in your browser.\n",
+			wantStderr: "Opening https://github.com/OWNER/REPO in your browser.\n",
 			wantBrowse: "https://github.com/OWNER/REPO",
 		},
 		{
diff --git a/pkg/cmd/ruleset/check/check_test.go b/pkg/cmd/ruleset/check/check_test.go
index 2d9dffae4..b24e084c4 100644
--- a/pkg/cmd/ruleset/check/check_test.go
+++ b/pkg/cmd/ruleset/check/check_test.go
@@ -162,7 +162,7 @@ func Test_checkRun(t *testing.T) {
 				Branch:  "my-branch",
 				WebMode: true,
 			},
-			wantStdout: "Opening github.com/my-org/repo-name/rules in your browser.\n",
+			wantStdout: "Opening https://github.com/my-org/repo-name/rules in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/my-org/repo-name/rules?ref=refs%2Fheads%2Fmy-branch",
 		},
@@ -173,7 +173,7 @@ func Test_checkRun(t *testing.T) {
 				Branch:  "my-feature/my-branch",
 				WebMode: true,
 			},
-			wantStdout: "Opening github.com/my-org/repo-name/rules in your browser.\n",
+			wantStdout: "Opening https://github.com/my-org/repo-name/rules in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/my-org/repo-name/rules?ref=refs%2Fheads%2Fmy-feature%2Fmy-branch",
 		},
diff --git a/pkg/cmd/ruleset/list/list_test.go b/pkg/cmd/ruleset/list/list_test.go
index 1c370fcfb..2b4675b2f 100644
--- a/pkg/cmd/ruleset/list/list_test.go
+++ b/pkg/cmd/ruleset/list/list_test.go
@@ -255,7 +255,7 @@ func Test_listRun(t *testing.T) {
 			opts: ListOptions{
 				WebMode: true,
 			},
-			wantStdout: "Opening github.com/OWNER/REPO/rules in your browser.\n",
+			wantStdout: "Opening https://github.com/OWNER/REPO/rules in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/OWNER/REPO/rules",
 		},
@@ -266,7 +266,7 @@ func Test_listRun(t *testing.T) {
 				WebMode:      true,
 				Organization: "my-org",
 			},
-			wantStdout: "Opening github.com/organizations/my-org/settings/rules in your browser.\n",
+			wantStdout: "Opening https://github.com/organizations/my-org/settings/rules in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/organizations/my-org/settings/rules",
 		},
diff --git a/pkg/cmd/ruleset/view/view_test.go b/pkg/cmd/ruleset/view/view_test.go
index 5e2846441..e463a9ac4 100644
--- a/pkg/cmd/ruleset/view/view_test.go
+++ b/pkg/cmd/ruleset/view/view_test.go
@@ -317,7 +317,7 @@ func Test_viewRun(t *testing.T) {
 					httpmock.FileResponse("./fixtures/rulesetViewRepo.json"),
 				)
 			},
-			wantStdout: "Opening github.com/my-owner/repo-name/rules/42 in your browser.\n",
+			wantStdout: "Opening https://github.com/my-owner/repo-name/rules/42 in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/my-owner/repo-name/rules/42",
 		},
@@ -352,7 +352,7 @@ func Test_viewRun(t *testing.T) {
 					httpmock.FileResponse("./fixtures/rulesetViewOrg.json"),
 				)
 			},
-			wantStdout: "Opening github.com/organizations/my-owner/settings/rules/74 in your browser.\n",
+			wantStdout: "Opening https://github.com/organizations/my-owner/settings/rules/74 in your browser.\n",
 			wantStderr: "",
 			wantBrowse: "https://github.com/organizations/my-owner/settings/rules/74",
 		},
diff --git a/pkg/cmd/run/view/view_test.go b/pkg/cmd/run/view/view_test.go
index 44ca69fa6..60762c531 100644
--- a/pkg/cmd/run/view/view_test.go
+++ b/pkg/cmd/run/view/view_test.go
@@ -1183,7 +1183,7 @@ func TestViewRun(t *testing.T) {
 					httpmock.JSONResponse(shared.TestWorkflow))
 			},
 			browsedURL: "https://github.com/runs/3",
-			wantOut:    "Opening github.com/runs/3 in your browser.\n",
+			wantOut:    "Opening https://github.com/runs/3 in your browser.\n",
 		},
 		{
 			name: "web job",
@@ -1204,7 +1204,7 @@ func TestViewRun(t *testing.T) {
 					httpmock.JSONResponse(shared.TestWorkflow))
 			},
 			browsedURL: "https://github.com/jobs/10?check_suite_focus=true",
-			wantOut:    "Opening github.com/jobs/10 in your browser.\n",
+			wantOut:    "Opening https://github.com/jobs/10 in your browser.\n",
 		},
 		{
 			name: "hide job header, failure",
diff --git a/pkg/cmd/search/code/code_test.go b/pkg/cmd/search/code/code_test.go
index 253bd2889..4b493c6d5 100644
--- a/pkg/cmd/search/code/code_test.go
+++ b/pkg/cmd/search/code/code_test.go
@@ -304,7 +304,7 @@ func TestCodeRun(t *testing.T) {
 				WebMode: true,
 			},
 			tty:        true,
-			wantStderr: "Opening github.com/search in your browser.\n",
+			wantStderr: "Opening https://github.com/search in your browser.\n",
 		},
 		{
 			name: "opens browser for web mode notty",
diff --git a/pkg/cmd/search/commits/commits_test.go b/pkg/cmd/search/commits/commits_test.go
index efe022f32..d78599cbe 100644
--- a/pkg/cmd/search/commits/commits_test.go
+++ b/pkg/cmd/search/commits/commits_test.go
@@ -273,7 +273,7 @@ func TestCommitsRun(t *testing.T) {
 				WebMode: true,
 			},
 			tty:        true,
-			wantStderr: "Opening github.com/search in your browser.\n",
+			wantStderr: "Opening https://github.com/search in your browser.\n",
 		},
 		{
 			name: "opens browser for web mode notty",
diff --git a/pkg/cmd/search/repos/repos_test.go b/pkg/cmd/search/repos/repos_test.go
index 85e2547f1..3b725b049 100644
--- a/pkg/cmd/search/repos/repos_test.go
+++ b/pkg/cmd/search/repos/repos_test.go
@@ -249,7 +249,7 @@ func TestReposRun(t *testing.T) {
 				WebMode: true,
 			},
 			tty:        true,
-			wantStderr: "Opening github.com/search in your browser.\n",
+			wantStderr: "Opening https://github.com/search in your browser.\n",
 		},
 		{
 			name: "opens browser for web mode notty",
diff --git a/pkg/cmd/search/shared/shared_test.go b/pkg/cmd/search/shared/shared_test.go
index 689459d39..0700a688e 100644
--- a/pkg/cmd/search/shared/shared_test.go
+++ b/pkg/cmd/search/shared/shared_test.go
@@ -171,7 +171,7 @@ func TestSearchIssues(t *testing.T) {
 				WebMode: true,
 			},
 			tty:        true,
-			wantStderr: "Opening github.com/search in your browser.\n",
+			wantStderr: "Opening https://github.com/search in your browser.\n",
 		},
 		{
 			name: "opens browser for web mode notty",
diff --git a/pkg/cmd/workflow/view/view_test.go b/pkg/cmd/workflow/view/view_test.go
index c706da48f..e5df52478 100644
--- a/pkg/cmd/workflow/view/view_test.go
+++ b/pkg/cmd/workflow/view/view_test.go
@@ -222,7 +222,7 @@ func TestViewRun(t *testing.T) {
 					httpmock.JSONResponse(aWorkflow),
 				)
 			},
-			wantOut: "Opening github.com/OWNER/REPO/actions/workflows/flow.yml in your browser.\n",
+			wantOut: "Opening https://github.com/OWNER/REPO/actions/workflows/flow.yml in your browser.\n",
 		},
 		{
 			name: "web notty",
@@ -257,7 +257,7 @@ func TestViewRun(t *testing.T) {
 					httpmock.StringResponse(`{ "data": { "repository": { "defaultBranchRef": { "name": "trunk" } } } }`),
 				)
 			},
-			wantOut: "Opening github.com/OWNER/REPO/blob/trunk/.github/workflows/flow.yml in your browser.\n",
+			wantOut: "Opening https://github.com/OWNER/REPO/blob/trunk/.github/workflows/flow.yml in your browser.\n",
 		},
 		{
 			name: "web with yaml and ref",
@@ -274,7 +274,7 @@ func TestViewRun(t *testing.T) {
 					httpmock.JSONResponse(aWorkflow),
 				)
 			},
-			wantOut: "Opening github.com/OWNER/REPO/blob/base/.github/workflows/flow.yml in your browser.\n",
+			wantOut: "Opening https://github.com/OWNER/REPO/blob/base/.github/workflows/flow.yml in your browser.\n",
 		},
 		{
 			name: "workflow with yaml",

From 6b9a0aa89fc0643308ad2f584265a5950cf5df65 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Thu, 15 Aug 2024 22:52:13 -0700
Subject: [PATCH 012/301] Check http scheme as well

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 internal/text/text_test.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/text/text_test.go b/internal/text/text_test.go
index 906a68762..cae9b37c1 100644
--- a/internal/text/text_test.go
+++ b/internal/text/text_test.go
@@ -168,6 +168,11 @@ func TestDisplayURL(t *testing.T) {
 			url:  "https://github.com/cli/cli/issues/9470?q=is:issue#issue-command",
 			want: "https://github.com/cli/cli/issues/9470",
 		},
+		{
+			name: "preserve http protocol use despite insecure",
+			url:  "http://github.com/cli/cli/issues/9470",
+			want: "http://github.com/cli/cli/issues/9470",
+		},
 	}
 
 	for _, tt := range tests {

From 64415df08d301e08a151f09337dce994e72beb07 Mon Sep 17 00:00:00 2001
From: benebsiny <stu995106@hotmail.com.tw>
Date: Sun, 18 Aug 2024 16:57:19 +0800
Subject: [PATCH 013/301] fix the trimming of log filenames for `gh run view`

---
 pkg/cmd/run/view/fixtures/run_log.zip | Bin 6822 -> 6880 bytes
 pkg/cmd/run/view/view.go              |   1 +
 pkg/cmd/run/view/view_test.go         |  12 ++++++++++++
 3 files changed, 13 insertions(+)

diff --git a/pkg/cmd/run/view/fixtures/run_log.zip b/pkg/cmd/run/view/fixtures/run_log.zip
index 2422c3b2496a37b98c164713aee746f65ce150d1..757a6398307d835f12293e64b602d58ebc965308 100644
GIT binary patch
delta 1524
zcmZ2x`oMI;d`5=Jfdb+aw=ZU8W)Wdvn9M6EzPXL@731UvW=~!Q1`dWRNi`AAzJ5&L
zo_vith>4kHa-WdY<Pa8pu%zO)jv#?YCD|gAC$PjoO$ZbgpDe+;L=bEq&;Us!H6oKg
z3mZ*7&n^a4t0w|dD>Au~ZGtp23l{?jaBSKi24+ABQJ|{?IK*TFykRCPs&#^G6$YwM
z1Y&iFipln(LI$T#`iGx5dB!``;7OBluYgao9s@!n$moeymdif@HL*xAFvx*5%GbZW
zaWLzUgGlSc;^mPncX(n;XQ~U-G;8d7v5WtLRCJ*t%Mqu-sdM{tkKa+&$jV$;pnQ+N
zEq+o@+SD@~4sP?`Gb=3Xx7>2$(V{tzeG**VfAw*(UW<63{I&dBvAp2{?Pn|epM}pz
zYUTa)@`U)c^QWuAbYFLwTl*~DpZ)NeMfAC8^_!pOl(uAil6%(!Wc_{kGhl=2?Tpsv
z%(G?BcIF(Mma|wiPW(pC*_$WCa!#5>*==c=&HqrJyIeykGS9(fd3pEdr&0W~cGUm(
zU-$n1|M?)(dQu)w|G1*|WSrOzfeLGxABlnjU(O#|zWBA(c7cLzbN1#V1xge9{xI&2
z0~V%}6F9rsz=6y$nUU+cI0FX<Ltn(Qh?*%k1wdh~0K~f(6ec%{t(m-<+XbdHUP5fM
zG>;k6<U~F%aH<G^$M_CDSgJ6P5})kAA6O5IWu8Q#NT6|W0E}gZ<ox^`g{=G}1%>j=
zk_?69{G9weeS|}?L_2mZhVf}YLrOAI6_OH*s`N@KO5mx26P_$4&*R?&PW-!pB(I<%
zW5i^A!DGyE%nXxfGiyygAjt+4*A!A@UJMj@z-&EPL5O4W1R*6xw#l1?On`DPgcKQl
zCvyqAflLurWZK0tIZ#AwvJR^eNGU5Q??_I5BP7dMHTgMMk)DVm({om!A|Fk823%=f
z1sWm(KzcbFIOPX&fkU2wfsp~2W`CHJotk`;@rzBqw#vs_j2GYKf$0EmMkaX%U=9Xa
ziy2TbQx$;nw;-m1atn&d4V@=v@6fr<_&^l5$(R`k*<>SjkbC8I@wpe~ZjgILm_a4Z
zGf_pR1P)-Z2v3#~b7TZ1Jux1jJHg<s;~$R64PsZB7&s<}iz_fbom?-r4w(4#L17FM
zjF(Vg`oOihQ9_WB*@>57at)t0DDJ?)9{>t|rVif8uOwZ8kz^pH$ov(k#Gc;<sGFr8
z773V15#}jSBqZ_SNSMgJyvN_=3W^OFO-!s5t24mtQ2^RA6_-7jsTtX3Sge^H&ow|z
W53FpU5EKK#yW9*6Z-K@$FaQ8sfvAcA

delta 1352
zcmZ{ke@IkW6vywI_h#Om8Q(b0uQ$&y-!seD+RDgMBgoBCE48FVVnVU#hY2Yb+HO_`
zSy@}k2`UP#(E1}S%`%H<GDTVY1=;TQOWL(^H!@q(mK2KaoynOe<Q*=<z4JNWbMLv|
zGk-;$jViAcFv93)#@P%+M@7wrFdlC|^2BT<E1Aq?OIXfE5EX<Pa+yIUfX8`*Yu2VR
z2-Pv*Vv{{ekFvLWm7tMLv+%g*V}F*B$mqXG!SkSC2<N7IV5M<i8req(vN)H*V{`YG
zO*XPr$n@v+Q}?)wgu4G^;Vu^;>PAtLO3MbPwTWZu`N?}+C`h{UDLjr3ua!n?5^;og
zyVL3S$gm?BQhA4I<q84ub?Jp`=^TU#)+y2g`3_2WdW8rt4gzn1FPs2>N>)fQIY_$i
zUsRorb0Rd}6CVoau&{IRO!T^~MMlJMA4$Q<iy-vw*t{Gz(!A$IZevE?1XuMVeZb9<
z+}_(;P31)c3k)s0^W~<e)7n$2?oO!54@h}kej~6nFg-ZwSz<6#H*}}PhEZ@+f9d9p
z&V&`0x4nv772o^c!S>#P$=B8_%|8&ag&+FykH^`ElfHZ?>)M&q*>&~Ah1c2ZV<x??
zJQ)M#pRi)+$ys!Cb*Z^qO#6RtV#M{ranGh)AODJreYn4`t8IsUb*B*WFWoQboaqQ{
zJN~P^OdI>~O@e!BtNZT`d&iKw^|#?n+`qT}=lq6aFVD--XHH&;Z10-!rgh?}5AC<#
z#<^+q+c3FxQuQa|2p(6&#+>UTcc<m?JH%HwD8L6CJT~sT6&*#WA~L-cu^6ZS$78xf
zBVLD3`r$Fn?xRoxXPmDQc+7oH(t6E~AWrbQeVNa6Cxo#Lob02p$wib@uMfSZOAM|!
zB|>9h6@wv@5ox!0MpelMC^omTJ6Ht2us=Xvkd6?AK?>VKc5bnA;i9OA7eNX$8yL$h
zt;d3JND5(!A;YqWu+5xWZ5Wy@%gJtuR)l1Wf$4xKE2a9hVt_wqf(|OJOTlE-g?+aH
zMo9E7PUInl7ll#X09n>?;UmqUx+rZ1UuacHjwe*r8RBFc>;0RdkEwoU(gmu(0U9XN
zmY|u)>F3)OHd&9L7%!&vU=TFfWzCQtp4xxcU<CCJS<`JGt6JD4&Y?TkM4A0;L?9S@
zJQcj-R5Y0;=yT2_a*CvAs!b3tEhLLFNzsM{B2)m)Y$!aCLTp+cJ&TQe`V9zGlHU;e
E3VV%R^#A|>

diff --git a/pkg/cmd/run/view/view.go b/pkg/cmd/run/view/view.go
index 73ef7bb1e..c794cff9a 100644
--- a/pkg/cmd/run/view/view.go
+++ b/pkg/cmd/run/view/view.go
@@ -546,6 +546,7 @@ func logFilenameRegexp(job shared.Job, step shared.Step) *regexp.Regexp {
 	// * Truncate long job names
 	//
 	sanitizedJobName := strings.ReplaceAll(job.Name, "/", "")
+	sanitizedJobName = strings.ReplaceAll(sanitizedJobName, ":", "")
 	sanitizedJobName = truncateAsUTF16(sanitizedJobName, JOB_NAME_MAX_LENGTH)
 	re := fmt.Sprintf(`^%s\/%d_.*\.txt`, regexp.QuoteMeta(sanitizedJobName), step.Number)
 	return regexp.MustCompile(re)
diff --git a/pkg/cmd/run/view/view_test.go b/pkg/cmd/run/view/view_test.go
index 44ca69fa6..956f80cd5 100644
--- a/pkg/cmd/run/view/view_test.go
+++ b/pkg/cmd/run/view/view_test.go
@@ -1522,6 +1522,18 @@ func Test_attachRunLog(t *testing.T) {
 			// not the double space in the dir name, as the slash has been removed
 			wantFilename: "cool job  with slash/1_fob the barz.txt",
 		},
+		{
+			name: "job name with colon matches dir with colon removed",
+			job: shared.Job{
+				Name: "cool job : with colon",
+				Steps: []shared.Step{{
+					Name:   "fob the barz",
+					Number: 1,
+				}},
+			},
+			wantMatch:    true,
+			wantFilename: "cool job  with colon/1_fob the barz.txt",
+		},
 		{
 			name: "Job name with really long name (over the ZIP limit)",
 			job: shared.Job{

From 3fd309bdde0242dc46ff9a5a6473a5592361bce0 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Mon, 19 Aug 2024 10:29:01 -0400
Subject: [PATCH 014/301] rename flag to bundle-from-oci

---
 pkg/cmd/attestation/verify/options.go      | 8 ++++----
 pkg/cmd/attestation/verify/options_test.go | 4 ++--
 pkg/cmd/attestation/verify/verify.go       | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkg/cmd/attestation/verify/options.go b/pkg/cmd/attestation/verify/options.go
index a21e27c58..3ec2d49f1 100644
--- a/pkg/cmd/attestation/verify/options.go
+++ b/pkg/cmd/attestation/verify/options.go
@@ -84,14 +84,14 @@ func (opts *Options) AreFlagsValid() error {
 		return fmt.Errorf("limit %d not allowed, must be between 1 and 1000", opts.Limit)
 	}
 
-	// Check that the bundle-from-registry flag is only used with OCI artifact paths
+	// Check that the bundle-from-oci flag is only used with OCI artifact paths
 	if opts.UseBundleFromRegistry && !strings.HasPrefix(opts.ArtifactPath, "oci://") {
-		return fmt.Errorf("bundle-from-registry flag can only be used with OCI artifact paths")
+		return fmt.Errorf("bundle-from-oci flag can only be used with OCI artifact paths")
 	}
 
-	// Check that both the bundle-from-registry and bundle-path flags are not used together
+	// Check that both the bundle-from-oci and bundle-path flags are not used together
 	if opts.UseBundleFromRegistry && opts.BundlePath != "" {
-		return fmt.Errorf("bundle-from-registry flag cannot be used with bundle-path flag")
+		return fmt.Errorf("bundle-from-oci flag cannot be used with bundle-path flag")
 	}
 
 	return nil
diff --git a/pkg/cmd/attestation/verify/options_test.go b/pkg/cmd/attestation/verify/options_test.go
index 9fd319041..b9be054a5 100644
--- a/pkg/cmd/attestation/verify/options_test.go
+++ b/pkg/cmd/attestation/verify/options_test.go
@@ -128,7 +128,7 @@ func TestSetPolicyFlags(t *testing.T) {
 
 		err := opts.AreFlagsValid()
 		require.Error(t, err)
-		require.ErrorContains(t, err, "bundle-from-registry flag can only be used with OCI artifact paths")
+		require.ErrorContains(t, err, "bundle-from-oci flag can only be used with OCI artifact paths")
 	})
 
 	t.Run("does not return error when UseBundleFromRegistry is true and ArtifactPath is an OCI path", func(t *testing.T) {
@@ -157,6 +157,6 @@ func TestSetPolicyFlags(t *testing.T) {
 
 		err := opts.AreFlagsValid()
 		require.Error(t, err)
-		require.ErrorContains(t, err, "bundle-from-registry flag cannot be used with bundle-path flag")
+		require.ErrorContains(t, err, "bundle-from-oci flag cannot be used with bundle-path flag")
 	})
 }
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index f77f5f822..f053240de 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -150,7 +150,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	// general flags
 	verifyCmd.Flags().StringVarP(&opts.BundlePath, "bundle", "b", "", "Path to bundle on disk, either a single bundle in a JSON file or a JSON lines file with multiple bundles")
 	cmdutil.DisableAuthCheckFlag(verifyCmd.Flags().Lookup("bundle"))
-	verifyCmd.Flags().BoolVarP(&opts.UseBundleFromRegistry, "bundle-from-registry", "", false, "Use the bundle from the OCI registry when artifact is an OCI image")
+	verifyCmd.Flags().BoolVarP(&opts.UseBundleFromRegistry, "bundle-from-oci", "", false, "When verifying an OCI image, fetch the attestation bundle from the OCI registry instead of from GitHub")
 	cmdutil.StringEnumFlag(verifyCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	verifyCmd.Flags().StringVarP(&opts.Owner, "owner", "o", "", "GitHub organization to scope attestation lookup by")
 	verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")

From 47a8f4bbdd36e755dc5eba5bb548921329fc70a9 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Tue, 20 Aug 2024 16:14:39 -0400
Subject: [PATCH 015/301] update error message

---
 pkg/cmd/attestation/verification/attestation.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index c1fb25b12..5feca47ea 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -131,7 +131,7 @@ func GetOCIAttestations(c FetchAttestationsConfig) ([]*api.Attestation, error) {
 		return nil, fmt.Errorf("failed to fetch OCI attestations: %w", err)
 	}
 	if len(attestations) == 0 {
-		return nil, fmt.Errorf("no OCI attestations found")
+		return nil, fmt.Errorf("no attestations found in the OCI registry. Retry the command without the --bundle-from-oci flag to check GitHub for the attestation")
 	}
 	return attestations, nil
 }

From 0d38a2fd8e3a828deb8f92b7d5042463fff43709 Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Wed, 21 Aug 2024 10:52:42 -0400
Subject: [PATCH 016/301] fixed the test

---
 pkg/cmd/attestation/verify/verify_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 0f31d900c..89c5ae7c1 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -488,7 +488,7 @@ func TestRunVerify(t *testing.T) {
 		customOpts.UseBundleFromRegistry = true
 		customOpts.OCIClient = oci.NoAttestationsClient{}
 
-		require.ErrorContains(t, runVerify(&customOpts), "no OCI attestations found")
+		require.ErrorContains(t, runVerify(&customOpts), "no attestations found in the OCI registry. Retry the command without the --bundle-from-oci flag to check GitHub for the attestation")
 	})
 
 	t.Run("with valid OCI artifact with UseBundleFromRegistry flag but fail on fetching bundle from registry", func(t *testing.T) {
@@ -498,6 +498,6 @@ func TestRunVerify(t *testing.T) {
 		customOpts.UseBundleFromRegistry = true
 		customOpts.OCIClient = oci.NoAttestationsClient{}
 
-		require.ErrorContains(t, runVerify(&customOpts), "no OCI attestations found")
+		require.ErrorContains(t, runVerify(&customOpts), "no attestations found in the OCI registry. Retry the command without the --bundle-from-oci flag to check GitHub for the attestation")
 	})
 }

From c81ccab4b8bb1ef1c774f4ba9851e9dcb11fa5e7 Mon Sep 17 00:00:00 2001
From: Yukai Chou <muzimuzhi@gmail.com>
Date: Thu, 22 Aug 2024 03:20:45 +0800
Subject: [PATCH 017/301] Quote repo names consistently in `gh repo sync`
 stdout (#9491)

* Quote repo names consistently in `gh repo sync` stdout

* Update tests
---
 pkg/cmd/repo/sync/sync.go      |  2 +-
 pkg/cmd/repo/sync/sync_test.go | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkg/cmd/repo/sync/sync.go b/pkg/cmd/repo/sync/sync.go
index 87badc7a1..4418079b7 100644
--- a/pkg/cmd/repo/sync/sync.go
+++ b/pkg/cmd/repo/sync/sync.go
@@ -156,7 +156,7 @@ func syncLocalRepo(opts *SyncOptions) error {
 
 	if opts.IO.IsStdoutTTY() {
 		cs := opts.IO.ColorScheme()
-		fmt.Fprintf(opts.IO.Out, "%s Synced the \"%s\" branch from %s to local repository\n",
+		fmt.Fprintf(opts.IO.Out, "%s Synced the \"%s\" branch from \"%s\" to local repository\n",
 			cs.SuccessIcon(),
 			opts.Branch,
 			ghrepo.FullName(srcRepo))
diff --git a/pkg/cmd/repo/sync/sync_test.go b/pkg/cmd/repo/sync/sync_test.go
index 8b9e4352f..227e2a6a2 100644
--- a/pkg/cmd/repo/sync/sync_test.go
+++ b/pkg/cmd/repo/sync/sync_test.go
@@ -129,7 +129,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("IsDirty").Return(false, nil).Once()
 				mgc.On("MergeFastForward", "FETCH_HEAD").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER/REPO to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER/REPO\" to local repository\n",
 		},
 		{
 			name: "sync local repo with parent - notty",
@@ -162,7 +162,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("IsDirty").Return(false, nil).Once()
 				mgc.On("MergeFastForward", "FETCH_HEAD").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER2/REPO2 to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER2/REPO2\" to local repository\n",
 		},
 		{
 			name: "sync local repo with parent and force specified",
@@ -179,7 +179,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("IsDirty").Return(false, nil).Once()
 				mgc.On("ResetHard", "FETCH_HEAD").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER/REPO to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER/REPO\" to local repository\n",
 		},
 		{
 			name: "sync local repo with specified source repo and force specified",
@@ -197,7 +197,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("IsDirty").Return(false, nil).Once()
 				mgc.On("ResetHard", "FETCH_HEAD").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER2/REPO2 to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER2/REPO2\" to local repository\n",
 		},
 		{
 			name: "sync local repo with parent and not fast forward merge",
@@ -257,7 +257,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("CurrentBranch").Return("test", nil).Once()
 				mgc.On("UpdateBranch", "trunk", "FETCH_HEAD").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER/REPO to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER/REPO\" to local repository\n",
 		},
 		{
 			name: "sync local repo with parent - create new branch",
@@ -271,7 +271,7 @@ func Test_SyncRun(t *testing.T) {
 				mgc.On("CurrentBranch").Return("test", nil).Once()
 				mgc.On("CreateBranch", "trunk", "FETCH_HEAD", "origin/trunk").Return(nil).Once()
 			},
-			wantStdout: "✓ Synced the \"trunk\" branch from OWNER/REPO to local repository\n",
+			wantStdout: "✓ Synced the \"trunk\" branch from \"OWNER/REPO\" to local repository\n",
 		},
 		{
 			name: "sync remote fork with parent with new api - tty",

From 2374e82633056dbe3bcfa49d21eaf91af9c670b2 Mon Sep 17 00:00:00 2001
From: Yukai Chou <muzimuzhi@gmail.com>
Date: Fri, 23 Aug 2024 00:12:09 +0800
Subject: [PATCH 018/301] Fix doc typo for `repo sync`

---
 pkg/cmd/repo/sync/sync.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/repo/sync/sync.go b/pkg/cmd/repo/sync/sync.go
index 4418079b7..b025d9eec 100644
--- a/pkg/cmd/repo/sync/sync.go
+++ b/pkg/cmd/repo/sync/sync.go
@@ -50,7 +50,7 @@ func NewCmdSync(f *cmdutil.Factory, runF func(*SyncOptions) error) *cobra.Comman
 			of the source repository to update the matching branch on the destination
 			repository so they are equal. A fast forward update will be used except when the
 			%[1]s--force%[1]s flag is specified, then the two branches will
-			by synced using a hard reset.
+			be synced using a hard reset.
 
 			Without an argument, the local repository is selected as the destination repository.
 

From 91eb34011c1904c16c0c9ac93471a7f0e81e32a8 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 22 Aug 2024 10:01:16 -0700
Subject: [PATCH 019/301] Remove `Internal` from `gh repo create` prompt when
 owner is not an org (#9465)

* Remove `Internal` from `gh repo create` prompt when owner is not an org

Closes #9464

Internal repos only exist for organizations, so when a user selects their
personal namespace to create a repo using `gh repo create`, `Internal`
should not be an option in the `Visibility` prompt.

This should avoid the additional quirk where if the user selects
`Internal` while creating a personal repo and then proceeds to add any
of the README, .gitignore, or LICENSE files prompted for later, the repo
will not error and instead get created as a `Public` repo. This has the
potential for a user to unknowingly leak sensitive info intended to go
into a non-public repo.

* Refactor prompter with test coverage

By extracting the repo visibility options to its own function,
getRepoVisibilityOptions, we're able to directly test the behavior
introduced with this change. This breaks the testing pattern established
here thus far, but may be a good example of the direction we should
explore for a future refactor.

* Add failing tests to check for error with internal vis in non-org repos

There is a bug in the code, currently, where a user repo can attempt to be
created as with `--internal` visibility flag  when that is not an option
for non-org repos. It fails at the API level if the --gitignore,
--license, or --add-readme flags are not included, but silently falls back
to Public visibility if one of them is included.

Because this bug already existed, this commit adds the tests to ensure
that both scenarios described above are captured accurately by the test
suite. A fix for the latter scenario will be coming in a future commit

* Add Exclude to httpmock registry and implement in Test_repoCreate

Upon attempting to make the previous commit pass, I realized that it was
actually impossible to test what I wanted to. The tests in the previous
commit were behaving as expected given the bug that commit described, but
upon attempting to implement a solution I realized that the tests were
only testing the mocks and not the code functionality itself.

Essentially, when the code to fix the bug was implemented, the tests were
failing because the mocks required to test the buggy behavior were no
longer being called. To make the tests pass, I'd have to rewrite them, but
were I to remove the bug fix, the tests would no longer fail.

This pointed me to a gap in our httpmocks - the ability to intentionally
exclude api calls. The behavior I'm trying to test, here, is that we stop
executing when a certain condition is met, and therefore won't make any
subsequent api calls down the chain.

This implements the Exclude method on the registry such that it will fail
if an excluded api pattern is called. I have refactored the tests in
Test_repoCreate to use the Exclude mock for testing.

* Add error if user attempts to create repo with --internal flag

This was previously failing at either the API if no other flags were
included or falling back to creating a public repo if one of gitignore,
license, or add-readme were included.

* Add testing for error messages in gh repo create

In the previous commits, we've introduced a new error when a user tries to
create an Internal repo not owned by an organization. This adds tests to
verify that the error we are getting is, in fact, the one associated with
this use case and not some random error.
---
 pkg/cmd/repo/create/create.go      | 11 ++++++-
 pkg/cmd/repo/create/create_test.go | 24 +++++++++++++++
 pkg/cmd/repo/create/http.go        |  5 +++
 pkg/cmd/repo/create/http_test.go   | 49 ++++++++++++++++++++++++++++++
 pkg/httpmock/registry.go           | 18 ++++++++++-
 pkg/httpmock/stub.go               |  1 +
 6 files changed, 106 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 9074ea117..8b5dd515a 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -855,7 +855,7 @@ func interactiveRepoInfo(client *http.Client, hostname string, prompter iprompte
 		return "", "", "", err
 	}
 
-	visibilityOptions := []string{"Public", "Private", "Internal"}
+	visibilityOptions := getRepoVisibilityOptions(owner)
 	selected, err := prompter.Select("Visibility", "Public", visibilityOptions)
 	if err != nil {
 		return "", "", "", err
@@ -864,6 +864,15 @@ func interactiveRepoInfo(client *http.Client, hostname string, prompter iprompte
 	return name, description, strings.ToUpper(visibilityOptions[selected]), nil
 }
 
+func getRepoVisibilityOptions(owner string) []string {
+	visibilityOptions := []string{"Public", "Private"}
+	// orgs can also create internal repos
+	if owner != "" {
+		visibilityOptions = append(visibilityOptions, "Internal")
+	}
+	return visibilityOptions
+}
+
 func interactiveRepoNameAndOwner(client *http.Client, hostname string, prompter iprompter, defaultName string) (string, string, error) {
 	name, err := prompter.Input("Repository name", defaultName)
 	if err != nil {
diff --git a/pkg/cmd/repo/create/create_test.go b/pkg/cmd/repo/create/create_test.go
index e6576ebd0..cc0ec602a 100644
--- a/pkg/cmd/repo/create/create_test.go
+++ b/pkg/cmd/repo/create/create_test.go
@@ -866,3 +866,27 @@ func Test_createRun(t *testing.T) {
 		})
 	}
 }
+
+func Test_getRepoVisibilityOptions(t *testing.T) {
+	tests := []struct {
+		name  string
+		owner string
+		want  []string
+	}{
+		{
+			name:  "user repo",
+			owner: "",
+			want:  []string{"Public", "Private"},
+		},
+		{
+			name:  "org repo",
+			owner: "fooOrg",
+			want:  []string{"Public", "Private", "Internal"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, getRepoVisibilityOptions(tt.owner))
+		})
+	}
+}
diff --git a/pkg/cmd/repo/create/http.go b/pkg/cmd/repo/create/http.go
index ffe9dbb6f..120683c08 100644
--- a/pkg/cmd/repo/create/http.go
+++ b/pkg/cmd/repo/create/http.go
@@ -99,6 +99,11 @@ func repoCreate(client *http.Client, hostname string, input repoCreateInput) (*a
 		isOrg = owner.IsOrganization()
 	}
 
+	isInternal := strings.ToLower(input.Visibility) == "internal"
+	if isInternal && !isOrg {
+		return nil, fmt.Errorf("internal repositories can only be created within an organization")
+	}
+
 	if input.TemplateRepositoryID != "" {
 		var response struct {
 			CloneTemplateRepository struct {
diff --git a/pkg/cmd/repo/create/http_test.go b/pkg/cmd/repo/create/http_test.go
index cfe14563a..ec39b3c50 100644
--- a/pkg/cmd/repo/create/http_test.go
+++ b/pkg/cmd/repo/create/http_test.go
@@ -16,6 +16,7 @@ func Test_repoCreate(t *testing.T) {
 		input    repoCreateInput
 		stubs    func(t *testing.T, r *httpmock.Registry)
 		wantErr  bool
+		errMsg   string
 		wantRepo string
 	}{
 		{
@@ -681,6 +682,51 @@ func Test_repoCreate(t *testing.T) {
 			},
 			wantRepo: "https://github.com/snacks-inc/crisps",
 		},
+		{
+			name:     "create personal repository but try to set it as 'internal'",
+			hostname: "github.com",
+			input: repoCreateInput{
+				Name:        "winter-foods",
+				Description: "roasted chestnuts",
+				HomepageURL: "http://example.com",
+				Visibility:  "internal",
+				OwnerLogin:  "OWNER",
+			},
+			wantErr: true,
+			errMsg:  "internal repositories can only be created within an organization",
+			stubs: func(t *testing.T, r *httpmock.Registry) {
+				r.Register(
+					httpmock.REST("GET", "users/OWNER"),
+					httpmock.StringResponse(`{ "node_id": "1234", "type": "Not-Org" }`))
+				r.Exclude(
+					t,
+					httpmock.GraphQL(`mutation RepositoryCreate\b`),
+				)
+			},
+		},
+		{
+			name:     "create personal repository with README but try to set it as 'internal'",
+			hostname: "github.com",
+			input: repoCreateInput{
+				Name:        "winter-foods",
+				Description: "roasted chestnuts",
+				HomepageURL: "http://example.com",
+				Visibility:  "internal",
+				OwnerLogin:  "OWNER",
+				InitReadme:  true,
+			},
+			wantErr: true,
+			errMsg:  "internal repositories can only be created within an organization",
+			stubs: func(t *testing.T, r *httpmock.Registry) {
+				r.Register(
+					httpmock.REST("GET", "users/OWNER"),
+					httpmock.StringResponse(`{ "node_id": "1234", "type": "Not-Org" }`))
+				r.Exclude(
+					t,
+					httpmock.REST("POST", "user/repos"),
+				)
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -691,6 +737,9 @@ func Test_repoCreate(t *testing.T) {
 			r, err := repoCreate(httpClient, tt.hostname, tt.input)
 			if tt.wantErr {
 				assert.Error(t, err)
+				if tt.errMsg != "" {
+					assert.ErrorContains(t, err, tt.errMsg)
+				}
 				return
 			} else {
 				assert.NoError(t, err)
diff --git a/pkg/httpmock/registry.go b/pkg/httpmock/registry.go
index e36f71a92..387d0fc95 100644
--- a/pkg/httpmock/registry.go
+++ b/pkg/httpmock/registry.go
@@ -4,6 +4,9 @@ import (
 	"fmt"
 	"net/http"
 	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 // Replace http.Client transport layer with registry so all requests get
@@ -25,6 +28,18 @@ func (r *Registry) Register(m Matcher, resp Responder) {
 	})
 }
 
+func (r *Registry) Exclude(t *testing.T, m Matcher) {
+	excludedStub := &Stub{
+		Matcher: m,
+		Responder: func(req *http.Request) (*http.Response, error) {
+			assert.FailNowf(t, "Exclude error", "API called when excluded: %v", req.URL)
+			return nil, nil
+		},
+		exclude: true,
+	}
+	r.stubs = append(r.stubs, excludedStub)
+}
+
 type Testing interface {
 	Errorf(string, ...interface{})
 	Helper()
@@ -33,7 +48,7 @@ type Testing interface {
 func (r *Registry) Verify(t Testing) {
 	n := 0
 	for _, s := range r.stubs {
-		if !s.matched {
+		if !s.matched && !s.exclude {
 			n++
 		}
 	}
@@ -62,6 +77,7 @@ func (r *Registry) RoundTrip(req *http.Request) (*http.Response, error) {
 		stub = s
 		break // TODO: remove
 	}
+
 	if stub != nil {
 		stub.matched = true
 	}
diff --git a/pkg/httpmock/stub.go b/pkg/httpmock/stub.go
index e7534d7f8..787cdcf9d 100644
--- a/pkg/httpmock/stub.go
+++ b/pkg/httpmock/stub.go
@@ -18,6 +18,7 @@ type Stub struct {
 	matched   bool
 	Matcher   Matcher
 	Responder Responder
+	exclude   bool
 }
 
 func MatchAny(*http.Request) bool {

From 687a43fe89a6c52f419e48205062eb8f89d4f776 Mon Sep 17 00:00:00 2001
From: Yukai Chou <muzimuzhi@gmail.com>
Date: Wed, 21 Aug 2024 11:49:31 +0800
Subject: [PATCH 020/301] Drop surplus trailing space char in flag names in web

Introduced by 92cb2cc7 (more closely match cobra default val display,
2023-12-05).
---
 internal/docs/markdown.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/docs/markdown.go b/internal/docs/markdown.go
index 825db931c..7ae8c6862 100644
--- a/internal/docs/markdown.go
+++ b/internal/docs/markdown.go
@@ -103,7 +103,7 @@ type flagView struct {
 var flagsTemplate = `
 <dl class="flags">{{ range . }}
 	<dt>{{ if .Shorthand }}<code>-{{.Shorthand}}</code>, {{ end }}
-		<code>--{{.Name}}{{ if .Varname }} &lt;{{.Varname}}&gt;{{ end }}{{.DefValue}} </code></dt>
+		<code>--{{.Name}}{{ if .Varname }} &lt;{{.Varname}}&gt;{{ end }}{{.DefValue}}</code></dt>
 	<dd>{{.Usage}}</dd>
 {{ end }}</dl>
 `

From 1eecfd45301635e5a2f2f3375cd0445fc98a5668 Mon Sep 17 00:00:00 2001
From: Velmurugan <velumuruganr.dev@gmail.com>
Date: Sat, 24 Aug 2024 16:24:51 +0530
Subject: [PATCH 021/301] Added `--active` flag to the `gh auth status` command

---
 pkg/cmd/auth/status/status.go      |  6 ++++++
 pkg/cmd/auth/status/status_test.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/pkg/cmd/auth/status/status.go b/pkg/cmd/auth/status/status.go
index 2139bda1e..73ee084e9 100644
--- a/pkg/cmd/auth/status/status.go
+++ b/pkg/cmd/auth/status/status.go
@@ -129,6 +129,7 @@ type StatusOptions struct {
 
 	Hostname  string
 	ShowToken bool
+	Active    bool
 }
 
 func NewCmdStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobra.Command {
@@ -163,6 +164,7 @@ func NewCmdStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobra.Co
 
 	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "Check only a specific hostname's auth status")
 	cmd.Flags().BoolVarP(&opts.ShowToken, "show-token", "t", false, "Display the auth token")
+	cmd.Flags().BoolVarP(&opts.Active, "active", "a", false, "Display the active account only")
 
 	return cmd
 }
@@ -224,6 +226,10 @@ func statusRun(opts *StatusOptions) error {
 			err = cmdutil.SilentError
 		}
 
+		if opts.Active {
+			continue
+		}
+
 		users := authCfg.UsersForHost(hostname)
 		for _, username := range users {
 			if username == activeUser {
diff --git a/pkg/cmd/auth/status/status_test.go b/pkg/cmd/auth/status/status_test.go
index 03c26ca04..0f41ac8ab 100644
--- a/pkg/cmd/auth/status/status_test.go
+++ b/pkg/cmd/auth/status/status_test.go
@@ -44,6 +44,13 @@ func Test_NewCmdStatus(t *testing.T) {
 				ShowToken: true,
 			},
 		},
+		{
+			name: "active",
+			cli:  "--active",
+			wants: StatusOptions{
+				Active: true,
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -433,6 +440,27 @@ func Test_statusRun(t *testing.T) {
 				  - To forget about this account, run: gh auth logout -h ghe.io -u monalisa-ghe
 			`),
 		},
+		{
+			name: "active",
+			opts: StatusOptions{
+				Active: true,
+			},
+			cfgStubs: func(t *testing.T, c gh.Config) {
+				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
+				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
+			},
+			httpStubs: func(reg *httpmock.Registry) {
+				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
+			},
+			wantOut: heredoc.Doc(`
+				github.com
+				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
+				  - Active account: true
+				  - Git operations protocol: https
+				  - Token: gho_******
+				  - Token scopes: 'repo', 'read:org'
+			`),
+		},
 	}
 
 	for _, tt := range tests {

From 8305a49c3f7d5331d662c72e9956219fcfe37eae Mon Sep 17 00:00:00 2001
From: Aryan Bhosale <36108149+aryanbhosale@users.noreply.github.com>
Date: Mon, 26 Aug 2024 21:28:29 +0530
Subject: [PATCH 022/301] "offline" verification using the bundle of
 attestations without any additional handling of the file (#9523)

---
 pkg/cmd/attestation/verification/attestation.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 5feca47ea..c780e247c 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -2,6 +2,7 @@ package verification
 
 import (
 	"bufio"
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -88,6 +89,10 @@ func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 	var line []byte
 	line, err = reader.ReadBytes('\n')
 	for err == nil {
+		if len(bytes.TrimSpace(line)) == 0 {
+			line, err = reader.ReadBytes('\n')
+			continue
+		}
 		var bundle bundle.ProtobufBundle
 		bundle.Bundle = new(protobundle.Bundle)
 		err = bundle.UnmarshalJSON(line)

From b8db372d71bd7dd6ca77ebd8e95f47cb033760ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 26 Aug 2024 10:26:42 -0700
Subject: [PATCH 023/301] build(deps): bump actions/attest-build-provenance
 from 1.4.1 to 1.4.2 (#9518)

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 1.4.1 to 1.4.2.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/310b0a4a3b0b78ef57ecda988ee04b132db73ef8...6149ea5740be74af77f260b9db67e633f6b0a9a1)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tyler McGoffin <jtmcg@github.com>
---
 .github/workflows/deployment.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index 51b47e6d8..bc9442d9d 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -299,7 +299,7 @@ jobs:
           rpmsign --addsign dist/*.rpm
       - name: Attest release artifacts
         if: inputs.environment == 'production'
-        uses: actions/attest-build-provenance@310b0a4a3b0b78ef57ecda988ee04b132db73ef8 # v1.4.1
+        uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "dist/gh_*"
       - name: Run createrepo

From 192f57ef429b4e89937c87dcbd330520730d4a3a Mon Sep 17 00:00:00 2001
From: Zongle Wang <wangzongler@gmail.com>
Date: Wed, 28 Aug 2024 14:00:46 -0400
Subject: [PATCH 024/301] Improve the help message for -F (#9525)

Changing to `release-notes.md` from `changelog.md` may help users better contextually understand usage.

Co-authored-by: Tyler McGoffin <jtmcg@github.com>
---
 pkg/cmd/release/create/create.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/release/create/create.go b/pkg/cmd/release/create/create.go
index 7a72f7f90..0b7c99b23 100644
--- a/pkg/cmd/release/create/create.go
+++ b/pkg/cmd/release/create/create.go
@@ -114,7 +114,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			$ gh release create v1.2.3 --generate-notes
 
 			Use release notes from a file
-			$ gh release create v1.2.3 -F changelog.md
+			$ gh release create v1.2.3 -F release-notes.md
 
 			Use annotated tag notes
 			$ gh release create v1.2.3 --notes-from-tag

From 03c34e71f96891cb5b944bde959be1b873643528 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 30 Aug 2024 10:57:51 -0400
Subject: [PATCH 025/301] Expand active test cases

---
 pkg/cmd/auth/status/status_test.go | 73 ++++++++++++++++++++++++++++--
 1 file changed, 70 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/auth/status/status_test.go b/pkg/cmd/auth/status/status_test.go
index 0f41ac8ab..3f16baf46 100644
--- a/pkg/cmd/auth/status/status_test.go
+++ b/pkg/cmd/auth/status/status_test.go
@@ -389,14 +389,14 @@ func Test_statusRun(t *testing.T) {
 		{
 			name: "multiple hosts with multiple accounts with environment tokens and with errors",
 			opts: StatusOptions{},
-			env:  map[string]string{"GH_ENTERPRISE_TOKEN": "gho_abc123"},
+			env:  map[string]string{"GH_ENTERPRISE_TOKEN": "gho_abc123"}, // monalisa-ghe-2
 			cfgStubs: func(t *testing.T, c gh.Config) {
 				login(t, c, "github.com", "monalisa", "gho_def456", "https")
 				login(t, c, "github.com", "monalisa-2", "gho_ghi789", "https")
 				login(t, c, "ghe.io", "monalisa-ghe", "gho_xyz123", "ssh")
 			},
 			httpStubs: func(reg *httpmock.Registry) {
-				// Get scopes for monalia-2
+				// Get scopes for monalisa-2
 				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
 				// Get scopes for monalisa
 				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo"))
@@ -441,7 +441,7 @@ func Test_statusRun(t *testing.T) {
 			`),
 		},
 		{
-			name: "active",
+			name: "multiple accounts on a host, only active users",
 			opts: StatusOptions{
 				Active: true,
 			},
@@ -461,6 +461,73 @@ func Test_statusRun(t *testing.T) {
 				  - Token scopes: 'repo', 'read:org'
 			`),
 		},
+		{
+			name: "multiple hosts with multiple accounts, only active users",
+			opts: StatusOptions{
+				Active: true,
+			},
+			cfgStubs: func(t *testing.T, c gh.Config) {
+				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
+				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
+				login(t, c, "ghe.io", "monalisa-ghe", "gho_abc123", "ssh")
+				login(t, c, "ghe.io", "monalisa-ghe-2", "gho_abc123", "ssh")
+			},
+			httpStubs: func(reg *httpmock.Registry) {
+				// Get scopes for monalisa-2
+				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
+				// Get scopes for monalisa-ghe-2
+				reg.Register(httpmock.REST("GET", "api/v3/"), httpmock.ScopesResponder("repo,read:org"))
+			},
+			wantOut: heredoc.Doc(`
+				github.com
+				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
+				  - Active account: true
+				  - Git operations protocol: https
+				  - Token: gho_******
+				  - Token scopes: 'repo', 'read:org'
+
+				ghe.io
+				  ✓ Logged in to ghe.io account monalisa-ghe-2 (GH_CONFIG_DIR/hosts.yml)
+				  - Active account: true
+				  - Git operations protocol: ssh
+				  - Token: gho_******
+				  - Token scopes: 'repo', 'read:org'
+			`),
+		},
+		{
+			name: "multiple hosts with multiple accounts, only active users with errors",
+			opts: StatusOptions{
+				Active: true,
+			},
+			cfgStubs: func(t *testing.T, c gh.Config) {
+				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
+				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
+				login(t, c, "ghe.io", "monalisa-ghe", "gho_abc123", "ssh")
+				login(t, c, "ghe.io", "monalisa-ghe-2", "gho_abc123", "ssh")
+			},
+			httpStubs: func(reg *httpmock.Registry) {
+				// Get scopes for monalisa-2
+				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
+				// Error getting scopes for monalisa-ghe-2
+				reg.Register(httpmock.REST("GET", "api/v3/"), httpmock.StatusStringResponse(404, "{}"))
+			},
+			wantErr: cmdutil.SilentError,
+			wantErrOut: heredoc.Doc(`
+				github.com
+				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
+				  - Active account: true
+				  - Git operations protocol: https
+				  - Token: gho_******
+				  - Token scopes: 'repo', 'read:org'
+
+				ghe.io
+				  X Failed to log in to ghe.io account monalisa-ghe-2 (GH_CONFIG_DIR/hosts.yml)
+				  - Active account: true
+				  - The token in GH_CONFIG_DIR/hosts.yml is invalid.
+				  - To re-authenticate, run: gh auth login -h ghe.io
+				  - To forget about this account, run: gh auth logout -h ghe.io -u monalisa-ghe-2
+			`),
+		},
 	}
 
 	for _, tt := range tests {

From 5562c1489f90c2886d28d2044664bfa6735d40df Mon Sep 17 00:00:00 2001
From: crystalstall <crystalruby@qq.com>
Date: Mon, 2 Sep 2024 15:18:42 +0800
Subject: [PATCH 026/301] chore: fix some function names

Signed-off-by: crystalstall <crystalruby@qq.com>
---
 pkg/cmd/issue/shared/lookup.go | 2 +-
 pkg/markdown/markdown.go       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/issue/shared/lookup.go b/pkg/cmd/issue/shared/lookup.go
index f93b0867d..be79f9a73 100644
--- a/pkg/cmd/issue/shared/lookup.go
+++ b/pkg/cmd/issue/shared/lookup.go
@@ -36,7 +36,7 @@ func IssueFromArgWithFields(httpClient *http.Client, baseRepoFn func() (ghrepo.I
 	return issue, baseRepo, err
 }
 
-// IssuesFromArgWithFields loads 1 or more issues or pull requests with the specified fields. If some of the fields
+// IssuesFromArgsWithFields loads 1 or more issues or pull requests with the specified fields. If some of the fields
 // could not be fetched by GraphQL, this returns non-nil issues and a *PartialLoadError.
 func IssuesFromArgsWithFields(httpClient *http.Client, baseRepoFn func() (ghrepo.Interface, error), args []string, fields []string) ([]*api.Issue, ghrepo.Interface, error) {
 	var issuesRepo ghrepo.Interface
diff --git a/pkg/markdown/markdown.go b/pkg/markdown/markdown.go
index 1aab0bcd3..f3f4951af 100644
--- a/pkg/markdown/markdown.go
+++ b/pkg/markdown/markdown.go
@@ -9,7 +9,7 @@ func WithoutIndentation() glamour.TermRendererOption {
 	return ghMarkdown.WithoutIndentation()
 }
 
-// WithoutWrap is a rendering option that set the character limit for soft
+// WithWrap is a rendering option that set the character limit for soft
 // wrapping the markdown rendering. There is a max limit of 120 characters.
 // If 0 is passed then wrapping is disabled.
 func WithWrap(w int) glamour.TermRendererOption {

From 9a0a7d427e8c2bd6f9bb785bc92b01b3d1045796 Mon Sep 17 00:00:00 2001
From: Aryan Bhosale <36108149+aryanbhosale@users.noreply.github.com>
Date: Wed, 4 Sep 2024 20:27:56 +0530
Subject: [PATCH 027/301] verify 2nd artifact without swapping order (#9532)

* verify 2nd artifact without swapping order

possible solution to https://github.com/cli/cli/issues/9521#issuecomment-2310686619?

* copy the mentioned test file and adds some extra lines

* rm unnecessary import

* Update pkg/cmd/attestation/verification/attestation_test.go

Co-authored-by: Meredith Lancaster <malancas@users.noreply.github.com>

* gofmt

---------

Co-authored-by: Meredith Lancaster <malancas@users.noreply.github.com>
---
 .../attestation/verification/attestation.go   | 21 +++----------
 .../verification/attestation_test.go          | 31 ++++++++++++++++---
 2 files changed, 32 insertions(+), 20 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index c780e247c..4d96196da 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -1,7 +1,6 @@
 package verification
 
 import (
-	"bufio"
 	"bytes"
 	"encoding/json"
 	"errors"
@@ -76,33 +75,23 @@ func loadBundleFromJSONFile(path string) ([]*api.Attestation, error) {
 }
 
 func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
-	file, err := os.Open(path)
+	fileContent, err := os.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("could not open file: %v", err)
+		return nil, fmt.Errorf("could not read file: %v", err)
 	}
-	defer file.Close()
 
 	attestations := []*api.Attestation{}
 
-	reader := bufio.NewReader(file)
+	decoder := json.NewDecoder(bytes.NewReader(fileContent))
 
-	var line []byte
-	line, err = reader.ReadBytes('\n')
-	for err == nil {
-		if len(bytes.TrimSpace(line)) == 0 {
-			line, err = reader.ReadBytes('\n')
-			continue
-		}
+	for decoder.More() {
 		var bundle bundle.ProtobufBundle
 		bundle.Bundle = new(protobundle.Bundle)
-		err = bundle.UnmarshalJSON(line)
-		if err != nil {
+		if err := decoder.Decode(&bundle); err != nil {
 			return nil, fmt.Errorf("failed to unmarshal bundle from JSON: %v", err)
 		}
 		a := api.Attestation{Bundle: &bundle}
 		attestations = append(attestations, &a)
-
-		line, err = reader.ReadBytes('\n')
 	}
 
 	return attestations, nil
diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index 87a91cea9..ba530e55d 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -1,6 +1,8 @@
 package verification
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
@@ -12,11 +14,32 @@ import (
 )
 
 func TestLoadBundlesFromJSONLinesFile(t *testing.T) {
-	path := "../test/data/sigstore-js-2.1.0_with_2_bundles.jsonl"
-	attestations, err := loadBundlesFromJSONLinesFile(path)
+	t.Run("with original file", func(t *testing.T) {
+		path := "../test/data/sigstore-js-2.1.0_with_2_bundles.jsonl"
+		attestations, err := loadBundlesFromJSONLinesFile(path)
+		require.NoError(t, err)
+		require.Len(t, attestations, 2)
+	})
 
-	require.NoError(t, err)
-	require.Len(t, attestations, 2)
+	t.Run("with extra lines", func(t *testing.T) {
+		// Create a temporary file with extra lines
+		tempDir := t.TempDir()
+		tempFile := filepath.Join(tempDir, "test_with_extra_lines.jsonl")
+
+		originalContent, err := os.ReadFile("../test/data/sigstore-js-2.1.0_with_2_bundles.jsonl")
+		require.NoError(t, err)
+
+		extraLines := []byte("\n\n")
+		newContent := append(originalContent, extraLines...)
+
+		err = os.WriteFile(tempFile, newContent, 0644)
+		require.NoError(t, err)
+
+		// Test the function with the new file
+		attestations, err := loadBundlesFromJSONLinesFile(tempFile)
+		require.NoError(t, err)
+		require.Len(t, attestations, 2, "Should still load 2 valid attestations")
+	})
 }
 
 func TestLoadBundleFromJSONFile(t *testing.T) {

From 34d7ef7a0efb07b5be163d971c97df0c64655abd Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@users.noreply.github.com>
Date: Wed, 4 Sep 2024 10:31:41 -0600
Subject: [PATCH 028/301] `gh attestation verify` handles empty JSONL files
 (#9541)

* handle empty jsonl files

Signed-off-by: Meredith Lancaster <malancas@github.com>

* check processed attestations slice length

Signed-off-by: Meredith Lancaster <malancas@github.com>

* update err name and message

Signed-off-by: Meredith Lancaster <malancas@github.com>

---------

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go     |  5 +++++
 .../attestation/verification/attestation_test.go    | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 4d96196da..3a2d7456f 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -16,6 +16,7 @@ import (
 )
 
 var ErrUnrecognisedBundleExtension = errors.New("bundle file extension not supported, must be json or jsonl")
+var ErrEmptyBundleFile = errors.New("provided bundle file is empty")
 
 type FetchAttestationsConfig struct {
 	APIClient             api.Client
@@ -94,6 +95,10 @@ func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 		attestations = append(attestations, &a)
 	}
 
+	if len(attestations) == 0 {
+		return nil, ErrEmptyBundleFile
+	}
+
 	return attestations, nil
 }
 
diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index ba530e55d..66b337ad7 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -42,6 +42,19 @@ func TestLoadBundlesFromJSONLinesFile(t *testing.T) {
 	})
 }
 
+func TestLoadBundlesFromJSONLinesFile_RejectEmptyJSONLFile(t *testing.T) {
+	// Create a temporary file
+	emptyJSONL, err := os.CreateTemp("", "empty.jsonl")
+	require.NoError(t, err)
+	err = emptyJSONL.Close()
+	require.NoError(t, err)
+
+	attestations, err := loadBundlesFromJSONLinesFile(emptyJSONL.Name())
+
+	require.ErrorIs(t, err, ErrEmptyBundleFile)
+	require.Nil(t, attestations)
+}
+
 func TestLoadBundleFromJSONFile(t *testing.T) {
 	path := "../test/data/sigstore-js-2.1.0-bundle.json"
 	attestations, err := loadBundleFromJSONFile(path)

From 1b67b354a9845439a725a1eb280c71d41838c822 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Wed, 4 Sep 2024 13:30:30 -0600
Subject: [PATCH 029/301] update bundle file parsing err messages

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 3a2d7456f..0f52adec5 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -53,13 +53,13 @@ func GetLocalAttestations(path string) ([]*api.Attestation, error) {
 	case ".json":
 		attestations, err := loadBundleFromJSONFile(path)
 		if err != nil {
-			return nil, fmt.Errorf("bundle could not be loaded from JSON file: %v", err)
+			return nil, fmt.Errorf("bundle could not be loaded from JSON file at %s", path)
 		}
 		return attestations, nil
 	case ".jsonl":
 		attestations, err := loadBundlesFromJSONLinesFile(path)
 		if err != nil {
-			return nil, fmt.Errorf("bundles could not be loaded from JSON lines file: %v", err)
+			return nil, fmt.Errorf("bundles could not be loaded from JSON lines file at %s", path)
 		}
 		return attestations, nil
 	}

From 84460796563adbc0a71e3c1a9d4e3649729489e9 Mon Sep 17 00:00:00 2001
From: Cody Soyland <codysoyland@github.com>
Date: Wed, 4 Sep 2024 16:38:13 -0400
Subject: [PATCH 030/301] Upgrade to sigstore-go v0.6.1

Signed-off-by: Cody Soyland <codysoyland@github.com>
---
 go.mod                                        | 23 +++++------
 go.sum                                        | 38 ++++++++++---------
 .../attestation/verification/mock_verifier.go |  2 +-
 .../verification/sigstore_integration_test.go | 26 ++-----------
 4 files changed, 37 insertions(+), 52 deletions(-)

diff --git a/go.mod b/go.mod
index 68d87c034..50278d733 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module github.com/cli/cli/v2
 
-go 1.22.0
+go 1.22.5
 
-toolchain go1.22.5
+toolchain go1.22.6
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
@@ -26,7 +26,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-version v1.3.0
 	github.com/henvic/httpretty v0.1.3
-	github.com/in-toto/in-toto-golang v0.9.0
+	github.com/in-toto/attestation v1.1.0
 	github.com/joho/godotenv v1.5.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/mattn/go-colorable v0.1.13
@@ -38,15 +38,15 @@ require (
 	github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
 	github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc
 	github.com/sigstore/protobuf-specs v0.3.2
-	github.com/sigstore/sigstore-go v0.5.1
+	github.com/sigstore/sigstore-go v0.6.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/zalando/go-keyring v0.2.5
-	golang.org/x/crypto v0.25.0
-	golang.org/x/sync v0.7.0
-	golang.org/x/term v0.22.0
-	golang.org/x/text v0.16.0
+	golang.org/x/crypto v0.26.0
+	golang.org/x/sync v0.8.0
+	golang.org/x/term v0.23.0
+	golang.org/x/text v0.17.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -99,6 +99,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/itchyny/gojq v0.12.15 // indirect
 	github.com/itchyny/timefmt-go v0.1.5 // indirect
@@ -132,7 +133,7 @@ require (
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
 	github.com/sigstore/rekor v1.3.6 // indirect
-	github.com/sigstore/sigstore v1.8.7 // indirect
+	github.com/sigstore/sigstore v1.8.9 // indirect
 	github.com/sigstore/timestamp-authority v1.2.2 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
@@ -156,9 +157,9 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
-	golang.org/x/mod v0.19.0 // indirect
+	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index 1ed19f12c..407739dfe 100644
--- a/go.sum
+++ b/go.sum
@@ -259,6 +259,8 @@ github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
+github.com/in-toto/attestation v1.1.0 h1:oRWzfmZPDSctChD0VaQV7MJrywKOzyNrtpENQFq//2Q=
+github.com/in-toto/attestation v1.1.0/go.mod h1:DB59ytd3z7cIHgXxwpSX2SABrU6WJUKg/grpdgHVgVs=
 github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
 github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -391,10 +393,10 @@ github.com/sigstore/protobuf-specs v0.3.2 h1:nCVARCN+fHjlNCk3ThNXwrZRqIommIeNKWw
 github.com/sigstore/protobuf-specs v0.3.2/go.mod h1:RZ0uOdJR4OB3tLQeAyWoJFbNCBFrPQdcokntde4zRBA=
 github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
 github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
-github.com/sigstore/sigstore v1.8.7 h1:L7/zKauHTg0d0Hukx7qlR4nifh6T6O6UIt9JBwAmTIg=
-github.com/sigstore/sigstore v1.8.7/go.mod h1:MPiQ/NIV034Fc3Kk2IX9/XmBQdK60wfmpvgK9Z1UjRA=
-github.com/sigstore/sigstore-go v0.5.1 h1:5IhKvtjlQBeLnjKkzMELNG4tIBf+xXQkDzhLV77+/8Y=
-github.com/sigstore/sigstore-go v0.5.1/go.mod h1:TuOfV7THHqiDaUHuJ5+QN23RP/YoKmsbwJpY+aaYPN0=
+github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFadk=
+github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
+github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
+github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=
@@ -483,24 +485,24 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
-golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
-golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
+golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
 golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
-golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
-golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
+golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -512,19 +514,19 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
-golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
+golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
+golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/pkg/cmd/attestation/verification/mock_verifier.go b/pkg/cmd/attestation/verification/mock_verifier.go
index dcbfb1ba2..9943e6a97 100644
--- a/pkg/cmd/attestation/verification/mock_verifier.go
+++ b/pkg/cmd/attestation/verification/mock_verifier.go
@@ -8,7 +8,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/test/data"
 	"github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
 
-	"github.com/in-toto/in-toto-golang/in_toto"
+	in_toto "github.com/in-toto/attestation/go/v1"
 	"github.com/sigstore/sigstore-go/pkg/verify"
 )
 
diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go
index 48d1f4b49..e56e7d1ed 100644
--- a/pkg/cmd/attestation/verification/sigstore_integration_test.go
+++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go
@@ -43,31 +43,13 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 	})
 
 	t.Run("with missing verification material", func(t *testing.T) {
-		attestations := getAttestationsFor(t, "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl")
-		require.NotNil(t, attestations)
-
-		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
-			Logger: io.NewTestHandler(),
-		})
-
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Error(t, res.Error)
-		require.ErrorContains(t, res.Error, "failed to get bundle verification content")
-		require.Nil(t, res.VerifyResults)
+		_, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl")
+		require.ErrorContains(t, err, "missing verification material")
 	})
 
 	t.Run("with missing verification certificate", func(t *testing.T) {
-		attestations := getAttestationsFor(t, "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl")
-		require.NotNil(t, attestations)
-
-		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
-			Logger: io.NewTestHandler(),
-		})
-
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Error(t, res.Error)
-		require.ErrorContains(t, res.Error, "leaf cert not found")
-		require.Nil(t, res.VerifyResults)
+		_, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl")
+		require.ErrorContains(t, err, "missing bundle content")
 	})
 
 	t.Run("with GitHub Sigstore artifact", func(t *testing.T) {

From ea1a3da1eb9cf83667aa34a56fc8541369045f34 Mon Sep 17 00:00:00 2001
From: Cody Soyland <codysoyland@github.com>
Date: Wed, 4 Sep 2024 16:45:02 -0400
Subject: [PATCH 031/301] Rename ProtobufBundle to Bundle

Signed-off-by: Cody Soyland <codysoyland@github.com>
---
 pkg/cmd/attestation/api/attestation.go               | 2 +-
 pkg/cmd/attestation/artifact/oci/client.go           | 2 +-
 pkg/cmd/attestation/test/data/data.go                | 2 +-
 pkg/cmd/attestation/verification/attestation.go      | 2 +-
 pkg/cmd/attestation/verification/attestation_test.go | 6 +++---
 pkg/cmd/attestation/verification/sigstore.go         | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkg/cmd/attestation/api/attestation.go b/pkg/cmd/attestation/api/attestation.go
index 2b96a51fc..ea055b293 100644
--- a/pkg/cmd/attestation/api/attestation.go
+++ b/pkg/cmd/attestation/api/attestation.go
@@ -25,7 +25,7 @@ func newErrNoAttestations(name, digest string) ErrNoAttestations {
 }
 
 type Attestation struct {
-	Bundle *bundle.ProtobufBundle `json:"bundle"`
+	Bundle *bundle.Bundle `json:"bundle"`
 }
 
 type AttestationsResponse struct {
diff --git a/pkg/cmd/attestation/artifact/oci/client.go b/pkg/cmd/attestation/artifact/oci/client.go
index 5428fff2f..bda114708 100644
--- a/pkg/cmd/attestation/artifact/oci/client.go
+++ b/pkg/cmd/attestation/artifact/oci/client.go
@@ -132,7 +132,7 @@ func (c LiveClient) GetAttestations(ref name.Reference, digest string) ([]*api.A
 				return attestations, fmt.Errorf("error getting referrer image: %w", err)
 			}
 
-			b := &bundle.ProtobufBundle{}
+			b := &bundle.Bundle{}
 			err = b.UnmarshalJSON(bundleBytes)
 
 			if err != nil {
diff --git a/pkg/cmd/attestation/test/data/data.go b/pkg/cmd/attestation/test/data/data.go
index 77f07e60c..b33efaa28 100644
--- a/pkg/cmd/attestation/test/data/data.go
+++ b/pkg/cmd/attestation/test/data/data.go
@@ -12,6 +12,6 @@ import (
 var SigstoreBundleRaw []byte
 
 // SigstoreBundle returns a test *sigstore.Bundle
-func SigstoreBundle(t *testing.T) *bundle.ProtobufBundle {
+func SigstoreBundle(t *testing.T) *bundle.Bundle {
 	return sgData.TestBundle(t, SigstoreBundleRaw)
 }
diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 3a2d7456f..4b2545f62 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -86,7 +86,7 @@ func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 	decoder := json.NewDecoder(bytes.NewReader(fileContent))
 
 	for decoder.More() {
-		var bundle bundle.ProtobufBundle
+		var bundle bundle.Bundle
 		bundle.Bundle = new(protobundle.Bundle)
 		if err := decoder.Decode(&bundle); err != nil {
 			return nil, fmt.Errorf("failed to unmarshal bundle from JSON: %v", err)
diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index 66b337ad7..a3f444572 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -92,7 +92,7 @@ func TestGetLocalAttestations(t *testing.T) {
 func TestFilterAttestations(t *testing.T) {
 	attestations := []*api.Attestation{
 		{
-			Bundle: &bundle.ProtobufBundle{
+			Bundle: &bundle.Bundle{
 				Bundle: &protobundle.Bundle{
 					Content: &protobundle.Bundle_DsseEnvelope{
 						DsseEnvelope: &dsse.Envelope{
@@ -104,7 +104,7 @@ func TestFilterAttestations(t *testing.T) {
 			},
 		},
 		{
-			Bundle: &bundle.ProtobufBundle{
+			Bundle: &bundle.Bundle{
 				Bundle: &protobundle.Bundle{
 					Content: &protobundle.Bundle_DsseEnvelope{
 						DsseEnvelope: &dsse.Envelope{
@@ -116,7 +116,7 @@ func TestFilterAttestations(t *testing.T) {
 			},
 		},
 		{
-			Bundle: &bundle.ProtobufBundle{
+			Bundle: &bundle.Bundle{
 				Bundle: &protobundle.Bundle{
 					Content: &protobundle.Bundle_DsseEnvelope{
 						DsseEnvelope: &dsse.Envelope{
diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index d86a709b5..9a4ac5194 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -55,7 +55,7 @@ func NewLiveSigstoreVerifier(config SigstoreConfig) *LiveSigstoreVerifier {
 	}
 }
 
-func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.ProtobufBundle) (*verify.SignedEntityVerifier, string, error) {
+func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.Bundle) (*verify.SignedEntityVerifier, string, error) {
 	if !b.MinVersion("0.2") {
 		return nil, "", fmt.Errorf("unsupported bundle version: %s", b.MediaType)
 	}

From 7c405e8b6ece71d48be910fdee81aed281a8aee3 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Thu, 5 Sep 2024 08:16:34 -0600
Subject: [PATCH 032/301] dont print err content

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/sigstore.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index d86a709b5..f4aad8c22 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -200,7 +200,7 @@ func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy ve
 			))
 
 			return &SigstoreResults{
-				Error: fmt.Errorf("verifying with issuer \"%s\": %v", issuer, err),
+				Error: fmt.Errorf("verifying with issuer \"%s\"", issuer),
 			}
 		}
 

From 57b20291bd7274e2c4b099dbf2aff35634ab9312 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Thu, 5 Sep 2024 13:20:13 -0600
Subject: [PATCH 033/301] check for os.PathError

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go      | 12 ++++++++++--
 pkg/cmd/attestation/verification/attestation_test.go |  8 ++++++++
 pkg/cmd/attestation/verification/sigstore.go         |  2 +-
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 0f52adec5..d1659feef 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -53,13 +53,21 @@ func GetLocalAttestations(path string) ([]*api.Attestation, error) {
 	case ".json":
 		attestations, err := loadBundleFromJSONFile(path)
 		if err != nil {
-			return nil, fmt.Errorf("bundle could not be loaded from JSON file at %s", path)
+			var pathErr *os.PathError
+			if errors.As(err, &pathErr) {
+				return nil, fmt.Errorf("bundle could not be loaded from JSON file at %s", path)
+			}
+			return nil, fmt.Errorf("bundle content could not be parsed")
 		}
 		return attestations, nil
 	case ".jsonl":
 		attestations, err := loadBundlesFromJSONLinesFile(path)
 		if err != nil {
-			return nil, fmt.Errorf("bundles could not be loaded from JSON lines file at %s", path)
+			var pathErr *os.PathError
+			if errors.As(err, &pathErr) {
+				return nil, fmt.Errorf("bundles could not be loaded from JSON lines file at %s", path)
+			}
+			return nil, fmt.Errorf("bundle content could not be parsed")
 		}
 		return attestations, nil
 	}
diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index 66b337ad7..2db62d56d 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -87,6 +87,14 @@ func TestGetLocalAttestations(t *testing.T) {
 		require.ErrorIs(t, err, ErrUnrecognisedBundleExtension)
 		require.Nil(t, attestations)
 	})
+
+	t.Run("with non-existent bundle file", func(t *testing.T) {
+		path := "../test/data/not-found-bundle.json"
+		attestations, err := GetLocalAttestations(path)
+
+		require.ErrorContains(t, err, "bundle could not be loaded from JSON file")
+		require.Nil(t, attestations)
+	})
 }
 
 func TestFilterAttestations(t *testing.T) {
diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index f4aad8c22..822e7b621 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -186,7 +186,7 @@ func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy ve
 		verifier, issuer, err := v.chooseVerifier(apr.Attestation.Bundle)
 		if err != nil {
 			return &SigstoreResults{
-				Error: fmt.Errorf("failed to find recognized issuer from bundle content: %v", err),
+				Error: fmt.Errorf("failed to find recognized issuer from bundle content"),
 			}
 		}
 

From 668706ccf513278a41be59df9b502a6839a89c6a Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Thu, 5 Sep 2024 13:29:22 -0600
Subject: [PATCH 034/301] print verify err

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/sigstore.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index 822e7b621..f4aad8c22 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -186,7 +186,7 @@ func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy ve
 		verifier, issuer, err := v.chooseVerifier(apr.Attestation.Bundle)
 		if err != nil {
 			return &SigstoreResults{
-				Error: fmt.Errorf("failed to find recognized issuer from bundle content"),
+				Error: fmt.Errorf("failed to find recognized issuer from bundle content: %v", err),
 			}
 		}
 

From 043bdbedb9963368eadbf86769b12fc6d8c86b60 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 6 Sep 2024 08:36:04 -0400
Subject: [PATCH 035/301] Remove note explaining 2 year old GPG ID change

Relates #9569

Having been 2 years since the GitHub CLI changed GPG keys used to sign our releases, it no longer seems relevant to keep these notes in our installation docs as they are confusing to the uninitiated.
---
 docs/install_linux.md | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index 15619fe96..e5b263fac 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -23,9 +23,6 @@ Install:
 && sudo apt install gh -y
 ```
 
-> **Note**
-> We were recently forced to change our GPG signing key. If you've previously downloaded the `githubcli-archive-keyring.gpg` file, you should re-download it again per above instructions. If you are using a keyserver to download the key, the ID of the new key is `23F3D4EA75716059`.
-
 Upgrade:
 
 ```bash
@@ -65,9 +62,6 @@ sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.re
 sudo yum install gh
 ```
 
-> **Note**
-> We were recently forced to change our GPG signing key. If you've added the repository previously and now you're getting a GPG signing key error, disable the repository first with `sudo yum-config-manager --disable gh-cli` and add it again with `sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo`.
-
 Upgrade:
 
 ```bash

From 78fa57dff7b92a6acbe3da1c7b9df74a56f43a0b Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 6 Sep 2024 08:41:59 -0400
Subject: [PATCH 036/301] Revert "Remove note explaining 2 year old GPG ID
 change"

This reverts commit 043bdbedb9963368eadbf86769b12fc6d8c86b60.
---
 docs/install_linux.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index e5b263fac..15619fe96 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -23,6 +23,9 @@ Install:
 && sudo apt install gh -y
 ```
 
+> **Note**
+> We were recently forced to change our GPG signing key. If you've previously downloaded the `githubcli-archive-keyring.gpg` file, you should re-download it again per above instructions. If you are using a keyserver to download the key, the ID of the new key is `23F3D4EA75716059`.
+
 Upgrade:
 
 ```bash
@@ -62,6 +65,9 @@ sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.re
 sudo yum install gh
 ```
 
+> **Note**
+> We were recently forced to change our GPG signing key. If you've added the repository previously and now you're getting a GPG signing key error, disable the repository first with `sudo yum-config-manager --disable gh-cli` and add it again with `sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo`.
+
 Upgrade:
 
 ```bash

From 5a7cdff9db891f6fd55a75ed74fe5519bd114905 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 6 Sep 2024 08:45:24 -0400
Subject: [PATCH 037/301] Update linux install to point to GPG troubleshoot

Relates #9569

Updates notes from older 2 year GPG ID change to redirect users in case of GPG errors to recent issue.
---
 docs/install_linux.md | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index 15619fe96..fabaa19aa 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -15,17 +15,14 @@ Install:
 
 ```bash
 (type -p wget >/dev/null || (sudo apt update && sudo apt-get install wget -y)) \
-&& sudo mkdir -p -m 755 /etc/apt/keyrings \
-&& wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
-&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
-&& sudo apt update \
-&& sudo apt install gh -y
+	&& sudo mkdir -p -m 755 /etc/apt/keyrings \
+	&& wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
+	&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+	&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+	&& sudo apt update \
+	&& sudo apt install gh -y
 ```
 
-> **Note**
-> We were recently forced to change our GPG signing key. If you've previously downloaded the `githubcli-archive-keyring.gpg` file, you should re-download it again per above instructions. If you are using a keyserver to download the key, the ID of the new key is `23F3D4EA75716059`.
-
 Upgrade:
 
 ```bash
@@ -33,6 +30,9 @@ sudo apt update
 sudo apt install gh
 ```
 
+> [!NOTE]
+> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
+
 ### Fedora, CentOS, Red Hat Enterprise Linux (dnf)
 
 Install from our package repository for immediate access to latest releases:
@@ -65,15 +65,15 @@ sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.re
 sudo yum install gh
 ```
 
-> **Note**
-> We were recently forced to change our GPG signing key. If you've added the repository previously and now you're getting a GPG signing key error, disable the repository first with `sudo yum-config-manager --disable gh-cli` and add it again with `sudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo`.
-
 Upgrade:
 
 ```bash
 sudo yum update gh
 ```
 
+> [!NOTE]
+> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
+
 ### openSUSE/SUSE Linux (zypper)
 
 Install:

From a21e78bf0d3c5117846950d6b9a82e61c00f051c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 6 Sep 2024 14:31:25 +0000
Subject: [PATCH 038/301] build(deps): bump actions/attest-build-provenance
 from 1.4.2 to 1.4.3

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 1.4.2 to 1.4.3.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/6149ea5740be74af77f260b9db67e633f6b0a9a1...1c608d11d69870c2092266b3f9a6f3abbf17002c)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/deployment.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index bc9442d9d..82966ced4 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -299,7 +299,7 @@ jobs:
           rpmsign --addsign dist/*.rpm
       - name: Attest release artifacts
         if: inputs.environment == 'production'
-        uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
         with:
           subject-path: "dist/gh_*"
       - name: Run createrepo

From 500b619a5e7b388af89370c0f1fbba338aa5383f Mon Sep 17 00:00:00 2001
From: Cody Soyland <codysoyland@github.com>
Date: Fri, 6 Sep 2024 13:55:25 -0400
Subject: [PATCH 039/301] Move non-integration test to different test file

Signed-off-by: Cody Soyland <codysoyland@github.com>
---
 pkg/cmd/attestation/verification/attestation_test.go | 12 ++++++++++++
 .../verification/sigstore_integration_test.go        | 10 ----------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index a3f444572..0795f053c 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -87,6 +87,18 @@ func TestGetLocalAttestations(t *testing.T) {
 		require.ErrorIs(t, err, ErrUnrecognisedBundleExtension)
 		require.Nil(t, attestations)
 	})
+
+	t.Run("with missing verification material", func(t *testing.T) {
+		path := "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl"
+		_, err := GetLocalAttestations(path)
+		require.ErrorContains(t, err, "missing verification material")
+	})
+
+	t.Run("with missing verification certificate", func(t *testing.T) {
+		path := "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl"
+		_, err := GetLocalAttestations(path)
+		require.ErrorContains(t, err, "missing bundle content")
+	})
 }
 
 func TestFilterAttestations(t *testing.T) {
diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go
index e56e7d1ed..97b44581e 100644
--- a/pkg/cmd/attestation/verification/sigstore_integration_test.go
+++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go
@@ -42,16 +42,6 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 		require.NoError(t, res.Error)
 	})
 
-	t.Run("with missing verification material", func(t *testing.T) {
-		_, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl")
-		require.ErrorContains(t, err, "missing verification material")
-	})
-
-	t.Run("with missing verification certificate", func(t *testing.T) {
-		_, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl")
-		require.ErrorContains(t, err, "missing bundle content")
-	})
-
 	t.Run("with GitHub Sigstore artifact", func(t *testing.T) {
 		githubArtifactPath := test.NormalizeRelativePath("../test/data/github_provenance_demo-0.0.12-py3-none-any.whl")
 		githubArtifact, err := artifact.NewDigestedArtifact(nil, githubArtifactPath, "sha256")

From b14e430441f1d78d7fe9c44a6e97d8603d736b89 Mon Sep 17 00:00:00 2001
From: Cody Soyland <codysoyland@github.com>
Date: Fri, 6 Sep 2024 15:22:43 -0400
Subject: [PATCH 040/301] Check for nil values to prevent nil dereference panic

Signed-off-by: Cody Soyland <codysoyland@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index f053240de..055636ad5 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -307,11 +307,19 @@ func buildTableVerifyContent(results []*verification.AttestationProcessingResult
 	content := make([][]string, len(results))
 
 	for i, res := range results {
+		if res.VerificationResult == nil ||
+			res.VerificationResult.Signature == nil ||
+			res.VerificationResult.Signature.Certificate == nil {
+			return nil, fmt.Errorf("bundle missing verification result fields")
+		}
 		builderSignerURI := res.VerificationResult.Signature.Certificate.Extensions.BuildSignerURI
 		repoAndOrg, workflow, err := extractAttestationDetail(builderSignerURI)
 		if err != nil {
 			return nil, err
 		}
+		if res.VerificationResult.Statement == nil {
+			return nil, fmt.Errorf("bundle missing attestation statement (bundle must originate from GitHub Artifact Attestations)")
+		}
 		predicateType := res.VerificationResult.Statement.PredicateType
 		content[i] = []string{repoAndOrg, predicateType, workflow}
 	}

From bbefc5b24feeac275596d006c8bffdcb77209f77 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 9 Sep 2024 08:53:11 -0600
Subject: [PATCH 041/301] handle os.PathError in GetLocalAttestations

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go      |  2 +-
 pkg/cmd/attestation/verification/attestation_test.go | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 6107ccf4e..d6e7d9e15 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -86,7 +86,7 @@ func loadBundleFromJSONFile(path string) ([]*api.Attestation, error) {
 func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 	fileContent, err := os.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("could not read file: %v", err)
+		return nil, err
 	}
 
 	attestations := []*api.Attestation{}
diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index e321ffd87..68914afad 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -88,13 +88,21 @@ func TestGetLocalAttestations(t *testing.T) {
 		require.Nil(t, attestations)
 	})
 
-	t.Run("with non-existent bundle file", func(t *testing.T) {
+	t.Run("with non-existent bundle file and JSON file", func(t *testing.T) {
 		path := "../test/data/not-found-bundle.json"
 		attestations, err := GetLocalAttestations(path)
 
 		require.ErrorContains(t, err, "bundle could not be loaded from JSON file")
 		require.Nil(t, attestations)
 	})
+
+	t.Run("with non-existent bundle file and JSON lines file", func(t *testing.T) {
+		path := "../test/data/not-found-bundle.jsonl"
+		attestations, err := GetLocalAttestations(path)
+
+		require.ErrorContains(t, err, "bundles could not be loaded from JSON lines file")
+		require.Nil(t, attestations)
+	})
 }
 
 func TestFilterAttestations(t *testing.T) {

From 70e935ba9535a34fef49a0287a2573d0c1d553c0 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 07:54:33 -0600
Subject: [PATCH 042/301] get latest sigstore-go commit

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 go.mod | 2 +-
 go.sum | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 50278d733..0f10c32c8 100644
--- a/go.mod
+++ b/go.mod
@@ -38,7 +38,7 @@ require (
 	github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
 	github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc
 	github.com/sigstore/protobuf-specs v0.3.2
-	github.com/sigstore/sigstore-go v0.6.1
+	github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
diff --git a/go.sum b/go.sum
index 407739dfe..adadcf6b5 100644
--- a/go.sum
+++ b/go.sum
@@ -397,6 +397,8 @@ github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFa
 github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
 github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
 github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
+github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206 h1:V2F8VZ/oJJheQfmYA2hq+6uE7baNdHXSrCG1Ydmz+Ig=
+github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=

From 83519e4e9258fb1732e66f2c001ebce7bb4106be Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 07:54:45 -0600
Subject: [PATCH 043/301] check for sigstore-go validation errs

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index d6e7d9e15..14936e9f1 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -94,12 +94,15 @@ func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 	decoder := json.NewDecoder(bytes.NewReader(fileContent))
 
 	for decoder.More() {
-		var bundle bundle.Bundle
-		bundle.Bundle = new(protobundle.Bundle)
-		if err := decoder.Decode(&bundle); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal bundle from JSON: %v", err)
+		var b bundle.Bundle
+		b.Bundle = new(protobundle.Bundle)
+		if err := decoder.Decode(&b); err != nil {
+			if errors.Is(err, bundle.ErrValidation) {
+				return nil, err
+			}
+			return nil, fmt.Errorf("failed to unmarshal bundle from JSON")
 		}
-		a := api.Attestation{Bundle: &bundle}
+		a := api.Attestation{Bundle: &b}
 		attestations = append(attestations, &a)
 	}
 

From 442111075c8bc04c2bdfbe52b983c124ca6ff1db Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 08:04:51 -0600
Subject: [PATCH 044/301] go mod tidy

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 go.sum | 2 --
 1 file changed, 2 deletions(-)

diff --git a/go.sum b/go.sum
index adadcf6b5..fe198bec9 100644
--- a/go.sum
+++ b/go.sum
@@ -395,8 +395,6 @@ github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
 github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
 github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFadk=
 github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
-github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
-github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
 github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206 h1:V2F8VZ/oJJheQfmYA2hq+6uE7baNdHXSrCG1Ydmz+Ig=
 github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=

From 3814e82f9b858daa7bf35449a68060241487c0aa Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 10:32:46 -0600
Subject: [PATCH 045/301] check err in GetLocalAttestations

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 14936e9f1..50542a6b3 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -56,6 +56,8 @@ func GetLocalAttestations(path string) ([]*api.Attestation, error) {
 			var pathErr *os.PathError
 			if errors.As(err, &pathErr) {
 				return nil, fmt.Errorf("bundle could not be loaded from JSON file at %s", path)
+			} else if errors.Is(err, bundle.ErrValidation) {
+				return nil, err
 			}
 			return nil, fmt.Errorf("bundle content could not be parsed")
 		}
@@ -66,6 +68,8 @@ func GetLocalAttestations(path string) ([]*api.Attestation, error) {
 			var pathErr *os.PathError
 			if errors.As(err, &pathErr) {
 				return nil, fmt.Errorf("bundles could not be loaded from JSON lines file at %s", path)
+			} else if errors.Is(err, bundle.ErrValidation) {
+				return nil, err
 			}
 			return nil, fmt.Errorf("bundle content could not be parsed")
 		}
@@ -97,10 +101,7 @@ func loadBundlesFromJSONLinesFile(path string) ([]*api.Attestation, error) {
 		var b bundle.Bundle
 		b.Bundle = new(protobundle.Bundle)
 		if err := decoder.Decode(&b); err != nil {
-			if errors.Is(err, bundle.ErrValidation) {
-				return nil, err
-			}
-			return nil, fmt.Errorf("failed to unmarshal bundle from JSON")
+			return nil, err
 		}
 		a := api.Attestation{Bundle: &b}
 		attestations = append(attestations, &a)

From 50d335566d71763b7f841876dddef935aedee05a Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 10:47:06 -0600
Subject: [PATCH 046/301] check specific err

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verification/attestation_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation_test.go b/pkg/cmd/attestation/verification/attestation_test.go
index b49a179a5..08f0ccfef 100644
--- a/pkg/cmd/attestation/verification/attestation_test.go
+++ b/pkg/cmd/attestation/verification/attestation_test.go
@@ -107,13 +107,13 @@ func TestGetLocalAttestations(t *testing.T) {
 	t.Run("with missing verification material", func(t *testing.T) {
 		path := "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl"
 		_, err := GetLocalAttestations(path)
-		require.ErrorContains(t, err, "missing verification material")
+		require.ErrorIs(t, err, bundle.ErrMissingVerificationMaterial)
 	})
 
 	t.Run("with missing verification certificate", func(t *testing.T) {
 		path := "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl"
 		_, err := GetLocalAttestations(path)
-		require.ErrorContains(t, err, "missing bundle content")
+		require.ErrorIs(t, err, bundle.ErrMissingBundleContent)
 	})
 }
 

From e2c33e5cc1affb05e07cc698047beb54a14aaedd Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 10 Sep 2024 13:07:52 -0600
Subject: [PATCH 047/301] use sigstore-go v0.6.2

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 go.mod | 10 +++++-----
 go.sum | 20 ++++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/go.mod b/go.mod
index 0f10c32c8..78ceb7f70 100644
--- a/go.mod
+++ b/go.mod
@@ -38,15 +38,15 @@ require (
 	github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
 	github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc
 	github.com/sigstore/protobuf-specs v0.3.2
-	github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206
+	github.com/sigstore/sigstore-go v0.6.2
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/zalando/go-keyring v0.2.5
-	golang.org/x/crypto v0.26.0
+	golang.org/x/crypto v0.27.0
 	golang.org/x/sync v0.8.0
-	golang.org/x/term v0.23.0
-	golang.org/x/text v0.17.0
+	golang.org/x/term v0.24.0
+	golang.org/x/text v0.18.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -159,7 +159,7 @@ require (
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index fe198bec9..37c40407d 100644
--- a/go.sum
+++ b/go.sum
@@ -395,8 +395,8 @@ github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
 github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
 github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFadk=
 github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
-github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206 h1:V2F8VZ/oJJheQfmYA2hq+6uE7baNdHXSrCG1Ydmz+Ig=
-github.com/sigstore/sigstore-go v0.6.2-0.20240909222714-8c0e75bb6206/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
+github.com/sigstore/sigstore-go v0.6.2 h1:8uiywjt73vzfrGfWYVwVsiB1E1Qmwmpgr1kVpl4fs6A=
+github.com/sigstore/sigstore-go v0.6.2/go.mod h1:pOIUH7Jx+ctwMICo+2zNrViOJJN5sGaQgwX4yAVJkA0=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=
@@ -485,8 +485,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
+golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -514,19 +514,19 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
-golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
+golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

From 1b59ec8ad07c07173df8da120b3ea82966a94ddc Mon Sep 17 00:00:00 2001
From: Fredrik Skogman <kommendorkapten@github.com>
Date: Thu, 29 Aug 2024 13:42:26 +0200
Subject: [PATCH 048/301] This commit introduces tenancy aware attestation
 policy building.

This is done by inspecting the current hostname to determine if
tenancy is enabled.

The attestation commands also accepts a --hostname parameter, that
is used to pick the current host, similar to how the GH_HOST variable
can be used.

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>
---
 .gitignore                                    |  3 +
 pkg/cmd/attestation/api/client.go             | 24 ++++-
 pkg/cmd/attestation/api/client_test.go        | 32 +++++++
 .../attestation/api/mock_apiClient_test.go    | 28 ++++++
 pkg/cmd/attestation/api/mock_client.go        |  5 ++
 pkg/cmd/attestation/api/trust_domain.go       | 15 ++++
 pkg/cmd/attestation/auth/host.go              |  5 +-
 pkg/cmd/attestation/auth/host_test.go         |  5 +-
 pkg/cmd/attestation/download/download.go      | 16 ++--
 pkg/cmd/attestation/download/options.go       |  1 +
 pkg/cmd/attestation/inspect/bundle.go         | 30 ++++---
 pkg/cmd/attestation/inspect/bundle_test.go    | 14 ++-
 pkg/cmd/attestation/inspect/inspect.go        | 33 ++++++-
 pkg/cmd/attestation/inspect/options.go        |  2 +
 .../attestation/trustedroot/trustedroot.go    | 88 ++++++++++++++-----
 .../attestation/verification/extensions.go    | 54 ++++++++----
 .../verification/extensions_test.go           | 60 ++++++++++++-
 pkg/cmd/attestation/verification/sigstore.go  | 20 ++++-
 pkg/cmd/attestation/verify/options.go         | 15 +++-
 pkg/cmd/attestation/verify/policy.go          | 50 +++--------
 pkg/cmd/attestation/verify/policy_test.go     | 47 ++++++----
 pkg/cmd/attestation/verify/verify.go          | 73 +++++++++++----
 .../verify/verify_integration_test.go         | 16 +++-
 pkg/cmd/attestation/verify/verify_test.go     | 67 +++++++++++++-
 24 files changed, 550 insertions(+), 153 deletions(-)
 create mode 100644 pkg/cmd/attestation/api/trust_domain.go

diff --git a/.gitignore b/.gitignore
index b2b66aaf7..272b7703d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,4 +27,7 @@
 # vim
 *.swp
 
+# Emacs
+*~
+
 vendor/
diff --git a/pkg/cmd/attestation/api/client.go b/pkg/cmd/attestation/api/client.go
index b0cafa6e9..460ae3aad 100644
--- a/pkg/cmd/attestation/api/client.go
+++ b/pkg/cmd/attestation/api/client.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/cli/cli/v2/api"
 	ioconfig "github.com/cli/cli/v2/pkg/cmd/attestation/io"
-	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 const (
@@ -18,12 +17,14 @@ const (
 )
 
 type apiClient interface {
+	REST(hostname, method, p string, body io.Reader, data interface{}) error
 	RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error)
 }
 
 type Client interface {
 	GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error)
 	GetByOwnerAndDigest(owner, digest string, limit int) ([]*Attestation, error)
+	GetTrustDomain() (string, error)
 }
 
 type LiveClient struct {
@@ -32,9 +33,7 @@ type LiveClient struct {
 	logger *ioconfig.Handler
 }
 
-func NewLiveClient(hc *http.Client, l *ioconfig.Handler) *LiveClient {
-	host, _ := auth.DefaultHost()
-
+func NewLiveClient(hc *http.Client, host string, l *ioconfig.Handler) *LiveClient {
 	return &LiveClient{
 		api:    api.NewClientFromHTTP(hc),
 		host:   strings.TrimSuffix(host, "/"),
@@ -64,6 +63,12 @@ func (c *LiveClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*At
 	return c.getAttestations(url, owner, digest, limit)
 }
 
+// GetTrustDomain returns the current trust domain. If the default is used
+// the empty string is returned
+func (c *LiveClient) GetTrustDomain() (string, error) {
+	return c.getTrustDomain(MetaPath)
+}
+
 func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*Attestation, error) {
 	c.logger.VerbosePrintf("Fetching attestations for artifact digest %s\n\n", digest)
 
@@ -102,3 +107,14 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 
 	return attestations, nil
 }
+
+func (c *LiveClient) getTrustDomain(url string) (string, error) {
+	var resp MetaResponse
+
+	err := c.api.REST(c.host, http.MethodGet, url, nil, &resp)
+	if err != nil {
+		return "", err
+	}
+
+	return resp.Domains.ArtifactAttestations.TrustDomain, nil
+}
diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index 693e3266e..bfcb40f5a 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -172,3 +172,35 @@ func TestGetByDigest_Error(t *testing.T) {
 	require.Error(t, err)
 	require.Nil(t, attestations)
 }
+
+func TestGetTrustDomain(t *testing.T) {
+	fetcher := mockMetaGenerator{
+		TrustDomain: "foo",
+	}
+
+	t.Run("with returned trust domain", func(t *testing.T) {
+		c := LiveClient{
+			api: mockAPIClient{
+				OnREST: fetcher.OnREST,
+			},
+			logger: io.NewTestHandler(),
+		}
+		td, err := c.GetTrustDomain()
+		require.Nil(t, err)
+		require.Equal(t, "foo", td)
+
+	})
+
+	t.Run("with error", func(t *testing.T) {
+		c := LiveClient{
+			api: mockAPIClient{
+				OnREST: fetcher.OnRESTError,
+			},
+			logger: io.NewTestHandler(),
+		}
+		td, err := c.GetTrustDomain()
+		require.Equal(t, "", td)
+		require.ErrorContains(t, err, "test error")
+	})
+
+}
diff --git a/pkg/cmd/attestation/api/mock_apiClient_test.go b/pkg/cmd/attestation/api/mock_apiClient_test.go
index 1d4f61cd9..d58cdbc79 100644
--- a/pkg/cmd/attestation/api/mock_apiClient_test.go
+++ b/pkg/cmd/attestation/api/mock_apiClient_test.go
@@ -10,12 +10,17 @@ import (
 
 type mockAPIClient struct {
 	OnRESTWithNext func(hostname, method, p string, body io.Reader, data interface{}) (string, error)
+	OnREST         func(hostname, method, p string, body io.Reader, data interface{}) error
 }
 
 func (m mockAPIClient) RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return m.OnRESTWithNext(hostname, method, p, body, data)
 }
 
+func (m mockAPIClient) REST(hostname, method, p string, body io.Reader, data interface{}) error {
+	return m.OnREST(hostname, method, p, body, data)
+}
+
 type mockDataGenerator struct {
 	NumAttestations int
 }
@@ -87,3 +92,26 @@ func (m mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p stri
 func (m mockDataGenerator) OnRESTWithNextError(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return "", errors.New("failed to get attestations")
 }
+
+type mockMetaGenerator struct {
+	TrustDomain string
+}
+
+func (m mockMetaGenerator) OnREST(hostname, method, p string, body io.Reader, data interface{}) error {
+	var template = `
+{
+  "domains": {
+    "artifact_attestations": {
+      "trust_domain": "%s"
+    }
+  }
+}
+`
+	var jsonString = fmt.Sprintf(template, m.TrustDomain)
+	return json.Unmarshal([]byte(jsonString), &data)
+
+}
+
+func (m mockMetaGenerator) OnRESTError(hostname, method, p string, body io.Reader, data interface{}) error {
+	return errors.New("test error")
+}
diff --git a/pkg/cmd/attestation/api/mock_client.go b/pkg/cmd/attestation/api/mock_client.go
index edb51ee6e..bcb51c414 100644
--- a/pkg/cmd/attestation/api/mock_client.go
+++ b/pkg/cmd/attestation/api/mock_client.go
@@ -9,6 +9,7 @@ import (
 type MockClient struct {
 	OnGetByRepoAndDigest  func(repo, digest string, limit int) ([]*Attestation, error)
 	OnGetByOwnerAndDigest func(owner, digest string, limit int) ([]*Attestation, error)
+	OnGetTrustDomain      func() (string, error)
 }
 
 func (m MockClient) GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error) {
@@ -19,6 +20,10 @@ func (m MockClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*Att
 	return m.OnGetByOwnerAndDigest(owner, digest, limit)
 }
 
+func (m MockClient) GetTrustDomain() (string, error) {
+	return m.OnGetTrustDomain()
+}
+
 func makeTestAttestation() Attestation {
 	return Attestation{Bundle: data.SigstoreBundle(nil)}
 }
diff --git a/pkg/cmd/attestation/api/trust_domain.go b/pkg/cmd/attestation/api/trust_domain.go
new file mode 100644
index 000000000..5cf9309ae
--- /dev/null
+++ b/pkg/cmd/attestation/api/trust_domain.go
@@ -0,0 +1,15 @@
+package api
+
+const MetaPath = "meta"
+
+type ArtifactAttestations struct {
+	TrustDomain string `json:"trust_domain"`
+}
+
+type Domain struct {
+	ArtifactAttestations ArtifactAttestations `json:"artifact_attestations"`
+}
+
+type MetaResponse struct {
+	Domains Domain `json:"domains"`
+}
diff --git a/pkg/cmd/attestation/auth/host.go b/pkg/cmd/attestation/auth/host.go
index 1b5a344ea..a40df8335 100644
--- a/pkg/cmd/attestation/auth/host.go
+++ b/pkg/cmd/attestation/auth/host.go
@@ -4,14 +4,11 @@ import (
 	"errors"
 
 	"github.com/cli/cli/v2/internal/ghinstance"
-	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")
 
-func IsHostSupported() error {
-	host, _ := auth.DefaultHost()
-
+func IsHostSupported(host string) error {
 	// Note that this check is slightly redundant as Tenancy should not be considered Enterprise
 	// but the ghinstance package has not been updated to reflect this yet.
 	if ghinstance.IsEnterprise(host) && !ghinstance.IsTenancy(host) {
diff --git a/pkg/cmd/attestation/auth/host_test.go b/pkg/cmd/attestation/auth/host_test.go
index 1d84888c4..5d905bd04 100644
--- a/pkg/cmd/attestation/auth/host_test.go
+++ b/pkg/cmd/attestation/auth/host_test.go
@@ -3,6 +3,8 @@ package auth
 import (
 	"testing"
 
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
+
 	"github.com/stretchr/testify/require"
 )
 
@@ -38,7 +40,8 @@ func TestIsHostSupported(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("GH_HOST", tc.host)
 
-			err := IsHostSupported()
+			host, _ := ghauth.DefaultHost()
+			err := IsHostSupported(host)
 			if tc.expectedErr {
 				require.ErrorIs(t, err, ErrUnsupportedHost)
 			} else {
diff --git a/pkg/cmd/attestation/download/download.go b/pkg/cmd/attestation/download/download.go
index 3af3b6200..770fa442b 100644
--- a/pkg/cmd/attestation/download/download.go
+++ b/pkg/cmd/attestation/download/download.go
@@ -11,6 +11,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -78,16 +79,18 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 			if err != nil {
 				return err
 			}
-			opts.APIClient = api.NewLiveClient(hc, opts.Logger)
 
-			opts.OCIClient = oci.NewLiveClient()
-
-			opts.Store = NewLiveStore("")
-
-			if err := auth.IsHostSupported(); err != nil {
+			if opts.Hostname == "" {
+				opts.Hostname, _ = ghauth.DefaultHost()
+			}
+			if err := auth.IsHostSupported(opts.Hostname); err != nil {
 				return err
 			}
 
+			opts.APIClient = api.NewLiveClient(hc, opts.Hostname, opts.Logger)
+			opts.OCIClient = oci.NewLiveClient()
+			opts.Store = NewLiveStore("")
+
 			if runF != nil {
 				return runF(opts)
 			}
@@ -106,6 +109,7 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 	downloadCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", "", "Filter attestations by provided predicate type")
 	cmdutil.StringEnumFlag(downloadCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	downloadCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
+	downloadCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return downloadCmd
 }
diff --git a/pkg/cmd/attestation/download/options.go b/pkg/cmd/attestation/download/options.go
index cc1c4d3b5..91f724853 100644
--- a/pkg/cmd/attestation/download/options.go
+++ b/pkg/cmd/attestation/download/options.go
@@ -24,6 +24,7 @@ type Options struct {
 	Owner           string
 	PredicateType   string
 	Repo            string
+	Hostname        string
 }
 
 func (opts *Options) AreFlagsValid() error {
diff --git a/pkg/cmd/attestation/inspect/bundle.go b/pkg/cmd/attestation/inspect/bundle.go
index 283b2c14e..d6dc5a4bb 100644
--- a/pkg/cmd/attestation/inspect/bundle.go
+++ b/pkg/cmd/attestation/inspect/bundle.go
@@ -55,17 +55,27 @@ type AttestationDetail struct {
 	WorkflowID     string `json:"workflowId"`
 }
 
-func getOrgAndRepo(repoURL string) (string, string, error) {
-	after, found := strings.CutPrefix(repoURL, "https://github.com/")
-	if !found {
-		return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+func getOrgAndRepo(tenant, repoURL string) (string, string, error) {
+	var after string
+	var found bool
+	if tenant == "" {
+		after, found = strings.CutPrefix(repoURL, "https://github.com/")
+		if !found {
+			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+		}
+	} else {
+		after, found = strings.CutPrefix(repoURL,
+			fmt.Sprintf("https://%s.ghe.com/", tenant))
+		if !found {
+			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+		}
 	}
 
 	parts := strings.Split(after, "/")
 	return parts[0], parts[1], nil
 }
 
-func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
+func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetail, error) {
 	envelope, err := attr.Bundle.Envelope()
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to get envelope from bundle: %v", err)
@@ -87,7 +97,7 @@ func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
 		return AttestationDetail{}, fmt.Errorf("failed to unmarshal predicate: %v", err)
 	}
 
-	org, repo, err := getOrgAndRepo(predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
+	org, repo, err := getOrgAndRepo(tenant, predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to parse attestation content: %v", err)
 	}
@@ -101,11 +111,11 @@ func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
 	}, nil
 }
 
-func getDetailsAsSlice(results []*verification.AttestationProcessingResult) ([][]string, error) {
+func getDetailsAsSlice(tenant string, results []*verification.AttestationProcessingResult) ([][]string, error) {
 	details := make([][]string, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(*result.Attestation)
+		detail, err := getAttestationDetail(tenant, *result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}
@@ -114,11 +124,11 @@ func getDetailsAsSlice(results []*verification.AttestationProcessingResult) ([][
 	return details, nil
 }
 
-func getAttestationDetails(results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
+func getAttestationDetails(tenant string, results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
 	details := make([]AttestationDetail, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(*result.Attestation)
+		detail, err := getAttestationDetail(tenant, *result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}
diff --git a/pkg/cmd/attestation/inspect/bundle_test.go b/pkg/cmd/attestation/inspect/bundle_test.go
index d7e9babd8..61b8d7bfc 100644
--- a/pkg/cmd/attestation/inspect/bundle_test.go
+++ b/pkg/cmd/attestation/inspect/bundle_test.go
@@ -12,7 +12,7 @@ import (
 func TestGetOrgAndRepo(t *testing.T) {
 	t.Run("with valid source URL", func(t *testing.T) {
 		sourceURL := "https://github.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo(sourceURL)
+		org, repo, err := getOrgAndRepo("", sourceURL)
 		require.Nil(t, err)
 		require.Equal(t, "github", org)
 		require.Equal(t, "gh-attestation", repo)
@@ -20,11 +20,19 @@ func TestGetOrgAndRepo(t *testing.T) {
 
 	t.Run("with invalid source URL", func(t *testing.T) {
 		sourceURL := "hub.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo(sourceURL)
+		org, repo, err := getOrgAndRepo("", sourceURL)
 		require.Error(t, err)
 		require.Zero(t, org)
 		require.Zero(t, repo)
 	})
+
+	t.Run("with valid source tenant URL", func(t *testing.T) {
+		sourceURL := "https://foo.ghe.com/github/gh-attestation"
+		org, repo, err := getOrgAndRepo("foo", sourceURL)
+		require.Nil(t, err)
+		require.Equal(t, "github", org)
+		require.Equal(t, "gh-attestation", repo)
+	})
 }
 
 func TestGetAttestationDetail(t *testing.T) {
@@ -35,7 +43,7 @@ func TestGetAttestationDetail(t *testing.T) {
 	require.NoError(t, err)
 
 	attestation := attestations[0]
-	detail, err := getAttestationDetail(*attestation)
+	detail, err := getAttestationDetail("", *attestation)
 	require.NoError(t, err)
 
 	require.Equal(t, "sigstore", detail.OrgName)
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index 2731ee7a4..867ff8c1b 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -3,13 +3,16 @@ package inspect
 import (
 	"fmt"
 
+	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/tableprinter"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/auth"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -66,8 +69,11 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.OCIClient = oci.NewLiveClient()
+			if opts.Hostname == "" {
+				opts.Hostname, _ = ghauth.DefaultHost()
+			}
 
-			if err := auth.IsHostSupported(); err != nil {
+			if err := auth.IsHostSupported(opts.Hostname); err != nil {
 				return err
 			}
 
@@ -78,6 +84,26 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			config := verification.SigstoreConfig{
 				Logger: opts.Logger,
 			}
+			// Prepare for tenancy if detected
+			if ghinstance.IsTenancy(opts.Hostname) {
+				hc, err := f.HttpClient()
+				if err != nil {
+					return err
+				}
+				apiClient := api.NewLiveClient(hc, opts.Hostname, opts.Logger)
+				td, err := apiClient.GetTrustDomain()
+				if err != nil {
+					return err
+				}
+				tenant, found := ghinstance.TenantName(opts.Hostname)
+				if !found {
+					return fmt.Errorf("Invalid hostname provided: '%s'",
+						opts.Hostname)
+				}
+
+				config.TrustDomain = td
+				opts.Tenant = tenant
+			}
 
 			opts.SigstoreVerifier = verification.NewLiveSigstoreVerifier(config)
 
@@ -90,6 +116,7 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 
 	inspectCmd.Flags().StringVarP(&opts.BundlePath, "bundle", "b", "", "Path to bundle on disk, either a single bundle in a JSON file or a JSON lines file with multiple bundles")
 	inspectCmd.MarkFlagRequired("bundle") //nolint:errcheck
+	inspectCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 	cmdutil.StringEnumFlag(inspectCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	cmdutil.AddFormatFlags(inspectCmd, &opts.exporter)
 
@@ -125,7 +152,7 @@ func runInspect(opts *Options) error {
 
 	// If the user provides the --format=json flag, print the results in JSON format
 	if opts.exporter != nil {
-		details, err := getAttestationDetails(res.VerifyResults)
+		details, err := getAttestationDetails(opts.Tenant, res.VerifyResults)
 		if err != nil {
 			return fmt.Errorf("failed to get attestation detail: %v", err)
 		}
@@ -138,7 +165,7 @@ func runInspect(opts *Options) error {
 	}
 
 	// otherwise, print results in a table
-	details, err := getDetailsAsSlice(res.VerifyResults)
+	details, err := getDetailsAsSlice(opts.Tenant, res.VerifyResults)
 	if err != nil {
 		return fmt.Errorf("failed to parse attestation details: %v", err)
 	}
diff --git a/pkg/cmd/attestation/inspect/options.go b/pkg/cmd/attestation/inspect/options.go
index b9c8819c4..1a5a1b937 100644
--- a/pkg/cmd/attestation/inspect/options.go
+++ b/pkg/cmd/attestation/inspect/options.go
@@ -18,6 +18,8 @@ type Options struct {
 	OCIClient        oci.Client
 	SigstoreVerifier verification.SigstoreVerifier
 	exporter         cmdutil.Exporter
+	Hostname         string
+	Tenant           string
 }
 
 // Clean cleans the file path option values
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index e28ceab62..c9c3fdb04 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -6,9 +6,13 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/cli/cli/v2/internal/ghinstance"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/auth"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/sigstore/sigstore-go/pkg/tuf"
@@ -19,6 +23,8 @@ type Options struct {
 	TufUrl      string
 	TufRootPath string
 	VerifyOnly  bool
+	Hostname    string
+	TrustDomain string
 }
 
 type tufClientInstantiator func(o *tuf.Options) (*tuf.Client, error)
@@ -54,10 +60,28 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 			gh attestation trusted-root
 		`),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if err := auth.IsHostSupported(); err != nil {
+			if opts.Hostname == "" {
+				opts.Hostname, _ = ghauth.DefaultHost()
+			}
+
+			if err := auth.IsHostSupported(opts.Hostname); err != nil {
 				return err
 			}
 
+			if ghinstance.IsTenancy(opts.Hostname) {
+				hc, err := f.HttpClient()
+				if err != nil {
+					return err
+				}
+				logger := io.NewHandler(f.IOStreams)
+				apiClient := api.NewLiveClient(hc, opts.Hostname, logger)
+				td, err := apiClient.GetTrustDomain()
+				if err != nil {
+					return err
+				}
+				opts.TrustDomain = td
+			}
+
 			if runF != nil {
 				return runF(opts)
 			}
@@ -74,12 +98,19 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 	trustedRootCmd.Flags().StringVarP(&opts.TufRootPath, "tuf-root", "", "", "Path to the TUF root.json file on disk")
 	trustedRootCmd.MarkFlagsRequiredTogether("tuf-url", "tuf-root")
 	trustedRootCmd.Flags().BoolVarP(&opts.VerifyOnly, "verify-only", "", false, "Don't output trusted_root.jsonl contents")
+	trustedRootCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return &trustedRootCmd
 }
 
+type tufConfig struct {
+	tufOptions *tuf.Options
+	targets    []string
+}
+
 func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
-	var tufOptions []*tuf.Options
+	var tufOptions []tufConfig
+	var defaultTR = "trusted_root.json"
 
 	tufOpt := verification.DefaultOptionsWithCacheSetting()
 	// Disable local caching, so we get up-to-date response from TUF repository
@@ -93,37 +124,54 @@ func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
 
 		tufOpt.Root = tufRoot
 		tufOpt.RepositoryBaseURL = opts.TufUrl
-		tufOptions = append(tufOptions, tufOpt)
+		tufOptions = append(tufOptions, tufConfig{
+			tufOptions: tufOpt,
+			targets:    []string{defaultTR},
+		})
 	} else {
 		// Get from both Sigstore public good and GitHub private instance
-		tufOptions = append(tufOptions, tufOpt)
+		tufOptions = append(tufOptions, tufConfig{
+			tufOptions: tufOpt,
+			targets:    []string{defaultTR},
+		})
 
 		tufOpt = verification.GitHubTUFOptions()
 		tufOpt.CacheValidity = 0
-		tufOptions = append(tufOptions, tufOpt)
+		targets := []string{defaultTR}
+		if opts.TrustDomain != "" {
+			targets = append(targets, fmt.Sprintf("%s.%s",
+				opts.TrustDomain, defaultTR))
+		}
+		tufOptions = append(tufOptions, tufConfig{
+			tufOptions: tufOpt,
+			targets:    targets,
+		})
 	}
 
-	for _, tufOpt = range tufOptions {
-		tufClient, err := makeTUF(tufOpt)
+	for _, tufOpt := range tufOptions {
+		tufClient, err := makeTUF(tufOpt.tufOptions)
 		if err != nil {
 			return fmt.Errorf("failed to create TUF client: %v", err)
 		}
 
-		t, err := tufClient.GetTarget("trusted_root.json")
-		if err != nil {
-			return err
-		}
+		for _, target := range tufOpt.targets {
+			t, err := tufClient.GetTarget(target)
+			if err != nil {
+				return fmt.Errorf("failed to retrieve trusted root %s via TUF: %w",
+					target, err)
+			}
 
-		output := new(bytes.Buffer)
-		err = json.Compact(output, t)
-		if err != nil {
-			return err
-		}
+			output := new(bytes.Buffer)
+			err = json.Compact(output, t)
+			if err != nil {
+				return err
+			}
 
-		if !opts.VerifyOnly {
-			fmt.Println(output)
-		} else {
-			fmt.Printf("Local TUF repository for %s updated and verified\n", tufOpt.RepositoryBaseURL)
+			if !opts.VerifyOnly {
+				fmt.Println(output)
+			} else {
+				fmt.Printf("Local TUF repository for %s updated and verified\n", tufOpt.tufOptions.RepositoryBaseURL)
+			}
 		}
 	}
 
diff --git a/pkg/cmd/attestation/verification/extensions.go b/pkg/cmd/attestation/verification/extensions.go
index 1915152dc..727feb72c 100644
--- a/pkg/cmd/attestation/verification/extensions.go
+++ b/pkg/cmd/attestation/verification/extensions.go
@@ -1,28 +1,50 @@
 package verification
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 )
 
-func VerifyCertExtensions(results []*AttestationProcessingResult, owner string, repo string) error {
-	for _, attestation := range results {
-		// TODO: handle proxima prefix
-		expectedSourceRepositoryOwnerURI := fmt.Sprintf("https://github.com/%s", owner)
-		sourceRepositoryOwnerURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryOwnerURI
-		if !strings.EqualFold(expectedSourceRepositoryOwnerURI, sourceRepositoryOwnerURI) {
-			return fmt.Errorf("expected SourceRepositoryOwnerURI to be %s, got %s", expectedSourceRepositoryOwnerURI, sourceRepositoryOwnerURI)
-		}
+func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner, repo string) error {
+	if len(results) == 0 {
+		return errors.New("no attestations proccessing results")
+	}
 
-		// if repo is set, check the SourceRepositoryURI field
-		if repo != "" {
-			// TODO: handle proxima prefix
-			expectedSourceRepositoryURI := fmt.Sprintf("https://github.com/%s", repo)
-			sourceRepositoryURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryURI
-			if !strings.EqualFold(expectedSourceRepositoryURI, sourceRepositoryURI) {
-				return fmt.Errorf("expected SourceRepositoryURI to be %s, got %s", expectedSourceRepositoryURI, sourceRepositoryURI)
-			}
+	for _, attestation := range results {
+		if err := verifyCertExtensions(attestation, tenant, owner, repo); err != nil {
+			return err
 		}
 	}
 	return nil
 }
+
+func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owner, repo string) error {
+	var want string
+
+	if tenant == "" {
+		want = fmt.Sprintf("https://github.com/%s", owner)
+	} else {
+		want = fmt.Sprintf("https://%s.ghe.com/%s", tenant, owner)
+	}
+	sourceRepositoryOwnerURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryOwnerURI
+	if !strings.EqualFold(want, sourceRepositoryOwnerURI) {
+		return fmt.Errorf("expected SourceRepositoryOwnerURI to be %s, got %s", want, sourceRepositoryOwnerURI)
+	}
+
+	// if repo is set, check the SourceRepositoryURI field
+	if repo != "" {
+		if tenant == "" {
+			want = fmt.Sprintf("https://github.com/%s", repo)
+		} else {
+			want = fmt.Sprintf("https://%s.ghe.com/%s", tenant, repo)
+		}
+
+		sourceRepositoryURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryURI
+		if !strings.EqualFold(want, sourceRepositoryURI) {
+			return fmt.Errorf("expected SourceRepositoryURI to be %s, got %s", want, sourceRepositoryURI)
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/cmd/attestation/verification/extensions_test.go b/pkg/cmd/attestation/verification/extensions_test.go
index 7aec4ec45..c86f2030a 100644
--- a/pkg/cmd/attestation/verification/extensions_test.go
+++ b/pkg/cmd/attestation/verification/extensions_test.go
@@ -25,22 +25,74 @@ func TestVerifyCertExtensions(t *testing.T) {
 	}
 
 	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
 		require.NoError(t, err)
 	})
 
+	t.Run("VerifyCertExtensions with owner and repo, but wrong tenant", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
+		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/owner, got https://github.com/owner")
+	})
+
 	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "owner", "")
+		err := VerifyCertExtensions(results, "", "owner", "")
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "wrong", "")
+		err := VerifyCertExtensions(results, "", "wrong", "")
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/wrong, got https://github.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "owner", "wrong")
+		err := VerifyCertExtensions(results, "", "owner", "wrong")
 		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://github.com/wrong, got https://github.com/owner/repo")
 	})
 }
+
+func TestVerifyTenancyCertExtensions(t *testing.T) {
+	results := []*AttestationProcessingResult{
+		{
+			VerificationResult: &verify.VerificationResult{
+				Signature: &verify.SignatureVerificationResult{
+					Certificate: &certificate.Summary{
+						Extensions: certificate.Extensions{
+							SourceRepositoryOwnerURI: "https://foo.ghe.com/owner",
+							SourceRepositoryURI:      "https://foo.ghe.com/owner/repo",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
+		require.NoError(t, err)
+	})
+
+	t.Run("VerifyCertExtensions with owner and repo, no tenant", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
+		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/owner, got https://foo.ghe.com/owner")
+	})
+
+	t.Run("VerifyCertExtensions with owner and repo, wrong tenant", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "bar", "owner", "owner/repo")
+		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://bar.ghe.com/owner, got https://foo.ghe.com/owner")
+	})
+
+	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "")
+		require.NoError(t, err)
+	})
+
+	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "wrong", "")
+		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner")
+	})
+
+	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "wrong")
+		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner/repo")
+	})
+}
diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index 9a4ac5194..927eacf49 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -36,6 +36,8 @@ type SigstoreConfig struct {
 	TrustedRoot  string
 	Logger       *io.Handler
 	NoPublicGood bool
+	// If tenancy mode is not used, trust domain is empty
+	TrustDomain string
 }
 
 type SigstoreVerifier interface {
@@ -144,7 +146,7 @@ func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.Bundle) (*verify.SignedE
 
 		return publicGoodVerifier, issuer, nil
 	} else if leafCert.Issuer.Organization[0] == GitHubIssuerOrg || v.config.NoPublicGood {
-		ghVerifier, err := newGitHubVerifier()
+		ghVerifier, err := newGitHubVerifier(v.config.TrustDomain)
 		if err != nil {
 			return nil, "", fmt.Errorf("failed to create GitHub Sigstore verifier: %v", err)
 		}
@@ -240,13 +242,25 @@ func newCustomVerifier(trustedRoot *root.TrustedRoot) (*verify.SignedEntityVerif
 	return gv, nil
 }
 
-func newGitHubVerifier() (*verify.SignedEntityVerifier, error) {
+func newGitHubVerifier(trustDomain string) (*verify.SignedEntityVerifier, error) {
+	var tr string
+
 	opts := GitHubTUFOptions()
 	client, err := tuf.New(opts)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create TUF client: %v", err)
 	}
-	trustedRoot, err := root.GetTrustedRoot(client)
+
+	if trustDomain == "" {
+		tr = "trusted_root.json"
+	} else {
+		tr = fmt.Sprintf("%s.trusted_root.json", trustDomain)
+	}
+	jsonBytes, err := client.GetTarget(tr)
+	if err != nil {
+		return nil, err
+	}
+	trustedRoot, err := root.NewTrustedRootFromJSON(jsonBytes)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cmd/attestation/verify/options.go b/pkg/cmd/attestation/verify/options.go
index 3ec2d49f1..126159023 100644
--- a/pkg/cmd/attestation/verify/options.go
+++ b/pkg/cmd/attestation/verify/options.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
@@ -37,6 +38,9 @@ type Options struct {
 	OCIClient             oci.Client
 	SigstoreVerifier      verification.SigstoreVerifier
 	exporter              cmdutil.Exporter
+	Hostname              string
+	// Tenant is only set when tenancy is used
+	Tenant string
 }
 
 // Clean cleans the file path option values
@@ -57,12 +61,12 @@ func (opts *Options) SetPolicyFlags() {
 		opts.Owner = splitRepo[0]
 
 		if !isSignerIdentityProvided(opts) {
-			opts.SANRegex = expandToGitHubURL(opts.Repo)
+			opts.SANRegex = expandToGitHubURL(opts.Tenant, opts.Repo)
 		}
 		return
 	}
 	if !isSignerIdentityProvided(opts) {
-		opts.SANRegex = expandToGitHubURL(opts.Owner)
+		opts.SANRegex = expandToGitHubURL(opts.Tenant, opts.Owner)
 	}
 }
 
@@ -94,6 +98,13 @@ func (opts *Options) AreFlagsValid() error {
 		return fmt.Errorf("bundle-from-oci flag cannot be used with bundle-path flag")
 	}
 
+	// Verify provided hostname
+	if opts.Hostname != "" {
+		if err := ghinstance.HostnameValidator(opts.Hostname); err != nil {
+			return fmt.Errorf("error parsing hostname: %w", err)
+		}
+	}
+
 	return nil
 }
 
diff --git a/pkg/cmd/attestation/verify/policy.go b/pkg/cmd/attestation/verify/policy.go
index 4d850ddcc..0c7a686c2 100644
--- a/pkg/cmd/attestation/verify/policy.go
+++ b/pkg/cmd/attestation/verify/policy.go
@@ -1,8 +1,8 @@
 package verify
 
 import (
+	"errors"
 	"fmt"
-	"os"
 	"regexp"
 
 	"github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
@@ -13,21 +13,23 @@ import (
 )
 
 const (
-	GitHubOIDCIssuer = "https://token.actions.githubusercontent.com"
+	GitHubOIDCIssuer       = "https://token.actions.githubusercontent.com"
+	GitHubTenantOIDCIssuer = "https://token.actions.%s.ghe.com"
 	// represents the GitHub hosted runner in the certificate RunnerEnvironment extension
 	GitHubRunner = "github-hosted"
-	githubHost   = "github.com"
 	hostRegex    = `^[a-zA-Z0-9-]+\.[a-zA-Z0-9-]+.*$`
 )
 
-func expandToGitHubURL(ownerOrRepo string) string {
-	// TODO: handle proxima prefix
-	return fmt.Sprintf("(?i)^https://github.com/%s/", ownerOrRepo)
+func expandToGitHubURL(tenant, ownerOrRepo string) string {
+	if tenant == "" {
+		return fmt.Sprintf("(?i)^https://github.com/%s/", ownerOrRepo)
+	}
+	return fmt.Sprintf("(?i)^https://%s.ghe.com/%s/", tenant, ownerOrRepo)
 }
 
 func buildSANMatcher(opts *Options) (verify.SubjectAlternativeNameMatcher, error) {
 	if opts.SignerRepo != "" {
-		signedRepoRegex := expandToGitHubURL(opts.SignerRepo)
+		signedRepoRegex := expandToGitHubURL(opts.Tenant, opts.SignerRepo)
 		return verify.NewSANMatcher("", signedRepoRegex)
 	} else if opts.SignerWorkflow != "" {
 		validatedWorkflowRegex, err := validateSignerWorkflow(opts)
@@ -118,37 +120,9 @@ func validateSignerWorkflow(opts *Options) (string, error) {
 		return addSchemeToRegex(opts.SignerWorkflow), nil
 	}
 
-	// if the provided workflow does not contain a host, check for a host
-	// and prepend it to the workflow
-	host, err := chooseHost(opts)
-	if err != nil {
-		return "", err
+	if opts.Hostname == "" {
+		return "", errors.New("unknown host")
 	}
 
-	return addSchemeToRegex(fmt.Sprintf("%s/%s", host, opts.SignerWorkflow)), nil
-}
-
-// if a host was not provided as part of a flag argument choose a host based
-// on gh cli configuration
-func chooseHost(opts *Options) (string, error) {
-	// check if GH_HOST is set and use that host if it is
-	host := os.Getenv("GH_HOST")
-	if host != "" {
-		return host, nil
-	}
-
-	// check if the CLI is authenticated with any hosts
-	cfg, err := opts.Config()
-	if err != nil {
-		return "", err
-	}
-
-	// if authenticated, return the authenticated host
-	authCfg := cfg.Authentication()
-	if host, _ := authCfg.DefaultHost(); host != "" {
-		return host, nil
-	}
-
-	// if not authenticated, return the default host github.com
-	return githubHost, nil
+	return addSchemeToRegex(fmt.Sprintf("%s/%s", opts.Hostname, opts.SignerWorkflow)), nil
 }
diff --git a/pkg/cmd/attestation/verify/policy_test.go b/pkg/cmd/attestation/verify/policy_test.go
index 40435d19e..89f989b45 100644
--- a/pkg/cmd/attestation/verify/policy_test.go
+++ b/pkg/cmd/attestation/verify/policy_test.go
@@ -1,7 +1,6 @@
 package verify
 
 import (
-	"os"
 	"testing"
 
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
@@ -32,13 +31,12 @@ func TestBuildPolicy(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func ValidateSignerWorkflow(t *testing.T) {
+func TestValidateSignerWorkflow(t *testing.T) {
 	type testcase struct {
 		name                   string
 		providedSignerWorkflow string
 		expectedWorkflowRegex  string
-		ghHost                 string
-		authHost               string
+		host                   string
 	}
 
 	testcases := []testcase{
@@ -56,13 +54,19 @@ func ValidateSignerWorkflow(t *testing.T) {
 			name:                   "workflow with GH_HOST set",
 			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectedWorkflowRegex:  "^https://myhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			ghHost:                 "myhost.github.com",
+			host:                   "myhost.github.com",
 		},
 		{
 			name:                   "workflow with authenticated host",
 			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			authHost:               "authedhost.github.com",
+			host:                   "authedhost.github.com",
+		},
+		{
+			name:                   "workflow with authenticated host",
+			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			host:                   "authedhost.github.com",
 		},
 	}
 
@@ -74,22 +78,29 @@ func ValidateSignerWorkflow(t *testing.T) {
 			SignerWorkflow: tc.providedSignerWorkflow,
 		}
 
-		if tc.ghHost != "" {
-			err := os.Setenv("GH_HOST", tc.ghHost)
-			require.NoError(t, err)
-		}
-
-		if tc.authHost != "" {
-			cfg, err := opts.Config()
-			require.NoError(t, err)
-
-			// if authenticated, return the authenticated host
-			authCfg := cfg.Authentication()
-			authCfg.SetDefaultHost(tc.authHost, "")
+		// All host resolution is done verify.go:RunE
+		if tc.host == "" {
+			// Set to default host
+			tc.host = "github.com"
 		}
+		opts.Hostname = tc.host
 
 		workflowRegex, err := validateSignerWorkflow(opts)
 		require.NoError(t, err)
 		require.Equal(t, tc.expectedWorkflowRegex, workflowRegex)
+
 	}
 }
+
+func TestValidateSignerWorkflowNoHost(t *testing.T) {
+	cmdFactory := factory.New("test")
+	opts := &Options{
+		Config:         cmdFactory.Config,
+		SignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
+	}
+
+	workflowRegex, err := validateSignerWorkflow(opts)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "unknown host")
+	require.Equal(t, "", workflowRegex)
+}
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 055636ad5..9e508e994 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"regexp"
 
+	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
@@ -13,6 +14,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -109,9 +111,6 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			// Clean file path options
 			opts.Clean()
 
-			// set policy flags based on what has been provided
-			opts.SetPolicyFlags()
-
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -119,17 +118,18 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			if err != nil {
 				return err
 			}
-			opts.APIClient = api.NewLiveClient(hc, opts.Logger)
 
 			opts.OCIClient = oci.NewLiveClient()
 
-			if err := auth.IsHostSupported(); err != nil {
+			if opts.Hostname == "" {
+				opts.Hostname, _ = ghauth.DefaultHost()
+			}
+			err = auth.IsHostSupported(opts.Hostname)
+			if err != nil {
 				return err
 			}
 
-			if runF != nil {
-				return runF(opts)
-			}
+			opts.APIClient = api.NewLiveClient(hc, opts.Hostname, opts.Logger)
 
 			config := verification.SigstoreConfig{
 				TrustedRoot:  opts.TrustedRoot,
@@ -137,6 +137,30 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 				NoPublicGood: opts.NoPublicGood,
 			}
 
+			// Prepare for tenancy if detected
+			if ghinstance.IsTenancy(opts.Hostname) {
+				td, err := opts.APIClient.GetTrustDomain()
+				if err != nil {
+					return fmt.Errorf("error getting trust domain, make sure you are authenticated against the host: %w", err)
+				}
+
+				tenant, found := ghinstance.TenantName(opts.Hostname)
+				if !found {
+					return fmt.Errorf("invalid hostname provided: '%s'",
+						opts.Hostname)
+				}
+				config.TrustDomain = td
+				opts.Tenant = tenant
+				opts.OIDCIssuer = fmt.Sprintf(GitHubTenantOIDCIssuer, tenant)
+			}
+
+			// set policy flags based on what has been provided
+			opts.SetPolicyFlags()
+
+			if runF != nil {
+				return runF(opts)
+			}
+
 			opts.SigstoreVerifier = verification.NewLiveSigstoreVerifier(config)
 			opts.Config = f.Config
 
@@ -169,6 +193,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	verifyCmd.Flags().StringVarP(&opts.SignerWorkflow, "signer-workflow", "", "", "Workflow that signed attestation in the format [host/]<owner>/<repo>/<path>/<to>/<workflow>")
 	verifyCmd.MarkFlagsMutuallyExclusive("cert-identity", "cert-identity-regex", "signer-repo", "signer-workflow")
 	verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", GitHubOIDCIssuer, "Issuer of the OIDC token")
+	verifyCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return verifyCmd
 }
@@ -244,7 +269,7 @@ func runVerify(opts *Options) error {
 	}
 
 	// Verify extensions
-	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Owner, opts.Repo); err != nil {
+	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo); err != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
 		return err
 	}
@@ -264,7 +289,7 @@ func runVerify(opts *Options) error {
 	opts.Logger.Printf("%s was attested by:\n", artifact.DigestWithAlg())
 
 	// Otherwise print the results to the terminal in a table
-	tableContent, err := buildTableVerifyContent(sigstoreRes.VerifyResults)
+	tableContent, err := buildTableVerifyContent(opts.Tenant, sigstoreRes.VerifyResults)
 	if err != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("failed to parse results"))
 		return err
@@ -280,30 +305,44 @@ func runVerify(opts *Options) error {
 	return nil
 }
 
-func extractAttestationDetail(builderSignerURI string) (string, string, error) {
+func extractAttestationDetail(tenant, builderSignerURI string) (string, string, error) {
 	// If given a build signer URI like
 	// https://github.com/foo/bar/.github/workflows/release.yml@refs/heads/main
 	// We want to extract:
 	// * foo/bar
 	// * .github/workflows/release.yml@refs/heads/main
-	orgAndRepoRegexp := regexp.MustCompile(`https://github\.com/([^/]+/[^/]+)/`)
+	var orgAndRepoRegexp *regexp.Regexp
+	var workflowRegexp *regexp.Regexp
+
+	if tenant == "" {
+		orgAndRepoRegexp = regexp.MustCompile(`https://github\.com/([^/]+/[^/]+)/`)
+		workflowRegexp = regexp.MustCompile(`https://github\.com/[^/]+/[^/]+/(.+)`)
+	} else {
+		var tr = regexp.QuoteMeta(tenant)
+		orgAndRepoRegexp = regexp.MustCompile(fmt.Sprintf(
+			`https://%s\.ghe\.com/([^/]+/[^/]+)/`,
+			tr))
+		workflowRegexp = regexp.MustCompile(fmt.Sprintf(
+			`https://%s\.ghe\.com/[^/]+/[^/]+/(.+)`,
+			tr))
+	}
+
 	match := orgAndRepoRegexp.FindStringSubmatch(builderSignerURI)
 	if len(match) < 2 {
 		return "", "", fmt.Errorf("no match found for org and repo")
 	}
-	repoAndOrg := match[1]
+	orgAndRepo := match[1]
 
-	workflowRegexp := regexp.MustCompile(`https://github\.com/[^/]+/[^/]+/(.+)`)
 	match = workflowRegexp.FindStringSubmatch(builderSignerURI)
 	if len(match) < 2 {
 		return "", "", fmt.Errorf("no match found for workflow")
 	}
 	workflow := match[1]
 
-	return repoAndOrg, workflow, nil
+	return orgAndRepo, workflow, nil
 }
 
-func buildTableVerifyContent(results []*verification.AttestationProcessingResult) ([][]string, error) {
+func buildTableVerifyContent(tenant string, results []*verification.AttestationProcessingResult) ([][]string, error) {
 	content := make([][]string, len(results))
 
 	for i, res := range results {
@@ -313,7 +352,7 @@ func buildTableVerifyContent(results []*verification.AttestationProcessingResult
 			return nil, fmt.Errorf("bundle missing verification result fields")
 		}
 		builderSignerURI := res.VerificationResult.Signature.Certificate.Extensions.BuildSignerURI
-		repoAndOrg, workflow, err := extractAttestationDetail(builderSignerURI)
+		repoAndOrg, workflow, err := extractAttestationDetail(tenant, builderSignerURI)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index 9ad7a87a3..611b1d89f 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/test"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmd/factory"
+	"github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/stretchr/testify/require"
 )
 
@@ -28,8 +29,10 @@ func TestVerifyIntegration(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	host, _ := auth.DefaultHost()
+
 	publicGoodOpts := Options{
-		APIClient:        api.NewLiveClient(hc, logger),
+		APIClient:        api.NewLiveClient(hc, host, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		DigestAlgorithm:  "sha512",
@@ -99,8 +102,10 @@ func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	host, _ := auth.DefaultHost()
+
 	baseOpts := Options{
-		APIClient:        api.NewLiveClient(hc, logger),
+		APIClient:        api.NewLiveClient(hc, host, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		DigestAlgorithm:  "sha256",
@@ -185,8 +190,10 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	host, _ := auth.DefaultHost()
+
 	baseOpts := Options{
-		APIClient:        api.NewLiveClient(hc, logger),
+		APIClient:        api.NewLiveClient(hc, host, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		Config:           cmdFactory.Config,
@@ -203,6 +210,7 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		name           string
 		signerWorkflow string
 		expectErr      bool
+		host           string
 	}
 
 	testcases := []testcase{
@@ -220,12 +228,14 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 			name:           "valid signer workflow without host (defaults to github.com)",
 			signerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectErr:      false,
+			host:           "github.com",
 		},
 	}
 
 	for _, tc := range testcases {
 		opts := baseOpts
 		opts.SignerWorkflow = tc.signerWorkflow
+		opts.Hostname = tc.host
 
 		err := runVerify(&opts)
 		if tc.expectErr {
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 89c5ae7c1..6f71b537f 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -35,10 +35,21 @@ var (
 
 func TestNewVerifyCmd(t *testing.T) {
 	testIO, _, _, _ := iostreams.Test()
+	var testReg httpmock.Registry
+	var metaResp = api.MetaResponse{
+		Domains: api.Domain{
+			ArtifactAttestations: api.ArtifactAttestations{
+				TrustDomain: "foo",
+			},
+		},
+	}
+	testReg.Register(httpmock.REST(http.MethodGet, "api/v3/meta"),
+		httpmock.StatusJSONResponse(200, &metaResp))
+
 	f := &cmdutil.Factory{
 		IOStreams: testIO,
 		HttpClient: func() (*http.Client, error) {
-			reg := &httpmock.Registry{}
+			reg := &testReg
 			client := &http.Client{}
 			httpmock.ReplaceTripper(client, reg)
 			return client, nil
@@ -63,6 +74,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				OIDCIssuer:       GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -78,9 +90,42 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
+		{
+			name: "Custom host",
+			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --hostname foo.ghe.com", artifactPath, bundlePath),
+			wants: Options{
+				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
+				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
+				DigestAlgorithm:  "sha256",
+				Limit:            30,
+				OIDCIssuer:       "https://token.actions.foo.ghe.com",
+				Owner:            "sigstore",
+				SANRegex:         "(?i)^https://foo.ghe.com/sigstore/",
+				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "foo.ghe.com",
+			},
+			wantsErr: false,
+		},
+		{
+			name: "Invalid custom host",
+			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --hostname foo.bar.com", artifactPath, bundlePath),
+			wants: Options{
+				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
+				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
+				DigestAlgorithm:  "sha256",
+				Limit:            30,
+				OIDCIssuer:       GitHubOIDCIssuer,
+				Owner:            "sigstore",
+				SANRegex:         "(?i)^https://github.com/sigstore/",
+				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "foo.ghe.com",
+			},
+			wantsErr: true,
+		},
 		{
 			name: "Use custom digest-alg value",
 			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --digest-alg sha512", artifactPath, bundlePath),
@@ -93,6 +138,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -107,6 +153,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -121,6 +168,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Repo:             "sigstore/sigstore-js",
 				Limit:            30,
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -135,6 +183,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -149,6 +198,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            101,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -163,6 +213,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            0,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -178,6 +229,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				SAN:              "https://github.com/sigstore/",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -193,6 +245,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+				Hostname:         "github.com",
 			},
 			wantsExporter: true,
 		},
@@ -230,6 +283,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			assert.Equal(t, tc.wants.Repo, opts.Repo)
 			assert.Equal(t, tc.wants.SAN, opts.SAN)
 			assert.Equal(t, tc.wants.SANRegex, opts.SANRegex)
+			assert.Equal(t, tc.wants.Hostname, opts.Hostname)
 			assert.NotNil(t, opts.APIClient)
 			assert.NotNil(t, opts.Logger)
 			assert.NotNil(t, opts.OCIClient)
@@ -357,6 +411,17 @@ func TestRunVerify(t *testing.T) {
 		require.Nil(t, runVerify(&opts))
 	})
 
+	// Test with bad tenancy
+	t.Run("with bad tenancy", func(t *testing.T) {
+		opts := publicGoodOpts
+		opts.BundlePath = ""
+		opts.Repo = "sigstore/sigstore-js"
+		opts.Tenant = "foo"
+
+		err := runVerify(&opts)
+		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/sigstore, got https://github.com/sigstore")
+	})
+
 	t.Run("with repo which not matches SourceRepositoryURI", func(t *testing.T) {
 		opts := publicGoodOpts
 		opts.BundlePath = ""

From a0a25673542e669561551376431b5029ae5484d4 Mon Sep 17 00:00:00 2001
From: Tim Rogers <me@timrogers.co.uk>
Date: Wed, 11 Sep 2024 11:50:05 +0100
Subject: [PATCH 049/301] Suggest installing Rosetta when extension
 installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64`
 binary is available

When installing an extension, the CLI must to select the correct
binary to download for the machine (see the
[`installBin` function](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L240)).

By default, the CLI will download a binary matching the current
machine's architecture.

However, to provide better support for Macs running on Apple
Silicon, it will
[fall back](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L267-L274)
from `darwin-arm64` to `darwin-amd64` if
[Rosetta](https://support.apple.com/en-gb/102527) (Apple's
compatibility layer) is installed.

If Rosetta isn't installed, this fallback doesn't happen, which
can lead to surprising and confusing results when one Mac has
Rosetta and another doesn't, because the extension will install
on one machine but not another.

In the situation where a `darwin-arm64` binary isn't available
but the CLI can't fall back to `amd64` because Rosetta isn't
installed, this updates our error message to suggest installing
Rosetta.

Closes https://github.com/cli/cli/issues/9592.
---
 pkg/cmd/extension/manager.go | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 0ab429c2e..60fe8d239 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -263,12 +263,18 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 		}
 	}
 
-	// if an arm64 binary is unavailable, fall back to amd64 if it can be executed through Rosetta 2
-	if asset == nil && isMacARM && hasRosetta() {
+	// if using an ARM-based Mac and an arm64 binary is unavailable, fall back to amd64 if a relevant binary is available and Rosetta 2 is installed
+	if asset == nil && isMacARM {
 		for _, a := range r.Assets {
 			if strings.HasSuffix(a.Name, "darwin-amd64") {
-				asset = &a
-				break
+				if hasRosetta() {
+					asset = &a
+					break
+				} else {
+					return fmt.Errorf(
+						"%[1]s unsupported for %[2]s. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
+						repo.RepoName(), platform, repo.RepoOwner())
+				}
 			}
 		}
 	}

From fbdf0ccb7576055c1a44ee23192b919e07199083 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 11 Sep 2024 14:39:44 +0000
Subject: [PATCH 050/301] build(deps): bump github.com/sigstore/sigstore-go
 from 0.6.1 to 0.6.2

Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](https://github.com/sigstore/sigstore-go/compare/v0.6.1...v0.6.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 10 +++++-----
 go.sum | 20 ++++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/go.mod b/go.mod
index 50278d733..78ceb7f70 100644
--- a/go.mod
+++ b/go.mod
@@ -38,15 +38,15 @@ require (
 	github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
 	github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc
 	github.com/sigstore/protobuf-specs v0.3.2
-	github.com/sigstore/sigstore-go v0.6.1
+	github.com/sigstore/sigstore-go v0.6.2
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/zalando/go-keyring v0.2.5
-	golang.org/x/crypto v0.26.0
+	golang.org/x/crypto v0.27.0
 	golang.org/x/sync v0.8.0
-	golang.org/x/term v0.23.0
-	golang.org/x/text v0.17.0
+	golang.org/x/term v0.24.0
+	golang.org/x/text v0.18.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -159,7 +159,7 @@ require (
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index 407739dfe..37c40407d 100644
--- a/go.sum
+++ b/go.sum
@@ -395,8 +395,8 @@ github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
 github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
 github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFadk=
 github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
-github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
-github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
+github.com/sigstore/sigstore-go v0.6.2 h1:8uiywjt73vzfrGfWYVwVsiB1E1Qmwmpgr1kVpl4fs6A=
+github.com/sigstore/sigstore-go v0.6.2/go.mod h1:pOIUH7Jx+ctwMICo+2zNrViOJJN5sGaQgwX4yAVJkA0=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=
@@ -485,8 +485,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
+golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -514,19 +514,19 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
-golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
+golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

From f128ae8349950cbaeb4c68b7635955f1b6200f19 Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Tue, 10 Sep 2024 14:37:38 -0700
Subject: [PATCH 051/301] add att verify test for custom OIDC issuer

Signed-off-by: Brian DeHamer <bdehamer@github.com>
---
 .../test/data/custom-issuer-artifact          |  1 +
 .../test/data/custom-issuer.sigstore.json     | 61 ++++++++++++++++
 .../verify/verify_integration_test.go         | 69 +++++++++++++++++++
 3 files changed, 131 insertions(+)
 create mode 100644 pkg/cmd/attestation/test/data/custom-issuer-artifact
 create mode 100644 pkg/cmd/attestation/test/data/custom-issuer.sigstore.json

diff --git a/pkg/cmd/attestation/test/data/custom-issuer-artifact b/pkg/cmd/attestation/test/data/custom-issuer-artifact
new file mode 100644
index 000000000..bdd51cc27
--- /dev/null
+++ b/pkg/cmd/attestation/test/data/custom-issuer-artifact
@@ -0,0 +1 @@
+hello-world
\ No newline at end of file
diff --git a/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json b/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json
new file mode 100644
index 000000000..ad47e2478
--- /dev/null
+++ b/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json
@@ -0,0 +1,61 @@
+{
+  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
+  "verificationMaterial": {
+    "tlogEntries": [
+      {
+        "logIndex": "129601213",
+        "logId": {
+          "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
+        },
+        "kindVersion": {
+          "kind": "dsse",
+          "version": "0.0.1"
+        },
+        "integratedTime": "1726082343",
+        "inclusionPromise": {
+          "signedEntryTimestamp": "MEQCICL0FAIR4ISP9CZJERTDWm0ZWQXmBfk1n2rNaKcThjFnAiAOpJMbjiwKD+Nt32VgodKh3whOZWERIerwtuTGChcKVg=="
+        },
+        "inclusionProof": {
+          "logIndex": "7696951",
+          "rootHash": "jFHZ9WG6TKsPs3sSueywIxZ8kCLggGmqg2toWJ8seXk=",
+          "treeSize": "7696953",
+          "hashes": [
+            "CYHKf/bh3CxW39mRO4FlajMmrzH8KleobYBryPGMjhQ=",
+            "kAIZZLHLd1KnJQ3CNShHaxG5wQjuF0wG49oq5AC4vXQ=",
+            "f9/xH+QDA5+muxMr2QouK2OLOLkI+jPM2lUX7diPaOA=",
+            "mlhYVIwuxUw07ewtU3um0c8IkYPf55EhyXwuOlzwJbs=",
+            "K2QMn27+dp+8+2utA7P0W1+pFT18nvdFMIlz3qXBC/0=",
+            "+5kLbgrjmfzkYQ0V+vofM18LsqyNpLa5oRr/24gOH+s=",
+            "kNWva6L6IlKsmCkDx0cdNtZJztdunXsjWqzwn/k9moQ=",
+            "W8NjV+EXoTQRJYFsLhEueUiT6vxbPXYoSIONJIJmCvM=",
+            "8tdMgSRLWN3UxGVxNBjKm/4Sjivq1EMAAomCJVhscmU=",
+            "hPmHSU/WMp+ST2P+1mEnh/wjLLY9KbulaYu+ELcIJ2o=",
+            "KYw9/y5e7chXWKn9xKSkwIm0ZV/niE9MccszZ/yMVH8=",
+            "52g33BcJumS4u9qvM95+2WQcPJoG3zKFTsDQU/yGT/Q=",
+            "57ZnG4cTkj/dfCv8Vz7kMnUbcY3NL1PkfzMA2cgdg0c=",
+            "uRsmea7eVXshBNN6huh/owmfaAy9Rx4Cq2M2vFb2Ntk=",
+            "NeHKGVl6KVXfx3+wnQrIrxra4Pr9Fa7YDpTlf86mlTc="
+          ],
+          "checkpoint": {
+            "envelope": "rekor.sigstore.dev - 1193050959916656506\n7696953\njFHZ9WG6TKsPs3sSueywIxZ8kCLggGmqg2toWJ8seXk=\n\n— rekor.sigstore.dev wNI9ajBFAiEA4cRIk3KpKhPAmONZTnKJ84MWoy/uylIgvcQ5hZsQdsQCIFrXcNcJfpQQAXlhca0jAsz/4vqXvuFdHTT12JDyXhjW\n"
+          }
+        },
+        "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNTM0ZDM4OWFmY2ZiMGYyOGE1MzE2MDEzNmRhOTNmODQyNGEwOGMzMzZhMTQ5YzcxNjg5NWFiY2EyZDlhMzAxMSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjhkOWMxNzg0NjA5ZGJkZmQxMjhhMjFlMzdiNzJhY2QwZDVmY2RhNjBlMzRjZjQwZGI2ZGYwMDQyODJmMGFjMDQifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRRG82SGN1ZkQxWDVXK0FMcUFzK0d0VXZvcEZYQlFGNUpDRFJXODlWTndOV1FJaEFKdjRTSjhINlJPM3JwV3Zib3VUWTdrNGJzUWN1NWNDa2l1aXRRSjlkMEgvIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VjNGFrTkRRbTV0WjBGM1NVSkJaMGxWVDBwd05EVmpPVTExVGxKU1JISk5XSEpMZG5sSWJHc3JVbFpKZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwUmQwOVVSWGhOVkd0NFQxUkJlbGRvWTA1TmFsRjNUMVJGZUUxVWEzbFBWRUY2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlpUbVZEZFVsMUsySnRhRzR4UkdsdmRHRnVNakZpUjFsTGVGcHdSVFpOV2paUFlTOEtWMjh4WTNsNU5raFhNVVZJVEZsQ00wbG5XRE56Y1RkdFNFSklaMWQyY1dwMlFWVkdVelZZTUZaVFZGWktkR0Z4TkV0UFEwSmFaM2RuWjFkVlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVXJkVkkxQ2tSMFRHeDRWelJQTnpCMWFWcGtXVXBZTWlzd01EUnpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMWwzV1VSV1VqQlNRVkZJTDBKR2EzZFdORnBXWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5TZG1KNU1YTmFWMlJ3WkVNNWFBcGtTRkpzWXpOUmRreHRaSEJrUjJneFdXazVNMkl6U25KYWJYaDJaRE5OZG1GWE5UQmFWMlI1V1ZoU2NHSXlOSFZsVnpGelVVaEtiRnB1VFhaaFIxWm9DbHBJVFhaaVYwWndZbXBDUmtKbmIzSkNaMFZGUVZsUEwwMUJSVUpDUkdSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREFLWVVoV2FXUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUREpvYUdKWE1XeGphVEV3WVZjeGJFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZGdwamJYUnRZa2M1TTFneVVuQmpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJKTkUweVNtMVBWRmt6V20xRmVsbDZWVFZOVkd0NUNrNVhVbXROYWxac1RtMUZNbHBVYUd4T2VtZDRUbFJSZVUxVVJUTlpiVmwzUzJkWlMwdDNXVUpDUVVkRWRucEJRa0pCVVdOUldGSXdXbGhPTUZsWVVuQUtZakkwWjFOWE5UQmFWMlI1V1ZoU2NHSXlOR2RXUjFaNlpFUkJaVUpuYjNKQ1owVkZRVmxQTDAxQlJVWkNRa0l3WWpJNGRHSkhWbTVoV0ZGMldWaFNNQXBhV0U0d1RVSXdSME5wYzBkQlVWRkNaemM0ZDBGUldVVkVNMHBzV201TmRtRkhWbWhhU0UxMllsZEdjR0pxUWtoQ1oyOXlRbWRGUlVGWlR5OU5RVVZKQ2tKRWEwMU9NbWd3WkVoQ2VrOXBPSFprUnpseVdsYzBkVmxYVGpCaFZ6bDFZM2sxYm1GWVVtOWtWMG94WXpKV2VWa3lPWFZrUjFaMVpFTTFhbUl5TUhZS1lVZEdkR0pYVm5sTVdGSndZbGRWZDFwUldVdExkMWxDUWtGSFJIWjZRVUpEVVZKWVJFWldiMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RncGtSemwyVEZkNGJGb3liREJNTWtZd1pFZFdlbVJET0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPWEJpYmxKc1dqTkthR1JIYkhaaWFUVTFDbUpYZUVGamJWWnRZM2s1YjFwWFJtdGplVGwwV1Zkc2RVMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVXOUZTMmQzYjAxcVozcFpiVmsxVG1wa2JWbFVUbW9LVGxScmVFOVVTVEZhUjFGNVRsZFZNbGxVV214UFIxVXpUMFJGTVU1RVNYaE5WR1JwV21wQlpFSm5iM0pDWjBWRlFWbFBMMDFCUlV4Q1FUaE5SRmRrY0Fwa1IyZ3hXV2t4YjJJelRqQmFWMUYzVFhkWlMwdDNXVUpDUVVkRWRucEJRa1JCVVd4RVEwNXZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMkNtUkhPWFpNVjNoc1dqSnNNRXd5UmpCa1IxWjZaRVJCTkVKbmIzSkNaMFZGUVZsUEwwMUJSVTVDUTI5TlMwUkpORTB5U20xUFZGa3pXbTFGZWxsNlZUVUtUVlJyZVU1WFVtdE5hbFpzVG0xRk1scFVhR3hPZW1kNFRsUlJlVTFVUlROWmJWbDNTSGRaUzB0M1dVSkNRVWRFZG5wQlFrUm5VVkpFUVRsNVdsZGFlZ3BNTW1oc1dWZFNla3d5TVdoaFZ6UjNSMUZaUzB0M1dVSkNRVWRFZG5wQlFrUjNVVXhFUVdzMFRsUkZORTlVVVRSTmFsRjNURUZaUzB0M1dVSkNRVWRFQ25aNlFVSkZRVkZsUkVKNGIyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZG1SSE9YWk1WM2hzV2pKc01FMUNhMGREYVhOSFFWRlJRbWMzT0hjS1FWSkZSVU4zZDBwTlZHZDNUWHBSTkUxRVVUSk5SMVZIUTJselIwRlJVVUpuTnpoM1FWSkpSVlozZUZaaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRRcFpNamwwVEROU2RtSjVNWE5hVjJSd1pFTTVhR1JJVW14ak0xRjJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMllWYzFNRnBYWkhsWldGSndDbUl5TkhWbFZ6RnpVVWhLYkZwdVRYWmhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGVkVKRGIwMUxSRWswVFRKS2JVOVVXVE1LV20xRmVsbDZWVFZOVkd0NVRsZFNhMDFxVm14T2JVVXlXbFJvYkU1NlozaE9WRkY1VFZSRk0xbHRXWGRKVVZsTFMzZFpRa0pCUjBSMmVrRkNSa0ZSVkFwRVFrWXpZak5LY2xwdGVIWmtNVGxyWVZoT2QxbFlVbXBoUkVKWVFtZHZja0puUlVWQldVOHZUVUZGVmtKRmEwMVNNbWd3WkVoQ2VrOXBPSFphTW13d0NtRklWbWxNYlU1MllsTTVNR0l5T0hSaVIxWnVZVmhSZGxsWVVqQmFXRTR3VERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hoTlJHZDRUMFJKZVU1cVJYa0tUbE01YUdSSVVteGlXRUl3WTNrNGVFMUNXVWREYVhOSFFWRlJRbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVsSFMwSm5iM0pDWjBWRlFXUmFOUXBCWjFGRFFraDNSV1ZuUWpSQlNGbEJNMVF3ZDJGellraEZWRXBxUjFJMFkyMVhZek5CY1VwTFdISnFaVkJMTXk5b05IQjVaME00Y0Rkdk5FRkJRVWRTQ2pSdldtbFpRVUZCUWtGTlFWSjZRa1pCYVVGamJHNDNUR1JRUkZOS1lXZzVSRzFDTVdwT2EwMXlRMVZVYVU5WEwxbzNTMkpJZWtoNFZWQjZNek4zU1dnS1FVdGFhVmhwTDFjelVsSTVjbXh2ZVdWV1JsTlFOemc0U1VsdVprcERiekJPY21acWIybFhNRWh4TkhkTlFXOUhRME54UjFOTk5EbENRVTFFUVRKalFRcE5SMUZEVFVFd2RFWTFObmRDYlZCSWNtdzBVQ3RWTUVGaGNuRnNWbGg1VVV4eloxQkphVFU0UmxWeFlqVjNkMVZLZUZwQmRFOU1kbFJMYTI1dWNrVmxDakpNU3pCWlFVbDNVVTFtVUZsa2NHeHlWUzlWVUdaWlJtWlZOSFV2YlhGV05HdFBOVWh6WXpoUGFGcG9lVTE1WjBJNWJVSnhSMnBpYlRkVlFrNTRlakFLWXpNMVZXMUhRbWNLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfX0="
+      }
+    ],
+    "timestampVerificationData": {
+    },
+    "certificate": {
+      "rawBytes": "MIIG8jCCBnmgAwIBAgIUOJp45c9MuNRRDrMXrKvyHlk+RVIwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQwOTExMTkxOTAzWhcNMjQwOTExMTkyOTAzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNeCuIu+bmhn1Diotan21bGYKxZpE6MZ6Oa/Wo1cyy6HW1EHLYB3IgX3sq7mHBHgWvqjvAUFS5X0VSTVJtaq4KOCBZgwggWUMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU+uR5DtLlxW4O70uiZdYJX2+004swHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYwYDVR0RAQH/BFkwV4ZVaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QvLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjBFBgorBgEEAYO/MAEBBDdodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2hhbW1lci10aW1lMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwKgYKKwYBBAGDvzABBAQcQXR0ZXN0YXRpb24gSW50ZWdyYXRpb24gVGVzdDAeBgorBgEEAYO/MAEFBBB0b28tbGVnaXQvYXR0ZXN0MB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjBHBgorBgEEAYO/MAEIBDkMN2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20vaGFtbWVyLXRpbWUwZQYKKwYBBAGDvzABCQRXDFVodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdC8uZ2l0aHViL3dvcmtmbG93cy9pbnRlZ3JhdGlvbi55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoMjgzYmY5NjdmYTNjNTkxOTI1ZGQyNWU2YTZlOGU3ODE1NDIxMTdiZjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMwYKKwYBBAGDvzABDAQlDCNodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdDA4BgorBgEEAYO/MAENBCoMKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGQYKKwYBBAGDvzABDwQLDAk4NTE4OTQ4MjQwLAYKKwYBBAGDvzABEAQeDBxodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0MBkGCisGAQQBg78wAREECwwJMTgwMzQ4MDQ2MGUGCisGAQQBg78wARIEVwxVaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QvLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAETBCoMKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwIQYKKwYBBAGDvzABFAQTDBF3b3JrZmxvd19kaXNwYXRjaDBXBgorBgEEAYO/MAEVBEkMR2h0dHBzOi8vZ2l0aHViLmNvbS90b28tbGVnaXQvYXR0ZXN0L2FjdGlvbnMvcnVucy8xMDgxODIyNjEyNS9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGR4oZiYAAABAMARzBFAiAcln7LdPDSJah9DmB1jNkMrCUTiOW/Z7KbHzHxUPz33wIhAKZiXi/W3RR9rloyeVFSP788IInfJCo0NrfjoiW0Hq4wMAoGCCqGSM49BAMDA2cAMGQCMA0tF56wBmPHrl4P+U0AarqlVXyQLsgPIi58FUqb5wwUJxZAtOLvTKknnrEe2LK0YAIwQMfPYdplrU/UPfYFfU4u/mqV4kO5Hsc8OhZhyMygB9mBqGjbm7UBNxz0c35UmGBg"
+    }
+  },
+  "dsseEnvelope": {
+    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QiLCJkaWdlc3QiOnsic2hhMjU2IjoiYWZhMjdiNDRkNDNiMDJhOWZlYTQxZDEzY2VkYzJlNDAxNmNmY2Y4N2M1ZGJmOTkwZTU5MzY2OWFhOGNlMjg2ZCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL21haW4iLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sIn19LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiI4NTE4OTQ4MjQiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMTgwMzQ4MDQ2IiwicnVubmVyX2Vudmlyb25tZW50IjoiZ2l0aHViLWhvc3RlZCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiMjgzYmY5NjdmYTNjNTkxOTI1ZGQyNWU2YTZlOGU3ODE1NDIxMTdiZiJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdC8uZ2l0aHViL3dvcmtmbG93cy9pbnRlZ3JhdGlvbi55bWxAcmVmcy9oZWFkcy9tYWluIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS90b28tbGVnaXQvYXR0ZXN0L2FjdGlvbnMvcnVucy8xMDgxODIyNjEyNS9hdHRlbXB0cy8xIn19fX0=",
+    "payloadType": "application/vnd.in-toto+json",
+    "signatures": [
+      {
+        "sig": "MEYCIQDo6HcufD1X5W+ALqAs+GtUvopFXBQF5JCDRW89VNwNWQIhAJv4SJ8H6RO3rpWvbouTY7k4bsQcu5cCkiuitQJ9d0H/"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index 611b1d89f..df24b31c4 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -85,6 +85,75 @@ func TestVerifyIntegration(t *testing.T) {
 	})
 }
 
+func TestVerifyIntegrationCustomIssuer(t *testing.T) {
+	artifactPath := test.NormalizeRelativePath("../test/data/custom-issuer-artifact")
+	bundlePath := test.NormalizeRelativePath("../test/data/custom-issuer.sigstore.json")
+
+	logger := io.NewTestHandler()
+
+	sigstoreConfig := verification.SigstoreConfig{
+		Logger: logger,
+	}
+
+	cmdFactory := factory.New("test")
+
+	hc, err := cmdFactory.HttpClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	host, _ := auth.DefaultHost()
+
+	baseOpts := Options{
+		APIClient:        api.NewLiveClient(hc, host, logger),
+		ArtifactPath:     artifactPath,
+		BundlePath:       bundlePath,
+		DigestAlgorithm:  "sha256",
+		Logger:           logger,
+		OCIClient:        oci.NewLiveClient(),
+		OIDCIssuer:       "https://token.actions.githubusercontent.com/hammer-time",
+		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
+	}
+
+	t.Run("with owner and valid workflow SAN", func(t *testing.T) {
+		opts := baseOpts
+		opts.Owner = "too-legit"
+		opts.SAN = "https://github.com/too-legit/attest/.github/workflows/integration.yml@refs/heads/main"
+
+		err := runVerify(&opts)
+		require.NoError(t, err)
+	})
+
+	t.Run("with owner and valid workflow SAN regex", func(t *testing.T) {
+		opts := baseOpts
+		opts.Owner = "too-legit"
+		opts.SANRegex = "^https://github.com/too-legit/attest"
+
+		err := runVerify(&opts)
+		require.NoError(t, err)
+	})
+
+	t.Run("with repo and valid workflow SAN", func(t *testing.T) {
+		opts := baseOpts
+		opts.Owner = "too-legit"
+		opts.Repo = "too-legit/attest"
+		opts.SAN = "https://github.com/too-legit/attest/.github/workflows/integration.yml@refs/heads/main"
+
+		err := runVerify(&opts)
+		require.NoError(t, err)
+	})
+
+	t.Run("with repo and valid workflow SAN regex", func(t *testing.T) {
+		opts := baseOpts
+		opts.Owner = "too-legit"
+		opts.Repo = "too-legit/attest"
+		opts.SANRegex = "^https://github.com/too-legit/attest"
+
+		err := runVerify(&opts)
+		require.NoError(t, err)
+	})
+}
+
 func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 	artifactPath := test.NormalizeRelativePath("../test/data/reusable-workflow-artifact")
 	bundlePath := test.NormalizeRelativePath("../test/data/reusable-workflow-attestation.sigstore.json")

From 677edbac777fd2da8fe863a3b49172a93cf50bb2 Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Thu, 12 Sep 2024 09:40:47 -0700
Subject: [PATCH 052/301] suppress att verify output when no tty

Signed-off-by: Brian DeHamer <bdehamer@github.com>
---
 pkg/cmd/attestation/io/handler.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkg/cmd/attestation/io/handler.go b/pkg/cmd/attestation/io/handler.go
index 07be3d1df..9664c7f65 100644
--- a/pkg/cmd/attestation/io/handler.go
+++ b/pkg/cmd/attestation/io/handler.go
@@ -62,6 +62,10 @@ func (h *Handler) VerbosePrintf(f string, v ...interface{}) (int, error) {
 }
 
 func (h *Handler) PrintTable(headers []string, rows [][]string) error {
+	if !h.IO.IsStdoutTTY() {
+		return nil
+	}
+
 	t := tableprinter.New(h.IO, tableprinter.WithHeader(headers...))
 
 	for _, row := range rows {

From 5296d608323f2c48a6a8e588df007b22f4617010 Mon Sep 17 00:00:00 2001
From: Tim Rogers <timrogers@github.com>
Date: Thu, 12 Sep 2024 18:53:24 +0100
Subject: [PATCH 053/301] Refactor conditions

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 pkg/cmd/extension/manager.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 60fe8d239..cf5c44bcd 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -267,14 +267,14 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 	if asset == nil && isMacARM {
 		for _, a := range r.Assets {
 			if strings.HasSuffix(a.Name, "darwin-amd64") {
-				if hasRosetta() {
-					asset = &a
-					break
-				} else {
+				if !hasRosetta() {
 					return fmt.Errorf(
 						"%[1]s unsupported for %[2]s. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
 						repo.RepoName(), platform, repo.RepoOwner())
 				}
+
+				asset = &a
+				break
 			}
 		}
 	}

From e0fb793b44d7060fdff429500382badf030ae880 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 12 Sep 2024 20:29:59 +0200
Subject: [PATCH 054/301] Stub hasRosetta for tests

---
 pkg/cmd/extension/manager.go      |  2 +-
 pkg/cmd/extension/manager_test.go | 52 +++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index cf5c44bcd..45186d689 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -771,7 +771,7 @@ func possibleDists() []string {
 	}
 }
 
-func hasRosetta() bool {
+var hasRosetta = func() bool {
 	_, err := os.Stat("/Library/Apple/usr/libexec/oah/libRosettaRuntime")
 	return err == nil
 }
diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index 6d9b63124..f03cc7f73 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -912,6 +912,58 @@ func TestManager_Install_binary_unsupported(t *testing.T) {
 	assert.Equal(t, "", stderr.String())
 }
 
+func TestManager_Install_rosetta_fallback_not_found(t *testing.T) {
+	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
+
+	reg := httpmock.Registry{}
+	defer reg.Verify(t)
+	client := http.Client{Transport: &reg}
+
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Tag: "v1.0.1",
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+
+	ios, _, stdout, stderr := iostreams.Test()
+	tempDir := t.TempDir()
+
+	m := newTestManager(tempDir, &client, nil, ios)
+	m.platform = func() (string, string) {
+		return "darwin-arm64", ""
+	}
+
+	originalHasRosetta := hasRosetta
+	t.Cleanup(func() { hasRosetta = originalHasRosetta })
+	hasRosetta = func() bool {
+		return false
+	}
+
+	err := m.Install(repo, "")
+	assert.EqualError(t, err, "gh-bin-ext unsupported for darwin-arm64. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R owner/gh-bin-ext -t'Support darwin-arm64'`")
+
+	assert.Equal(t, "", stdout.String())
+	assert.Equal(t, "", stderr.String())
+}
+
 func TestManager_Install_binary(t *testing.T) {
 	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
 

From 99b789e745d260d314c05a8d6f68ddabaa9cb882 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 13 Sep 2024 11:59:54 +0200
Subject: [PATCH 055/301] Add test for extension install fallback to amd64 on
 darwin

---
 pkg/cmd/extension/manager_test.go | 74 +++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index f03cc7f73..5de4e15cb 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -1028,6 +1028,80 @@ func TestManager_Install_binary(t *testing.T) {
 	assert.Equal(t, "", stderr.String())
 }
 
+func TestManager_Install_amd64_when_supported(t *testing.T) {
+	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
+
+	reg := httpmock.Registry{}
+	defer reg.Verify(t)
+	client := http.Client{Transport: &reg}
+
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Tag: "v1.0.1",
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "release/cool"),
+		httpmock.StringResponse("FAKE BINARY"))
+
+	ios, _, stdout, stderr := iostreams.Test()
+	tempDir := t.TempDir()
+
+	m := newTestManager(tempDir, &client, nil, ios)
+	m.platform = func() (string, string) {
+		return "darwin-arm64", ""
+	}
+
+	originalHasRosetta := hasRosetta
+	t.Cleanup(func() { hasRosetta = originalHasRosetta })
+	hasRosetta = func() bool {
+		return true
+	}
+
+	err := m.Install(repo, "")
+	assert.NoError(t, err)
+
+	manifest, err := os.ReadFile(filepath.Join(tempDir, "extensions/gh-bin-ext", manifestName))
+	assert.NoError(t, err)
+
+	var bm binManifest
+	err = yaml.Unmarshal(manifest, &bm)
+	assert.NoError(t, err)
+
+	assert.Equal(t, binManifest{
+		Name:  "gh-bin-ext",
+		Owner: "owner",
+		Host:  "example.com",
+		Tag:   "v1.0.1",
+		Path:  filepath.Join(tempDir, "extensions/gh-bin-ext/gh-bin-ext"),
+	}, bm)
+
+	fakeBin, err := os.ReadFile(filepath.Join(tempDir, "extensions/gh-bin-ext/gh-bin-ext"))
+	assert.NoError(t, err)
+	assert.Equal(t, "FAKE BINARY", string(fakeBin))
+
+	assert.Equal(t, "", stdout.String())
+	assert.Equal(t, "", stderr.String())
+}
+
 func TestManager_repo_not_found(t *testing.T) {
 	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
 

From 352737cb6026fcf6ce0f5a203bc5e4604bac6b98 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 13 Sep 2024 14:22:34 +0200
Subject: [PATCH 056/301] Use api subdomains for commands using ghinstance
 package

---
 internal/ghinstance/host.go               | 14 ++++++++++++++
 internal/ghinstance/host_test.go          |  8 ++++++++
 pkg/cmd/attestation/verify/verify_test.go |  2 +-
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/internal/ghinstance/host.go b/internal/ghinstance/host.go
index 729d47f31..f80bfef57 100644
--- a/internal/ghinstance/host.go
+++ b/internal/ghinstance/host.go
@@ -73,6 +73,13 @@ func GraphQLEndpoint(hostname string) string {
 	if isGarage(hostname) {
 		return fmt.Sprintf("https://%s/api/graphql", hostname)
 	}
+	// Once we change Tenancy to no longer be treated as Enterprise, this
+	// conditional can be removed as the flow will fall through to the bottom.
+	// However, we can't do that until we've investigated all places in which
+	// Tenancy is currently treated as Enterprise.
+	if IsTenancy(hostname) {
+		return fmt.Sprintf("https://api.%s/graphql", hostname)
+	}
 	if IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/graphql", hostname)
 	}
@@ -86,6 +93,13 @@ func RESTPrefix(hostname string) string {
 	if isGarage(hostname) {
 		return fmt.Sprintf("https://%s/api/v3/", hostname)
 	}
+	// Once we change Tenancy to no longer be treated as Enterprise, this
+	// conditional can be removed as the flow will fall through to the bottom.
+	// However, we can't do that until we've investigated all places in which
+	// Tenancy is currently treated as Enterprise.
+	if IsTenancy(hostname) {
+		return fmt.Sprintf("https://api.%s/", hostname)
+	}
 	if IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/v3/", hostname)
 	}
diff --git a/internal/ghinstance/host_test.go b/internal/ghinstance/host_test.go
index 673fad24c..e9fb97008 100644
--- a/internal/ghinstance/host_test.go
+++ b/internal/ghinstance/host_test.go
@@ -254,6 +254,10 @@ func TestGraphQLEndpoint(t *testing.T) {
 			host: "ghe.io",
 			want: "https://ghe.io/api/graphql",
 		},
+		{
+			host: "tenant.ghe.com",
+			want: "https://api.tenant.ghe.com/graphql",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.host, func(t *testing.T) {
@@ -285,6 +289,10 @@ func TestRESTPrefix(t *testing.T) {
 			host: "ghe.io",
 			want: "https://ghe.io/api/v3/",
 		},
+		{
+			host: "tenant.ghe.com",
+			want: "https://api.tenant.ghe.com/",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.host, func(t *testing.T) {
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 6f71b537f..3ff309922 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -43,7 +43,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			},
 		},
 	}
-	testReg.Register(httpmock.REST(http.MethodGet, "api/v3/meta"),
+	testReg.Register(httpmock.REST(http.MethodGet, "meta"),
 		httpmock.StatusJSONResponse(200, &metaResp))
 
 	f := &cmdutil.Factory{

From 420d80b4980f1cffd39b0b0b6006c4a9ab1de254 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 13 Sep 2024 14:48:55 +0200
Subject: [PATCH 057/301] Update go-gh to use api subdomains

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 78ceb7f70..54d02ec8e 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/charmbracelet/glamour v0.7.0
 	github.com/charmbracelet/lipgloss v0.10.1-0.20240413172830-d0be07ea6b9c
-	github.com/cli/go-gh/v2 v2.9.0
+	github.com/cli/go-gh/v2 v2.10.0
 	github.com/cli/oauth v1.0.1
 	github.com/cli/safeexec v1.0.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.4
diff --git a/go.sum b/go.sum
index 37c40407d..416f2ee59 100644
--- a/go.sum
+++ b/go.sum
@@ -95,8 +95,8 @@ github.com/charmbracelet/x/exp/term v0.0.0-20240425164147-ba2a9512b05f/go.mod h1
 github.com/cli/browser v1.0.0/go.mod h1:IEWkHYbLjkhtjwwWlwTHW2lGxeS5gezEQBMLTwDHf5Q=
 github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
-github.com/cli/go-gh/v2 v2.9.0 h1:D3lTjEneMYl54M+WjZ+kRPrR5CEJ5BHS05isBPOV3LI=
-github.com/cli/go-gh/v2 v2.9.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
+github.com/cli/go-gh/v2 v2.10.0 h1:GMflBKoErBXlLvN2euxzL+p7JaM8erlSmw0cT7uZr7M=
+github.com/cli/go-gh/v2 v2.10.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
 github.com/cli/oauth v1.0.1 h1:pXnTFl/qUegXHK531Dv0LNjW4mLx626eS42gnzfXJPA=
 github.com/cli/oauth v1.0.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=

From 24336f1344f57af4f6c41c4d50481a11ec742239 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Mon, 16 Sep 2024 13:42:51 -0400
Subject: [PATCH 058/301] Enhance gh repo create docs, fix random cmd link

Relates #8946

- updates the documentation within `gh repo create` to include links to lookup .gitignore templates and licenses
- fixes link markup within `gh auth setup-git` so link is formatted correctly on https://cli.github.com
---
 pkg/cmd/auth/setupgit/setupgit.go | 2 +-
 pkg/cmd/repo/create/create.go     | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/auth/setupgit/setupgit.go b/pkg/cmd/auth/setupgit/setupgit.go
index c1200b475..0ff7b6903 100644
--- a/pkg/cmd/auth/setupgit/setupgit.go
+++ b/pkg/cmd/auth/setupgit/setupgit.go
@@ -36,7 +36,7 @@ func NewCmdSetupGit(f *cmdutil.Factory, runF func(*SetupGitOptions) error) *cobr
 		Long: heredoc.Docf(`
 			This command configures %[1]sgit%[1]s to use GitHub CLI as a credential helper.
 			For more information on git credential helpers please reference:
-			https://git-scm.com/docs/gitcredentials.
+			<https://git-scm.com/docs/gitcredentials>.
 
 			By default, GitHub CLI will be set as the credential helper for all authenticated hosts.
 			If there is no authenticated hosts the command fails with an error.
diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 8b5dd515a..28ca0d1e8 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -93,7 +93,12 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 
 			To create a remote repository from an existing local repository, specify the source directory with %[1]s--source%[1]s.
 			By default, the remote repository name will be the name of the source directory.
+
 			Pass %[1]s--push%[1]s to push any local commits to the new repository.
+
+			For language or platform .gitignore templates to use with %[1]s--gitignore%[1]s, <https://github.com/github/gitignore>.
+
+			For license keywords to use with %[1]s--license%[1]s, <https://choosealicense.com/>.
 		`, "`"),
 		Example: heredoc.Doc(`
 			# create a repository interactively

From 8c8423aa3dfa147495644867d1031432fdb6cb45 Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Thu, 12 Sep 2024 15:04:02 -0700
Subject: [PATCH 059/301] better error for att verify custom issuer mismatch

Signed-off-by: Brian DeHamer <bdehamer@github.com>
Co-authored-by: Zach Steindler <steiza@github.com>
Co-authored-by: Phill MV <phillmv@github.com>
---
 .../attestation/verification/extensions.go    | 32 +++++++-
 .../verification/extensions_test.go           | 74 ++++++++++++++++---
 .../attestation/verification/mock_verifier.go |  1 +
 pkg/cmd/attestation/verify/policy.go          |  5 +-
 pkg/cmd/attestation/verify/policy_test.go     |  1 -
 pkg/cmd/attestation/verify/verify.go          |  5 +-
 .../verify/verify_integration_test.go         |  6 +-
 pkg/cmd/attestation/verify/verify_test.go     | 30 ++++----
 8 files changed, 115 insertions(+), 39 deletions(-)

diff --git a/pkg/cmd/attestation/verification/extensions.go b/pkg/cmd/attestation/verification/extensions.go
index 727feb72c..2ffb11a9d 100644
--- a/pkg/cmd/attestation/verification/extensions.go
+++ b/pkg/cmd/attestation/verification/extensions.go
@@ -6,20 +6,25 @@ import (
 	"strings"
 )
 
-func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner, repo string) error {
+var (
+	GitHubOIDCIssuer       = "https://token.actions.githubusercontent.com"
+	GitHubTenantOIDCIssuer = "https://token.actions.%s.ghe.com"
+)
+
+func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner, repo, issuer string) error {
 	if len(results) == 0 {
 		return errors.New("no attestations proccessing results")
 	}
 
 	for _, attestation := range results {
-		if err := verifyCertExtensions(attestation, tenant, owner, repo); err != nil {
+		if err := verifyCertExtensions(attestation, tenant, owner, repo, issuer); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owner, repo string) error {
+func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owner, repo, issuer string) error {
 	var want string
 
 	if tenant == "" {
@@ -46,5 +51,26 @@ func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owne
 		}
 	}
 
+	// if issuer is anything other than the default, use the user-provided value;
+	// otherwise, select the appropriate default based on the tenant
+	if issuer != GitHubOIDCIssuer {
+		want = issuer
+	} else {
+		if tenant != "" {
+			want = fmt.Sprintf(GitHubTenantOIDCIssuer, tenant)
+		} else {
+			want = GitHubOIDCIssuer
+		}
+	}
+
+	certIssuer := attestation.VerificationResult.Signature.Certificate.Extensions.Issuer
+	if !strings.EqualFold(want, certIssuer) {
+		if strings.Index(certIssuer, want+"/") == 0 {
+			return fmt.Errorf("expected Issuer to be %s, got %s -- if you have a custom OIDC issuer policy for your enterprise, use the --cert-oidc-issuer flag with your expected issuer", want, certIssuer)
+		} else {
+			return fmt.Errorf("expected Issuer to be %s, got %s", want, certIssuer)
+		}
+	}
+
 	return nil
 }
diff --git a/pkg/cmd/attestation/verification/extensions_test.go b/pkg/cmd/attestation/verification/extensions_test.go
index c86f2030a..5eb28829d 100644
--- a/pkg/cmd/attestation/verification/extensions_test.go
+++ b/pkg/cmd/attestation/verification/extensions_test.go
@@ -17,6 +17,7 @@ func TestVerifyCertExtensions(t *testing.T) {
 						Extensions: certificate.Extensions{
 							SourceRepositoryOwnerURI: "https://github.com/owner",
 							SourceRepositoryURI:      "https://github.com/owner/repo",
+							Issuer:                   "https://token.actions.githubusercontent.com",
 						},
 					},
 				},
@@ -25,32 +26,72 @@ func TestVerifyCertExtensions(t *testing.T) {
 	}
 
 	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo", GitHubOIDCIssuer)
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with owner and repo, but wrong tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo", GitHubOIDCIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/owner, got https://github.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "")
+		err := VerifyCertExtensions(results, "", "owner", "", GitHubOIDCIssuer)
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "wrong", "")
+		err := VerifyCertExtensions(results, "", "wrong", "", GitHubOIDCIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/wrong, got https://github.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "wrong")
+		err := VerifyCertExtensions(results, "", "owner", "wrong", GitHubOIDCIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://github.com/wrong, got https://github.com/owner/repo")
 	})
+
+	t.Run("VerifyCertExtensions with wrong issuer", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "", "owner", "", "wrong")
+		require.ErrorContains(t, err, "expected Issuer to be wrong, got https://token.actions.githubusercontent.com")
+	})
+}
+
+func TestVerifyCertExtensionsCustomizedIssuer(t *testing.T) {
+	results := []*AttestationProcessingResult{
+		{
+			VerificationResult: &verify.VerificationResult{
+				Signature: &verify.SignatureVerificationResult{
+					Certificate: &certificate.Summary{
+						Extensions: certificate.Extensions{
+							SourceRepositoryOwnerURI: "https://github.com/owner",
+							SourceRepositoryURI:      "https://github.com/owner/repo",
+							Issuer:                   "https://token.actions.githubusercontent.com/foo-bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	t.Run("VerifyCertExtensions with exact issuer match", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo", "https://token.actions.githubusercontent.com/foo-bar")
+		require.NoError(t, err)
+	})
+
+	t.Run("VerifyCertExtensions with partial issuer match", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo", "https://token.actions.githubusercontent.com")
+		require.ErrorContains(t, err, "expected Issuer to be https://token.actions.githubusercontent.com, got https://token.actions.githubusercontent.com/foo-bar -- if you have a custom OIDC issuer")
+	})
+
+	t.Run("VerifyCertExtensions with wrong issuer", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "", "owner", "", "wrong")
+		require.ErrorContains(t, err, "expected Issuer to be wrong, got https://token.actions.githubusercontent.com/foo-bar")
+	})
 }
 
 func TestVerifyTenancyCertExtensions(t *testing.T) {
+	defaultIssuer := GitHubOIDCIssuer
+
 	results := []*AttestationProcessingResult{
 		{
 			VerificationResult: &verify.VerificationResult{
@@ -59,6 +100,7 @@ func TestVerifyTenancyCertExtensions(t *testing.T) {
 						Extensions: certificate.Extensions{
 							SourceRepositoryOwnerURI: "https://foo.ghe.com/owner",
 							SourceRepositoryURI:      "https://foo.ghe.com/owner/repo",
+							Issuer:                   "https://token.actions.foo.ghe.com",
 						},
 					},
 				},
@@ -67,32 +109,42 @@ func TestVerifyTenancyCertExtensions(t *testing.T) {
 	}
 
 	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo", defaultIssuer)
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with owner and repo, no tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "", "owner", "owner/repo", defaultIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/owner, got https://foo.ghe.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with owner and repo, wrong tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "bar", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "bar", "owner", "owner/repo", defaultIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://bar.ghe.com/owner, got https://foo.ghe.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "")
+		err := VerifyCertExtensions(results, "foo", "owner", "", defaultIssuer)
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "wrong", "")
+		err := VerifyCertExtensions(results, "foo", "wrong", "", defaultIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "wrong")
+		err := VerifyCertExtensions(results, "foo", "owner", "wrong", defaultIssuer)
 		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner/repo")
 	})
+
+	t.Run("VerifyCertExtensions with correct, non-default issuer", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo", "https://token.actions.foo.ghe.com")
+		require.NoError(t, err)
+	})
+
+	t.Run("VerifyCertExtensions with wrong issuer", func(t *testing.T) {
+		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo", "wrong")
+		require.ErrorContains(t, err, "expected Issuer to be wrong, got https://token.actions.foo.ghe.com")
+	})
 }
diff --git a/pkg/cmd/attestation/verification/mock_verifier.go b/pkg/cmd/attestation/verification/mock_verifier.go
index 9943e6a97..cb3a4c061 100644
--- a/pkg/cmd/attestation/verification/mock_verifier.go
+++ b/pkg/cmd/attestation/verification/mock_verifier.go
@@ -34,6 +34,7 @@ func (v *MockSigstoreVerifier) Verify(attestations []*api.Attestation, policy ve
 						BuildSignerURI:           "https://github.com/github/example/.github/workflows/release.yml@refs/heads/main",
 						SourceRepositoryOwnerURI: "https://github.com/sigstore",
 						SourceRepositoryURI:      "https://github.com/sigstore/sigstore-js",
+						Issuer:                   "https://token.actions.githubusercontent.com",
 					},
 				},
 			},
diff --git a/pkg/cmd/attestation/verify/policy.go b/pkg/cmd/attestation/verify/policy.go
index 0c7a686c2..f41b2f66b 100644
--- a/pkg/cmd/attestation/verify/policy.go
+++ b/pkg/cmd/attestation/verify/policy.go
@@ -13,8 +13,6 @@ import (
 )
 
 const (
-	GitHubOIDCIssuer       = "https://token.actions.githubusercontent.com"
-	GitHubTenantOIDCIssuer = "https://token.actions.%s.ghe.com"
 	// represents the GitHub hosted runner in the certificate RunnerEnvironment extension
 	GitHubRunner = "github-hosted"
 	hostRegex    = `^[a-zA-Z0-9-]+\.[a-zA-Z0-9-]+.*$`
@@ -51,7 +49,8 @@ func buildCertificateIdentityOption(opts *Options, runnerEnv string) (verify.Pol
 		return nil, err
 	}
 
-	issuerMatcher, err := verify.NewIssuerMatcher(opts.OIDCIssuer, "")
+	// Accept any issuer, we will verify the issuer as part of the extension verification
+	issuerMatcher, err := verify.NewIssuerMatcher("", ".*")
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cmd/attestation/verify/policy_test.go b/pkg/cmd/attestation/verify/policy_test.go
index 89f989b45..ae1e52955 100644
--- a/pkg/cmd/attestation/verify/policy_test.go
+++ b/pkg/cmd/attestation/verify/policy_test.go
@@ -22,7 +22,6 @@ func TestBuildPolicy(t *testing.T) {
 
 	opts := &Options{
 		ArtifactPath: artifactPath,
-		OIDCIssuer:   GitHubOIDCIssuer,
 		Owner:        "sigstore",
 		SANRegex:     "^https://github.com/sigstore/",
 	}
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 9e508e994..17b8a84d1 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -151,7 +151,6 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 				}
 				config.TrustDomain = td
 				opts.Tenant = tenant
-				opts.OIDCIssuer = fmt.Sprintf(GitHubTenantOIDCIssuer, tenant)
 			}
 
 			// set policy flags based on what has been provided
@@ -192,7 +191,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	verifyCmd.Flags().StringVarP(&opts.SignerRepo, "signer-repo", "", "", "Repository of reusable workflow that signed attestation in the format <owner>/<repo>")
 	verifyCmd.Flags().StringVarP(&opts.SignerWorkflow, "signer-workflow", "", "", "Workflow that signed attestation in the format [host/]<owner>/<repo>/<path>/<to>/<workflow>")
 	verifyCmd.MarkFlagsMutuallyExclusive("cert-identity", "cert-identity-regex", "signer-repo", "signer-workflow")
-	verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", GitHubOIDCIssuer, "Issuer of the OIDC token")
+	verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", verification.GitHubOIDCIssuer, "Issuer of the OIDC token")
 	verifyCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return verifyCmd
@@ -269,7 +268,7 @@ func runVerify(opts *Options) error {
 	}
 
 	// Verify extensions
-	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo); err != nil {
+	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo, opts.OIDCIssuer); err != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
 		return err
 	}
diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index df24b31c4..4b0f0adfb 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -38,7 +38,7 @@ func TestVerifyIntegration(t *testing.T) {
 		DigestAlgorithm:  "sha512",
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
-		OIDCIssuer:       GitHubOIDCIssuer,
+		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
@@ -180,7 +180,7 @@ func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 		DigestAlgorithm:  "sha256",
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
-		OIDCIssuer:       GitHubOIDCIssuer,
+		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
 
@@ -269,7 +269,7 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		DigestAlgorithm:  "sha256",
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
-		OIDCIssuer:       GitHubOIDCIssuer,
+		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "malancas",
 		Repo:             "malancas/attest-demo",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 6f71b537f..8b211fe4c 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -71,7 +71,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha384",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 				Hostname:         "github.com",
@@ -86,7 +86,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -102,7 +102,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       "https://token.actions.foo.ghe.com",
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://foo.ghe.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -118,7 +118,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -134,7 +134,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha512",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -148,7 +148,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				DigestAlgorithm:  "sha256",
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				Limit:            30,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
@@ -163,7 +163,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				Repo:             "sigstore/sigstore-js",
 				Limit:            30,
@@ -179,7 +179,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -193,7 +193,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				Limit:            101,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
@@ -208,7 +208,7 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				Limit:            0,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
@@ -224,7 +224,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SAN:              "https://github.com/sigstore/",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
@@ -241,7 +241,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				BundlePath:       bundlePath,
 				DigestAlgorithm:  "sha256",
 				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -331,7 +331,7 @@ func TestJSONOutput(t *testing.T) {
 		APIClient:        api.NewTestClient(),
 		Logger:           io.NewHandler(testIO),
 		OCIClient:        oci.MockClient{},
-		OIDCIssuer:       GitHubOIDCIssuer,
+		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -354,7 +354,7 @@ func TestRunVerify(t *testing.T) {
 		APIClient:        api.NewTestClient(),
 		Logger:           logger,
 		OCIClient:        oci.MockClient{},
-		OIDCIssuer:       GitHubOIDCIssuer,
+		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -474,7 +474,7 @@ func TestRunVerify(t *testing.T) {
 			APIClient:        api.NewTestClient(),
 			DigestAlgorithm:  "sha512",
 			Logger:           logger,
-			OIDCIssuer:       GitHubOIDCIssuer,
+			OIDCIssuer:       verification.GitHubOIDCIssuer,
 			Owner:            "sigstore",
 			SAN:              SigstoreSanValue,
 			SigstoreVerifier: verification.NewMockSigstoreVerifier(t),

From 8e8fc696f13ce3396eabb92471bc4ae71a86274e Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Thu, 12 Sep 2024 09:20:02 -0700
Subject: [PATCH 060/301] disable auth check for att trusted-root cmd

Signed-off-by: Brian DeHamer <bdehamer@github.com>
---
 pkg/cmd/attestation/trustedroot/trustedroot.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index c9c3fdb04..a79c32ddb 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -94,6 +94,7 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 		},
 	}
 
+	cmdutil.DisableAuthCheck(&trustedRootCmd)
 	trustedRootCmd.Flags().StringVarP(&opts.TufUrl, "tuf-url", "", "", "URL to the TUF repository mirror")
 	trustedRootCmd.Flags().StringVarP(&opts.TufRootPath, "tuf-root", "", "", "Path to the TUF root.json file on disk")
 	trustedRootCmd.MarkFlagsRequiredTogether("tuf-url", "tuf-root")

From cbe85253214d1ff3ce3c4fe707d55e99fe2adfaf Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Fri, 13 Sep 2024 15:26:14 -0700
Subject: [PATCH 061/301] enforce auth for tenancy

Signed-off-by: Brian DeHamer <bdehamer@github.com>
---
 .../attestation/trustedroot/trustedroot.go    |  9 ++
 .../trustedroot/trustedroot_test.go           | 97 +++++++++++++++++++
 2 files changed, 106 insertions(+)

diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index a79c32ddb..7dba916eb 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -69,6 +69,15 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 			}
 
 			if ghinstance.IsTenancy(opts.Hostname) {
+				c, err := f.Config()
+				if err != nil {
+					return err
+				}
+
+				if token, _ := c.Authentication().ActiveToken(opts.Hostname); token == "" {
+					return fmt.Errorf("not authenticated with %s", opts.Hostname)
+				}
+
 				hc, err := f.HttpClient()
 				if err != nil {
 					return err
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot_test.go b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
index 70b5ae2a1..b7d5f6c2f 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot_test.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
@@ -3,6 +3,7 @@ package trustedroot
 import (
 	"bytes"
 	"fmt"
+	"net/http"
 	"strings"
 	"testing"
 
@@ -10,8 +11,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	ghmock "github.com/cli/cli/v2/internal/gh/mock"
+	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/test"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
 	"github.com/cli/cli/v2/pkg/iostreams"
 )
 
@@ -19,6 +25,9 @@ func TestNewTrustedRootCmd(t *testing.T) {
 	testIO, _, _, _ := iostreams.Test()
 	f := &cmdutil.Factory{
 		IOStreams: testIO,
+		Config: func() (gh.Config, error) {
+			return &ghmock.ConfigMock{}, nil
+		},
 	}
 
 	testcases := []struct {
@@ -72,6 +81,83 @@ func TestNewTrustedRootCmd(t *testing.T) {
 	}
 }
 
+func TestNewTrustedRootWithTenancy(t *testing.T) {
+	testIO, _, _, _ := iostreams.Test()
+	var testReg httpmock.Registry
+	var metaResp = api.MetaResponse{
+		Domains: api.Domain{
+			ArtifactAttestations: api.ArtifactAttestations{
+				TrustDomain: "foo",
+			},
+		},
+	}
+	testReg.Register(httpmock.REST(http.MethodGet, "meta"),
+		httpmock.StatusJSONResponse(200, &metaResp))
+
+	httpClientFunc := func() (*http.Client, error) {
+		reg := &testReg
+		client := &http.Client{}
+		httpmock.ReplaceTripper(client, reg)
+		return client, nil
+	}
+
+	cli := "--hostname foo-bar.ghe.com"
+
+	t.Run("Host with NO auth configured", func(t *testing.T) {
+		f := &cmdutil.Factory{
+			IOStreams: testIO,
+			Config: func() (gh.Config, error) {
+				return &ghmock.ConfigMock{
+					AuthenticationFunc: func() gh.AuthConfig {
+						return &MockAuthConfig{Token: ""}
+					},
+				}, nil
+			},
+		}
+
+		cmd := NewTrustedRootCmd(f, func(_ *Options) error {
+			return nil
+		})
+
+		argv := strings.Split(cli, " ")
+		cmd.SetArgs(argv)
+		cmd.SetIn(&bytes.Buffer{})
+		cmd.SetOut(&bytes.Buffer{})
+		cmd.SetErr(&bytes.Buffer{})
+		_, err := cmd.ExecuteC()
+
+		assert.Error(t, err)
+		assert.ErrorContains(t, err, "not authenticated")
+	})
+
+	t.Run("Host wth auth configured", func(t *testing.T) {
+		f := &cmdutil.Factory{
+			IOStreams: testIO,
+			Config: func() (gh.Config, error) {
+				return &ghmock.ConfigMock{
+					AuthenticationFunc: func() gh.AuthConfig {
+						return &MockAuthConfig{Token: "TOKEN"}
+					},
+				}, nil
+			},
+			HttpClient: httpClientFunc,
+		}
+
+		cmd := NewTrustedRootCmd(f, func(_ *Options) error {
+			return nil
+		})
+
+		argv := strings.Split(cli, " ")
+		cmd.SetArgs(argv)
+		cmd.SetIn(&bytes.Buffer{})
+		cmd.SetOut(&bytes.Buffer{})
+		cmd.SetErr(&bytes.Buffer{})
+
+		_, err := cmd.ExecuteC()
+		assert.NoError(t, err)
+	})
+}
+
 var newTUFErrClient tufClientInstantiator = func(o *tuf.Options) (*tuf.Client, error) {
 	return nil, fmt.Errorf("failed to create TUF client")
 }
@@ -99,3 +185,14 @@ func TestGetTrustedRoot(t *testing.T) {
 	})
 
 }
+
+type MockAuthConfig struct {
+	config.AuthConfig
+	Token string
+}
+
+var _ gh.AuthConfig = (*MockAuthConfig)(nil)
+
+func (c *MockAuthConfig) ActiveToken(host string) (string, string) {
+	return c.Token, ""
+}

From 1511c9f225f5a7b2c884f0d35f5cdebe9cdfc858 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2024 14:28:48 +0000
Subject: [PATCH 062/301] build(deps): bump github.com/cpuguy83/go-md2man/v2
 from 2.0.4 to 2.0.5

Bumps [github.com/cpuguy83/go-md2man/v2](https://github.com/cpuguy83/go-md2man) from 2.0.4 to 2.0.5.
- [Release notes](https://github.com/cpuguy83/go-md2man/releases)
- [Commits](https://github.com/cpuguy83/go-md2man/compare/v2.0.4...v2.0.5)

---
updated-dependencies:
- dependency-name: github.com/cpuguy83/go-md2man/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/go.mod b/go.mod
index 54d02ec8e..51083f997 100644
--- a/go.mod
+++ b/go.mod
@@ -14,7 +14,7 @@ require (
 	github.com/cli/go-gh/v2 v2.10.0
 	github.com/cli/oauth v1.0.1
 	github.com/cli/safeexec v1.0.1
-	github.com/cpuguy83/go-md2man/v2 v2.0.4
+	github.com/cpuguy83/go-md2man/v2 v2.0.5
 	github.com/creack/pty v1.1.23
 	github.com/distribution/reference v0.5.0
 	github.com/gabriel-vasile/mimetype v1.4.5
diff --git a/go.sum b/go.sum
index 416f2ee59..f0e05ee81 100644
--- a/go.sum
+++ b/go.sum
@@ -109,8 +109,9 @@ github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AX
 github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/creack/pty v1.1.23 h1:4M6+isWdcStXEf15G/RbrMPOQj1dZ7HPZCGwE4kOeP0=
 github.com/creack/pty v1.1.23/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=

From 3bcedfe7f071904af24b0d9096980e53844ca42a Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Tue, 17 Sep 2024 14:18:00 -0700
Subject: [PATCH 063/301] Update
 pkg/cmd/attestation/trustedroot/trustedroot_test.go

Co-authored-by: Fredrik Skogman <kommendorkapten@github.com>
---
 pkg/cmd/attestation/trustedroot/trustedroot_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/trustedroot/trustedroot_test.go b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
index b7d5f6c2f..c3c1818dd 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot_test.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
@@ -130,7 +130,7 @@ func TestNewTrustedRootWithTenancy(t *testing.T) {
 		assert.ErrorContains(t, err, "not authenticated")
 	})
 
-	t.Run("Host wth auth configured", func(t *testing.T) {
+	t.Run("Host with auth configured", func(t *testing.T) {
 		f := &cmdutil.Factory{
 			IOStreams: testIO,
 			Config: func() (gh.Config, error) {

From dded0391254781d1222b1050885a5c658b4461b0 Mon Sep 17 00:00:00 2001
From: Tim Rogers <me@timrogers.co.uk>
Date: Thu, 12 Sep 2024 10:48:12 +0100
Subject: [PATCH 064/301] Improve the suggested command for creating an issue
 when an extension doesn't have a binary for your platform
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When installing an extension, the CLI must to select the correct
binary to download for the machine (see the
[`installBin` function](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L240)).

By default, the CLI will download a binary matching the current
machine's architecture.

If a suitable binary isn't available, the CLI
[outputs an error](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L278),
directing the user to create an issue on the extension's
repository:

```go
if asset == nil {
	return fmt.Errorf(
		"%[1]s unsupported for %[2]s. Open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
		repo.RepoName(), platform, repo.RepoOwner())
}
```

The issue this creates isn't very clear or helpful. It isn't
obvious where it is coming from, or what you need to do.

This improves the suggested command, adding a better title
to the issue and an explanatory body.

To test this, try installing my
`timrogers/gh-extension-without-binary` extension, which only has
an esoteric `linux-ppc64` binary 😸:

```bash
gh extension install timrogers/gh-extension-without-binary
```

You'll get a nice output like this:

```
gh-extension-without-binary unsupported for darwin-arm64. Open an issue: `gh issue create -R timrogers/gh-extension-without-binary --title "Add support for the darwin-arm64 architecture" --body "This extension does not support the darwin-arm64 architecture. I tried to install it on a darwin-arm64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>."`
```

...which produces an issue like
https://github.com/timrogers/gh-extension-without-binary/issues/4.

I have tested the resulting command on macOS and Windows, so
I am confident that it has *at least reasonable* cross-platform
support.

Fixes https://github.com/cli/cli/issues/9600.
---
 pkg/cmd/extension/manager.go      | 15 +++++++++++++--
 pkg/cmd/extension/manager_test.go |  2 +-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 45186d689..37140ee0f 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -280,9 +280,11 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 	}
 
 	if asset == nil {
+		issueCreateCommand := generateMissingBinaryIssueCreateCommand(repo.RepoOwner(), repo.RepoName(), platform)
+
 		return fmt.Errorf(
-			"%[1]s unsupported for %[2]s. Open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
-			repo.RepoName(), platform, repo.RepoOwner())
+			"%[1]s unsupported for %[2]s. Open an issue: `%[3]s`",
+			repo.RepoName(), platform, issueCreateCommand)
 	}
 
 	name := repo.RepoName()
@@ -334,6 +336,15 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 	return nil
 }
 
+func generateMissingBinaryIssueCreateCommand(repoOwner string, repoName string, currentPlatform string) string {
+	issueBody := generateMissingBinaryIssueBody(currentPlatform)
+	return fmt.Sprintf("gh issue create -R %[1]s/%[2]s --title \"Add support for the %[3]s architecture\" --body \"%[4]s\"", repoOwner, repoName, currentPlatform, issueBody)
+}
+
+func generateMissingBinaryIssueBody(currentPlatform string) string {
+	return fmt.Sprintf("This extension does not support the %[1]s architecture. I tried to install it on a %[1]s machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.", currentPlatform)
+}
+
 func writeManifest(dir, name string, data []byte) (writeErr error) {
 	path := filepath.Join(dir, name)
 	var f *os.File
diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index 5de4e15cb..78fd40978 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -906,7 +906,7 @@ func TestManager_Install_binary_unsupported(t *testing.T) {
 	m := newTestManager(tempDir, &client, nil, ios)
 
 	err := m.Install(repo, "")
-	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64. Open an issue: `gh issue create -R owner/gh-bin-ext -t'Support windows-amd64'`")
+	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64. Open an issue: `gh issue create -R owner/gh-bin-ext --title \"Add support for the windows-amd64 architecture\" --body \"This extension does not support the windows-amd64 architecture. I tried to install it on a windows-amd64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.\"`")
 
 	assert.Equal(t, "", stdout.String())
 	assert.Equal(t, "", stderr.String())

From 81d57a0643ff5856a96c0c5735184a571985f3df Mon Sep 17 00:00:00 2001
From: Tim Rogers <me@timrogers.co.uk>
Date: Thu, 12 Sep 2024 23:18:37 +0100
Subject: [PATCH 065/301] Improve error presentation

---
 pkg/cmd/extension/manager.go      | 6 ++++--
 pkg/cmd/extension/manager_test.go | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 37140ee0f..6bed532d3 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -280,11 +280,13 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 	}
 
 	if asset == nil {
+		cs := m.io.ColorScheme()
+		errorMessageInRed := fmt.Sprintf(cs.Red("%[1]s unsupported for %[2]s."), repo.RepoName(), platform)
 		issueCreateCommand := generateMissingBinaryIssueCreateCommand(repo.RepoOwner(), repo.RepoName(), platform)
 
 		return fmt.Errorf(
-			"%[1]s unsupported for %[2]s. Open an issue: `%[3]s`",
-			repo.RepoName(), platform, issueCreateCommand)
+			"%[1]s\n\nOpen an issue on the extension's repo by running the following command:\n\n	`%[2]s`",
+			errorMessageInRed, issueCreateCommand)
 	}
 
 	name := repo.RepoName()
diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index 78fd40978..ae3a9a469 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -906,7 +906,7 @@ func TestManager_Install_binary_unsupported(t *testing.T) {
 	m := newTestManager(tempDir, &client, nil, ios)
 
 	err := m.Install(repo, "")
-	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64. Open an issue: `gh issue create -R owner/gh-bin-ext --title \"Add support for the windows-amd64 architecture\" --body \"This extension does not support the windows-amd64 architecture. I tried to install it on a windows-amd64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.\"`")
+	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64.\n\nOpen an issue on the extension's repo by running the following command:\n\n\t`gh issue create -R owner/gh-bin-ext --title \"Add support for the windows-amd64 architecture\" --body \"This extension does not support the windows-amd64 architecture. I tried to install it on a windows-amd64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.\"")
 
 	assert.Equal(t, "", stdout.String())
 	assert.Equal(t, "", stderr.String())

From e7403b89d0c0be36dacae29f61cb040525ba7246 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 18 Sep 2024 08:42:19 -0600
Subject: [PATCH 066/301] Add HasActiveToken to AuthConfig.

Co-authored-by: William Martin <williammartin@users.noreply.github.com>
---
 internal/config/auth_config_test.go | 26 +++++++++++++++++++++++++-
 internal/config/config.go           |  7 +++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/internal/config/auth_config_test.go b/internal/config/auth_config_test.go
index ed000ff18..61245c650 100644
--- a/internal/config/auth_config_test.go
+++ b/internal/config/auth_config_test.go
@@ -52,8 +52,32 @@ func TestTokenFromKeyringForUserErrorsIfUsernameIsBlank(t *testing.T) {
 	require.ErrorContains(t, err, "username cannot be blank")
 }
 
+func TestHasActiveToken(t *testing.T) {
+	// Given the user has logged in for a host
+	authCfg := newTestAuthConfig(t)
+	_, err := authCfg.Login("github.com", "test-user", "test-token", "", false)
+	require.NoError(t, err)
+
+	// When we check if that host has an active token
+	hasActiveToken := authCfg.HasActiveToken("github.com")
+
+	// Then there is an active token
+	require.True(t, hasActiveToken, "expected there to be an active token")
+}
+
+func TestHasNoActiveToken(t *testing.T) {
+	// Given there are no users logged in for a host
+	authCfg := newTestAuthConfig(t)
+
+	// When we check if any host has an active token
+	hasActiveToken := authCfg.HasActiveToken("github.com")
+
+	// Then there is no active token
+	require.False(t, hasActiveToken, "expected there to be no active token")
+}
+
 func TestTokenStoredInConfig(t *testing.T) {
-	// When the user has logged in insecurely
+	// Given the user has logged in insecurely
 	authCfg := newTestAuthConfig(t)
 	_, err := authCfg.Login("github.com", "test-user", "test-token", "", false)
 	require.NoError(t, err)
diff --git a/internal/config/config.go b/internal/config/config.go
index 29b66b73b..f7c949a46 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -217,6 +217,13 @@ func (c *AuthConfig) ActiveToken(hostname string) (string, string) {
 	return token, source
 }
 
+// HasActiveToken returns true when a token for the hostname is
+// present.
+func (c *AuthConfig) HasActiveToken(hostname string) bool {
+	token, _ := c.ActiveToken(hostname)
+	return token != ""
+}
+
 // HasEnvToken returns true when a token has been specified in an
 // environment variable, else returns false.
 func (c *AuthConfig) HasEnvToken() bool {

From 88d48f23654838ea7428ed47ed28f64f65405f6a Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 18 Sep 2024 10:32:58 -0600
Subject: [PATCH 067/301] Add HasActiveToken method to AuthConfig interface

---
 internal/gh/gh.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/internal/gh/gh.go b/internal/gh/gh.go
index c39734075..e4431fdab 100644
--- a/internal/gh/gh.go
+++ b/internal/gh/gh.go
@@ -93,6 +93,9 @@ type Migration interface {
 // with knowledge on how to access encrypted storage when neccesarry.
 // Behavior is scoped to authentication specific tasks.
 type AuthConfig interface {
+	// HasActiveToken returns true when a token for the hostname is present.
+	HasActiveToken(hostname string) bool
+
 	// ActiveToken will retrieve the active auth token for the given hostname, searching environment variables,
 	// general configuration, and finally encrypted storage.
 	ActiveToken(hostname string) (token string, source string)

From d8e77d256fe83791cf675e0ff539e1390ffd98d5 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 18 Sep 2024 10:35:11 -0600
Subject: [PATCH 068/301] Use new HasActiveToken method in trustedroot.go

---
 pkg/cmd/attestation/trustedroot/trustedroot.go     |  2 +-
 .../attestation/trustedroot/trustedroot_test.go    | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index 7dba916eb..6f741dcd4 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -74,7 +74,7 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 					return err
 				}
 
-				if token, _ := c.Authentication().ActiveToken(opts.Hostname); token == "" {
+				if !c.Authentication().HasActiveToken(opts.Hostname) {
 					return fmt.Errorf("not authenticated with %s", opts.Hostname)
 				}
 
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot_test.go b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
index c3c1818dd..c4a259436 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot_test.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot_test.go
@@ -109,7 +109,7 @@ func TestNewTrustedRootWithTenancy(t *testing.T) {
 			Config: func() (gh.Config, error) {
 				return &ghmock.ConfigMock{
 					AuthenticationFunc: func() gh.AuthConfig {
-						return &MockAuthConfig{Token: ""}
+						return &stubAuthConfig{hasActiveToken: false}
 					},
 				}, nil
 			},
@@ -136,7 +136,7 @@ func TestNewTrustedRootWithTenancy(t *testing.T) {
 			Config: func() (gh.Config, error) {
 				return &ghmock.ConfigMock{
 					AuthenticationFunc: func() gh.AuthConfig {
-						return &MockAuthConfig{Token: "TOKEN"}
+						return &stubAuthConfig{hasActiveToken: true}
 					},
 				}, nil
 			},
@@ -186,13 +186,13 @@ func TestGetTrustedRoot(t *testing.T) {
 
 }
 
-type MockAuthConfig struct {
+type stubAuthConfig struct {
 	config.AuthConfig
-	Token string
+	hasActiveToken bool
 }
 
-var _ gh.AuthConfig = (*MockAuthConfig)(nil)
+var _ gh.AuthConfig = (*stubAuthConfig)(nil)
 
-func (c *MockAuthConfig) ActiveToken(host string) (string, string) {
-	return c.Token, ""
+func (c *stubAuthConfig) HasActiveToken(host string) bool {
+	return c.hasActiveToken
 }

From d24dfbeacfdc87ea108835ee79e9f766fd75f639 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 18 Sep 2024 10:35:35 -0600
Subject: [PATCH 069/301] Update comment formatting

---
 internal/config/config.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index f7c949a46..1b56d30b2 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -217,8 +217,7 @@ func (c *AuthConfig) ActiveToken(hostname string) (string, string) {
 	return token, source
 }
 
-// HasActiveToken returns true when a token for the hostname is
-// present.
+// HasActiveToken returns true when a token for the hostname is present.
 func (c *AuthConfig) HasActiveToken(hostname string) bool {
 	token, _ := c.ActiveToken(hostname)
 	return token != ""

From 195188cee8751247d94c0196ac5ab20371210591 Mon Sep 17 00:00:00 2001
From: Tim Rogers <timrogers@github.com>
Date: Wed, 18 Sep 2024 18:55:20 +0100
Subject: [PATCH 070/301] Update pkg/cmd/extension/manager.go

Co-authored-by: Tyler McGoffin <jtmcg@github.com>
---
 pkg/cmd/extension/manager.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 6bed532d3..410d4c224 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -285,8 +285,8 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 		issueCreateCommand := generateMissingBinaryIssueCreateCommand(repo.RepoOwner(), repo.RepoName(), platform)
 
 		return fmt.Errorf(
-			"%[1]s\n\nOpen an issue on the extension's repo by running the following command:\n\n	`%[2]s`",
-			errorMessageInRed, issueCreateCommand)
+			"%[1]s\n\nTo request support for %[2]s, open an issue on the extension's repo by running the following command:\n\n	`%[3]s`",
+			errorMessageInRed, platform, issueCreateCommand)
 	}
 
 	name := repo.RepoName()

From 665e41566fe0856fd8d4c2991f81535b50b7da61 Mon Sep 17 00:00:00 2001
From: Tim Rogers <me@timrogers.co.uk>
Date: Wed, 18 Sep 2024 19:07:32 +0100
Subject: [PATCH 071/301] Fix test

---
 pkg/cmd/extension/manager_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index ae3a9a469..0ad8e991e 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -906,7 +906,7 @@ func TestManager_Install_binary_unsupported(t *testing.T) {
 	m := newTestManager(tempDir, &client, nil, ios)
 
 	err := m.Install(repo, "")
-	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64.\n\nOpen an issue on the extension's repo by running the following command:\n\n\t`gh issue create -R owner/gh-bin-ext --title \"Add support for the windows-amd64 architecture\" --body \"This extension does not support the windows-amd64 architecture. I tried to install it on a windows-amd64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.\"")
+	assert.EqualError(t, err, "gh-bin-ext unsupported for windows-amd64.\n\nTo request support for windows-amd64, open an issue on the extension's repo by running the following command:\n\n\t`gh issue create -R owner/gh-bin-ext --title \"Add support for the windows-amd64 architecture\" --body \"This extension does not support the windows-amd64 architecture. I tried to install it on a windows-amd64 machine, and it failed due to the lack of an available binary. Would you be able to update the extension's build and release process to include the relevant binary? For more details, see <https://docs.github.com/en/github-cli/github-cli/creating-github-cli-extensions>.\"`")
 
 	assert.Equal(t, "", stdout.String())
 	assert.Equal(t, "", stderr.String())

From 8123de9722c698c2ebbb21bdd32516ca7bcad1bf Mon Sep 17 00:00:00 2001
From: Brian DeHamer <bdehamer@github.com>
Date: Wed, 18 Sep 2024 14:05:04 -0700
Subject: [PATCH 072/301] fix tenant-awareness for trusted-root command

Signed-off-by: Brian DeHamer <bdehamer@github.com>
---
 pkg/cmd/attestation/trustedroot/trustedroot.go | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index c9c3fdb04..c52bdac15 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -116,6 +116,12 @@ func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
 	// Disable local caching, so we get up-to-date response from TUF repository
 	tufOpt.CacheValidity = 0
 
+	// Target will be either the default trusted root, or the trust domain-qualified one
+	ghTR := defaultTR
+	if opts.TrustDomain != "" {
+		ghTR = fmt.Sprintf("%s.%s", opts.TrustDomain, defaultTR)
+	}
+
 	if opts.TufUrl != "" && opts.TufRootPath != "" {
 		tufRoot, err := os.ReadFile(opts.TufRootPath)
 		if err != nil {
@@ -126,7 +132,7 @@ func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
 		tufOpt.RepositoryBaseURL = opts.TufUrl
 		tufOptions = append(tufOptions, tufConfig{
 			tufOptions: tufOpt,
-			targets:    []string{defaultTR},
+			targets:    []string{ghTR},
 		})
 	} else {
 		// Get from both Sigstore public good and GitHub private instance
@@ -137,14 +143,9 @@ func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
 
 		tufOpt = verification.GitHubTUFOptions()
 		tufOpt.CacheValidity = 0
-		targets := []string{defaultTR}
-		if opts.TrustDomain != "" {
-			targets = append(targets, fmt.Sprintf("%s.%s",
-				opts.TrustDomain, defaultTR))
-		}
 		tufOptions = append(tufOptions, tufConfig{
 			tufOptions: tufOpt,
-			targets:    targets,
+			targets:    []string{ghTR},
 		})
 	}
 

From 5dd52463071d0eb053d675796eca1ff47bb20550 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 19 Sep 2024 14:52:16 -0700
Subject: [PATCH 073/301] Replace "GitHub Enterprise Server" with "other" in
 `gh auth login` prompt

This change is meant to better support the login flow for other customers
besides GitHub Enterprise Server customers that use the same login flow
as GHES.
---
 pkg/cmd/auth/login/login.go      |  2 +-
 pkg/cmd/auth/login/login_test.go | 52 ++++++++++++++++++++++++++++++--
 2 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 9e27f28ac..2eded806e 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -222,7 +222,7 @@ func loginRun(opts *LoginOptions) error {
 }
 
 func promptForHostname(opts *LoginOptions) (string, error) {
-	options := []string{"GitHub.com", "GitHub Enterprise Server"}
+	options := []string{"GitHub.com", "other"}
 	hostType, err := opts.Prompter.Select(
 		"What account do you want to log into?",
 		options[0],
diff --git a/pkg/cmd/auth/login/login_test.go b/pkg/cmd/auth/login/login_test.go
index d53dd3f0b..555606d56 100644
--- a/pkg/cmd/auth/login/login_test.go
+++ b/pkg/cmd/auth/login/login_test.go
@@ -2,6 +2,7 @@ package login
 
 import (
 	"bytes"
+	"fmt"
 	"net/http"
 	"regexp"
 	"runtime"
@@ -546,7 +547,7 @@ func Test_loginRun_Survey(t *testing.T) {
 			wantErrOut: regexp.MustCompile("Tip: you can generate a Personal Access Token here https://rebecca.chambers/settings/tokens"),
 		},
 		{
-			name: "choose enterprise",
+			name: "choose other",
 			wantHosts: heredoc.Doc(`
                 brad.vickers:
                     users:
@@ -564,7 +565,7 @@ func Test_loginRun_Survey(t *testing.T) {
 				pm.SelectFunc = func(prompt, _ string, opts []string) (int, error) {
 					switch prompt {
 					case "What account do you want to log into?":
-						return prompter.IndexFor(opts, "GitHub Enterprise Server")
+						return prompter.IndexFor(opts, "other")
 					case "What is your preferred protocol for Git operations on this host?":
 						return prompter.IndexFor(opts, "HTTPS")
 					case "How would you like to authenticate GitHub CLI?":
@@ -803,3 +804,50 @@ func Test_loginRun_Survey(t *testing.T) {
 		})
 	}
 }
+
+func Test_promptForHostname(t *testing.T) {
+	tests := []struct {
+		name          string
+		options       []string
+		selectedIndex int
+		// This is so we can test that the options in the function don't change
+		expectedSelection string
+		inputHostname     string
+		expect            string
+	}{
+		{
+			name:              "select GitHub.com",
+			selectedIndex:     0,
+			expectedSelection: "GitHub.com",
+			expect:            "github.com",
+		},
+		{
+			name:              "select other",
+			selectedIndex:     1,
+			expectedSelection: "other",
+			inputHostname:     "github.enterprise.com",
+			expect:            "github.enterprise.com",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			promptMock := &prompter.PrompterMock{
+				SelectFunc: func(_ string, _ string, options []string) (int, error) {
+					if options[tt.selectedIndex] != tt.expectedSelection {
+						return 0, fmt.Errorf("expected %s at index %d, but got %s", tt.expectedSelection, tt.selectedIndex, options[tt.selectedIndex])
+					}
+					return tt.selectedIndex, nil
+				},
+				InputHostnameFunc: func() (string, error) {
+					return tt.inputHostname, nil
+				},
+			}
+			opts := &LoginOptions{
+				Prompter: promptMock,
+			}
+			hostname, err := promptForHostname(opts)
+			require.NoError(t, err)
+			require.Equal(t, tt.expect, hostname)
+		})
+	}
+}

From 46790977bb69023ae51a47469b39f6855d9c90af Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 19 Sep 2024 15:11:02 -0700
Subject: [PATCH 074/301] Add documentation explaining how to use `hostname`
 for `gh auth login`

---
 pkg/cmd/auth/login/login.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 2eded806e..613555dd7 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -59,6 +59,10 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 		Long: heredoc.Docf(`
 			Authenticate with a GitHub host.
 
+			Your %[1]shostname%[1]s is the domain where the GitHub instance you are logging into is hosted.
+			For example, "github.com" is the default hostname for GitHub.com. To authenticate with
+			a different hostname like github.enterprise.com, use that hostname instead.
+
 			The default authentication mode is a web-based browser flow. After completion, an
 			authentication token will be stored securely in the system credential store.
 			If a credential store is not found or there is an issue using it gh will fallback

From 1ef71409f3605709e01beab4e7a227a9bc44272f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 20 Sep 2024 14:11:28 +0000
Subject: [PATCH 075/301] build(deps): bump github.com/henvic/httpretty from
 0.1.3 to 0.1.4

Bumps [github.com/henvic/httpretty](https://github.com/henvic/httpretty) from 0.1.3 to 0.1.4.
- [Commits](https://github.com/henvic/httpretty/compare/v0.1.3...v0.1.4)

---
updated-dependencies:
- dependency-name: github.com/henvic/httpretty
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 54d02ec8e..9bf6be8e4 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/gorilla/websocket v1.5.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-version v1.3.0
-	github.com/henvic/httpretty v0.1.3
+	github.com/henvic/httpretty v0.1.4
 	github.com/in-toto/attestation v1.1.0
 	github.com/joho/godotenv v1.5.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
diff --git a/go.sum b/go.sum
index 416f2ee59..cdde6c210 100644
--- a/go.sum
+++ b/go.sum
@@ -251,8 +251,8 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/vault/api v1.12.2 h1:7YkCTE5Ni90TcmYHDBExdt4WGJxhpzaHqR6uGbQb/rE=
 github.com/hashicorp/vault/api v1.12.2/go.mod h1:LSGf1NGT1BnvFFnKVtnvcaLBM2Lz+gJdpL6HUYed8KE=
-github.com/henvic/httpretty v0.1.3 h1:4A6vigjz6Q/+yAfTD4wqipCv+Px69C7Th/NhT0ApuU8=
-github.com/henvic/httpretty v0.1.3/go.mod h1:UUEv7c2kHZ5SPQ51uS3wBpzPDibg2U3Y+IaXyHy5GBg=
+github.com/henvic/httpretty v0.1.4 h1:Jo7uwIRWVFxkqOnErcoYfH90o3ddQyVrSANeS4cxYmU=
+github.com/henvic/httpretty v0.1.4/go.mod h1:Dn60sQTZfbt2dYsdUSNsCljyF4AfdqnuJFDLJA1I4AM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=

From bc587f6576dc7a939545e791ee69ef969bcf5815 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 20 Sep 2024 13:55:20 -0700
Subject: [PATCH 076/301] Sentence case 'Other' option in hostname prompt

---
 pkg/cmd/auth/login/login.go      |  2 +-
 pkg/cmd/auth/login/login_test.go | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 613555dd7..9066abd5d 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -226,7 +226,7 @@ func loginRun(opts *LoginOptions) error {
 }
 
 func promptForHostname(opts *LoginOptions) (string, error) {
-	options := []string{"GitHub.com", "other"}
+	options := []string{"GitHub.com", "Other"}
 	hostType, err := opts.Prompter.Select(
 		"What account do you want to log into?",
 		options[0],
diff --git a/pkg/cmd/auth/login/login_test.go b/pkg/cmd/auth/login/login_test.go
index 555606d56..1cd955b1f 100644
--- a/pkg/cmd/auth/login/login_test.go
+++ b/pkg/cmd/auth/login/login_test.go
@@ -547,7 +547,7 @@ func Test_loginRun_Survey(t *testing.T) {
 			wantErrOut: regexp.MustCompile("Tip: you can generate a Personal Access Token here https://rebecca.chambers/settings/tokens"),
 		},
 		{
-			name: "choose other",
+			name: "choose Other",
 			wantHosts: heredoc.Doc(`
                 brad.vickers:
                     users:
@@ -565,7 +565,7 @@ func Test_loginRun_Survey(t *testing.T) {
 				pm.SelectFunc = func(prompt, _ string, opts []string) (int, error) {
 					switch prompt {
 					case "What account do you want to log into?":
-						return prompter.IndexFor(opts, "other")
+						return prompter.IndexFor(opts, "Other")
 					case "What is your preferred protocol for Git operations on this host?":
 						return prompter.IndexFor(opts, "HTTPS")
 					case "How would you like to authenticate GitHub CLI?":
@@ -816,15 +816,15 @@ func Test_promptForHostname(t *testing.T) {
 		expect            string
 	}{
 		{
-			name:              "select GitHub.com",
+			name:              "select 'GitHub.com'",
 			selectedIndex:     0,
 			expectedSelection: "GitHub.com",
 			expect:            "github.com",
 		},
 		{
-			name:              "select other",
+			name:              "select 'Other'",
 			selectedIndex:     1,
-			expectedSelection: "other",
+			expectedSelection: "Other",
 			inputHostname:     "github.enterprise.com",
 			expect:            "github.enterprise.com",
 		},

From 13e916bcfb22366d2d5db10b486ae066ce54b494 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 20 Sep 2024 14:10:05 -0700
Subject: [PATCH 077/301] Change prompts for `gh auth login` to reflect change
 from GHE to Other

---
 internal/prompter/prompter.go    | 2 +-
 pkg/cmd/auth/login/login.go      | 2 +-
 pkg/cmd/auth/login/login_test.go | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/internal/prompter/prompter.go b/internal/prompter/prompter.go
index 44579b189..1d4b11cbc 100644
--- a/internal/prompter/prompter.go
+++ b/internal/prompter/prompter.go
@@ -92,7 +92,7 @@ func (p *surveyPrompter) InputHostname() (string, error) {
 	var result string
 	err := p.ask(
 		&survey.Input{
-			Message: "GHE hostname:",
+			Message: "Hostname:",
 		}, &result, survey.WithValidator(func(v interface{}) error {
 			return ghinstance.HostnameValidator(v.(string))
 		}))
diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 9066abd5d..4d4db3259 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -228,7 +228,7 @@ func loginRun(opts *LoginOptions) error {
 func promptForHostname(opts *LoginOptions) (string, error) {
 	options := []string{"GitHub.com", "Other"}
 	hostType, err := opts.Prompter.Select(
-		"What account do you want to log into?",
+		"Where do you use GitHub?",
 		options[0],
 		options)
 	if err != nil {
diff --git a/pkg/cmd/auth/login/login_test.go b/pkg/cmd/auth/login/login_test.go
index 1cd955b1f..3264ed91c 100644
--- a/pkg/cmd/auth/login/login_test.go
+++ b/pkg/cmd/auth/login/login_test.go
@@ -564,7 +564,7 @@ func Test_loginRun_Survey(t *testing.T) {
 			prompterStubs: func(pm *prompter.PrompterMock) {
 				pm.SelectFunc = func(prompt, _ string, opts []string) (int, error) {
 					switch prompt {
-					case "What account do you want to log into?":
+					case "Where do you use GitHub?":
 						return prompter.IndexFor(opts, "Other")
 					case "What is your preferred protocol for Git operations on this host?":
 						return prompter.IndexFor(opts, "HTTPS")
@@ -607,7 +607,7 @@ func Test_loginRun_Survey(t *testing.T) {
 			prompterStubs: func(pm *prompter.PrompterMock) {
 				pm.SelectFunc = func(prompt, _ string, opts []string) (int, error) {
 					switch prompt {
-					case "What account do you want to log into?":
+					case "Where do you use GitHub?":
 						return prompter.IndexFor(opts, "GitHub.com")
 					case "What is your preferred protocol for Git operations on this host?":
 						return prompter.IndexFor(opts, "HTTPS")
@@ -641,7 +641,7 @@ func Test_loginRun_Survey(t *testing.T) {
 			prompterStubs: func(pm *prompter.PrompterMock) {
 				pm.SelectFunc = func(prompt, _ string, opts []string) (int, error) {
 					switch prompt {
-					case "What account do you want to log into?":
+					case "Where do you use GitHub?":
 						return prompter.IndexFor(opts, "GitHub.com")
 					case "What is your preferred protocol for Git operations on this host?":
 						return prompter.IndexFor(opts, "SSH")

From 2059c630a27443df0d4c2185b26e22c592aaf3ef Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 20 Sep 2024 14:12:13 -0700
Subject: [PATCH 078/301] Update language on docstring for `gh auth login`

---
 pkg/cmd/auth/login/login.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 4d4db3259..a5e601960 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -59,8 +59,8 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 		Long: heredoc.Docf(`
 			Authenticate with a GitHub host.
 
-			Your %[1]shostname%[1]s is the domain where the GitHub instance you are logging into is hosted.
-			For example, "github.com" is the default hostname for GitHub.com. To authenticate with
+			The %[1]shostname%[1]s is the domain where the GitHub instance you are logging into is hosted.
+			For example, "github.com" is the hostname for GitHub.com. To authenticate with
 			a different hostname like github.enterprise.com, use that hostname instead.
 
 			The default authentication mode is a web-based browser flow. After completion, an

From ccb830ca3674dc480cae08f026f3e298662e35e1 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 20 Sep 2024 15:51:07 -0700
Subject: [PATCH 079/301] Shorten language on Authenticate with a GitHub host.

The default authentication mode is a web-based browser flow. After completion, an
authentication token will be stored securely in the system credential store.
If a credential store is not found or there is an issue using it gh will fallback
to writing the token to a plain text file. See `gh auth status` for its
stored location.

Alternatively, use `--with-token` to pass in a token on standard input.
The minimum required scopes for the token are: `repo`, `read:org`, and `gist`.

Alternatively, gh will use the authentication token found in environment variables.
This method is most suitable for "headless" use of gh such as in automation. See
`gh help environment` for more info.

To use gh in GitHub Actions, add `GH_TOKEN: ${{ github.token }}` to `env`.

The git protocol to use for git operations on this host can be set with `--git-protocol`,
or during the interactive prompting. Although login is for a single account on a host, setting
the git protocol will take effect for all users on the host.

Specifying `ssh` for the git protocol will detect existing SSH keys to upload,
prompting to create and upload a new key if one is not found. This can be skipped with
`--skip-ssh-key` flag.

USAGE
  gh auth login [flags]

FLAGS
  -p, --git-protocol string   The protocol to use for git operations on this host: {ssh|https}
  -h, --hostname string       The hostname of the GitHub instance to authenticate with
      --insecure-storage      Save authentication credentials in plain text instead of credential store
  -s, --scopes strings        Additional authentication scopes to request
      --skip-ssh-key          Skip generate/upload SSH key prompt
  -w, --web                   Open a browser to authenticate
      --with-token            Read token from standard input

INHERITED FLAGS
  --help   Show help for command

EXAMPLES
  # Start interactive setup
  $ gh auth login

  # Authenticate against github.com by reading the token from a file
  $ gh auth login --with-token < mytoken.txt

  # Authenticate with specific host
  $ gh auth login --hostname enterprise.internal

LEARN MORE
  Use `gh <command> <subcommand> --help` for more information about a command.
  Read the manual at https://cli.github.com/manual
  Learn about exit codes using `gh help exit-codes` around Tylers-GitHub-MacBook.local
---
 pkg/cmd/auth/login/login.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index a5e601960..2a4f118cc 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -59,9 +59,7 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 		Long: heredoc.Docf(`
 			Authenticate with a GitHub host.
 
-			The %[1]shostname%[1]s is the domain where the GitHub instance you are logging into is hosted.
-			For example, "github.com" is the hostname for GitHub.com. To authenticate with
-			a different hostname like github.enterprise.com, use that hostname instead.
+			The %[1]shostname%[1]s is where you log in to GitHub. The default hostname is %[1]sgithub.com%[1]s.
 
 			The default authentication mode is a web-based browser flow. After completion, an
 			authentication token will be stored securely in the system credential store.

From 1eda1b41a7af430a13d1c17f6c5d2fbbe1e6c3da Mon Sep 17 00:00:00 2001
From: Tim Rogers <me@timrogers.co.uk>
Date: Sat, 21 Sep 2024 14:56:43 -0500
Subject: [PATCH 080/301] Emit a log message when extension installation falls
 back to a darwin-amd64 binary on an Apple Silicon macOS machine

---
 pkg/cmd/extension/manager.go      | 11 ++++++++---
 pkg/cmd/extension/manager_test.go |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 410d4c224..2431c6b83 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -29,6 +29,8 @@ import (
 // ErrInitialCommitFailed indicates the initial commit when making a new extension failed.
 var ErrInitialCommitFailed = errors.New("initial commit failed")
 
+const darwinAmd64 = "darwin-amd64"
+
 type Manager struct {
 	dataDir    func() string
 	lookPath   func(string) (string, error)
@@ -266,13 +268,16 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 	// if using an ARM-based Mac and an arm64 binary is unavailable, fall back to amd64 if a relevant binary is available and Rosetta 2 is installed
 	if asset == nil && isMacARM {
 		for _, a := range r.Assets {
-			if strings.HasSuffix(a.Name, "darwin-amd64") {
+			if strings.HasSuffix(a.Name, darwinAmd64) {
 				if !hasRosetta() {
 					return fmt.Errorf(
-						"%[1]s unsupported for %[2]s. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
-						repo.RepoName(), platform, repo.RepoOwner())
+						"%[1]s unsupported for %[2]s. Install Rosetta with `softwareupdate --install-rosetta` to use the available %[3]s binary, or open an issue: `gh issue create -R %[4]s/%[1]s -t'Support %[2]s'`",
+						repo.RepoName(), platform, darwinAmd64, repo.RepoOwner())
 				}
 
+				fallbackMessage := fmt.Sprintf("%[1]s not available for %[2]s. Falling back to compatible %[3]s binary", repo.RepoName(), platform, darwinAmd64)
+				fmt.Fprintln(m.io.Out, fallbackMessage)
+
 				asset = &a
 				break
 			}
diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index 0ad8e991e..e25bc1496 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -1098,7 +1098,7 @@ func TestManager_Install_amd64_when_supported(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, "FAKE BINARY", string(fakeBin))
 
-	assert.Equal(t, "", stdout.String())
+	assert.Equal(t, "gh-bin-ext not available for darwin-arm64. Falling back to compatible darwin-amd64 binary\n", stdout.String())
 	assert.Equal(t, "", stderr.String())
 }
 

From 029dc8ffc128361ac94b04414675089f3207f4f1 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 23 Sep 2024 09:04:03 -0700
Subject: [PATCH 081/301] Change conditional in promptForHostname to better
 reflect prompter changes

The old isEnterprise check no longer makes sense, given the prompter is
providing 'other', not 'GitHub Enterprise Server' as its non-GitHub.com
option. Additionally, there was an opportunity for cleaning up the code
via early returns and the removal of the default hostname lookup if we
don't need it.
---
 pkg/cmd/auth/login/login.go | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 2a4f118cc..a25bd9f85 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -233,12 +233,10 @@ func promptForHostname(opts *LoginOptions) (string, error) {
 		return "", err
 	}
 
-	isEnterprise := hostType == 1
-
-	hostname := ghinstance.Default()
-	if isEnterprise {
-		hostname, err = opts.Prompter.InputHostname()
+	isGitHubDotCom := hostType == 0
+	if isGitHubDotCom {
+		return ghinstance.Default(), nil
 	}
 
-	return hostname, err
+	return opts.Prompter.InputHostname()
 }

From f4af65d9dfb246ce8c3cbbd09f247917e34de3bd Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 23 Sep 2024 09:35:57 -0700
Subject: [PATCH 082/301] Update docs language to remove possible confusion
 around 'where you log in'

---
 pkg/cmd/auth/login/login.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index a25bd9f85..1480a29a0 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -59,7 +59,8 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 		Long: heredoc.Docf(`
 			Authenticate with a GitHub host.
 
-			The %[1]shostname%[1]s is where you log in to GitHub. The default hostname is %[1]sgithub.com%[1]s.
+			The default hostname is %[1]sgithub.com%[1]s. This can be overridden using the %[1]s--hostname%[1]s
+			flag.
 
 			The default authentication mode is a web-based browser flow. After completion, an
 			authentication token will be stored securely in the system credential store.

From fd8c4633e334f7bb5788fbb73fa9e0c02ebad7c9 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 23 Sep 2024 12:30:02 -0600
Subject: [PATCH 083/301] First pass at implementing `gh repo license list`

---
 pkg/cmd/repo/create/create.go          |   4 +-
 pkg/cmd/repo/create/http.go            |  11 --
 pkg/cmd/repo/license/license.go        |  18 ++
 pkg/cmd/repo/license/list/list.go      |  96 +++++++++
 pkg/cmd/repo/license/list/list_test.go | 259 +++++++++++++++++++++++++
 pkg/cmd/repo/repo.go                   |   2 +
 pkg/cmd/repo/shared/repo.go            |  14 ++
 7 files changed, 391 insertions(+), 13 deletions(-)
 create mode 100644 pkg/cmd/repo/license/license.go
 create mode 100644 pkg/cmd/repo/license/list/list.go
 create mode 100644 pkg/cmd/repo/license/list/list_test.go

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 28ca0d1e8..4b8b18c70 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -244,7 +244,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		licenses, err := listLicenseTemplates(httpClient, hostname)
+		licenses, err := shared.ListLicenseTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -830,7 +830,7 @@ func interactiveLicense(client *http.Client, hostname string, prompter iprompter
 		return "", nil
 	}
 
-	licenses, err := listLicenseTemplates(client, hostname)
+	licenses, err := shared.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/repo/create/http.go b/pkg/cmd/repo/create/http.go
index 120683c08..ba99c3e4c 100644
--- a/pkg/cmd/repo/create/http.go
+++ b/pkg/cmd/repo/create/http.go
@@ -350,17 +350,6 @@ func listGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 	return gitIgnoreTemplates, nil
 }
 
-// listLicenseTemplates uses API v3 here because license template isn't supported by GraphQL yet.
-func listLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
-	var licenseTemplates []api.License
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
-	if err != nil {
-		return nil, err
-	}
-	return licenseTemplates, nil
-}
-
 // Returns the current username and any orgs that user is a member of.
 func userAndOrgs(httpClient *http.Client, hostname string) (string, []string, error) {
 	client := api.NewClientFromHTTP(httpClient)
diff --git a/pkg/cmd/repo/license/license.go b/pkg/cmd/repo/license/license.go
new file mode 100644
index 000000000..84896f2cd
--- /dev/null
+++ b/pkg/cmd/repo/license/license.go
@@ -0,0 +1,18 @@
+package license
+
+import (
+	cmdList "github.com/cli/cli/v2/pkg/cmd/repo/license/list"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/spf13/cobra"
+)
+
+func NewCmdLicense(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "license <command>",
+		Short: "View available repository license options",
+	}
+
+	cmd.AddCommand(cmdList.NewCmdList(f, nil))
+
+	return cmd
+}
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
new file mode 100644
index 000000000..48f8a74d9
--- /dev/null
+++ b/pkg/cmd/repo/license/list/list.go
@@ -0,0 +1,96 @@
+package list
+
+import (
+	"net/http"
+
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/internal/tableprinter"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/spf13/cobra"
+)
+
+type LicenseRenderer interface {
+	Render([]api.License, ListOptions) error
+}
+
+type TableLicenseRenderer struct{}
+
+var licenseFields = []string{
+	"key",
+	"name",
+}
+
+type ListOptions struct {
+	IO         *iostreams.IOStreams
+	HTTPClient func() (*http.Client, error)
+	Exporter   cmdutil.Exporter
+	Config     func() (gh.Config, error)
+}
+
+func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Command {
+	opts := &ListOptions{
+		IO:         f.IOStreams,
+		HTTPClient: f.HttpClient,
+		Config:     f.Config,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "list",
+		Short:   "List available repository license options",
+		Aliases: []string{"ls"},
+		Args:    cmdutil.ExactArgs(0, "gh repo license list takes no arguments"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+
+			if runF != nil {
+				return runF(opts)
+			}
+			return listRun(opts)
+		},
+	}
+	// cmdutil.AddFormatFlags(cmd, &opts.Exporter)
+	cmdutil.AddJSONFlags(cmd, &opts.Exporter, licenseFields)
+	return cmd
+}
+
+func listRun(opts *ListOptions) error {
+	client, err := opts.HTTPClient()
+	if err != nil {
+		return err
+	}
+
+	cfg, err := opts.Config()
+	if err != nil {
+		return err
+	}
+
+	hostname, _ := cfg.Authentication().DefaultHost()
+	licenses, err := shared.ListLicenseTemplates(client, hostname)
+	if err != nil {
+		return err
+	}
+
+	if len(licenses) == 0 {
+		return cmdutil.NewNoResultsError("no licenses found")
+	}
+
+	if opts.Exporter != nil {
+		return opts.Exporter.Write(opts.IO, licenses)
+	}
+
+	r := &TableLicenseRenderer{}
+	return r.Render(licenses, opts)
+}
+
+func (r *TableLicenseRenderer) Render(licenses []api.License, opts *ListOptions) error {
+	t := tableprinter.New(opts.IO, tableprinter.WithHeader("KEY", "NAME"))
+	for _, l := range licenses {
+		t.AddField(l.Key)
+		t.AddField(l.Name)
+		t.EndRow()
+	}
+
+	return t.Render()
+}
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
new file mode 100644
index 000000000..c84e3fff8
--- /dev/null
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -0,0 +1,259 @@
+package list
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewCmdList(t *testing.T) {
+	tests := []struct {
+		name    string
+		args    []string
+		wantErr bool
+		tty     bool
+	}{
+		{
+			name:    "no arguments",
+			args:    []string{},
+			wantErr: false,
+			tty:     false,
+		},
+		{
+			name:    "too many arguments",
+			args:    []string{"foo", "bar"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ios, _, _, _ := iostreams.Test()
+			ios.SetStdinTTY(tt.tty)
+			ios.SetStdoutTTY(tt.tty)
+			ios.SetStderrTTY(tt.tty)
+
+			f := &cmdutil.Factory{
+				IOStreams: ios,
+			}
+			cmd := NewCmdList(f, func(*ListOptions) error {
+				return nil
+			})
+			cmd.SetArgs(tt.args)
+			cmd.SetIn(&bytes.Buffer{})
+			cmd.SetOut(&bytes.Buffer{})
+			cmd.SetErr(&bytes.Buffer{})
+
+			_, err := cmd.ExecuteC()
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestTableLicenseRenderer(t *testing.T) {
+	tests := []struct {
+		name       string
+		opts       ListOptions
+		isTTY      bool
+		wantStdout string
+		wantErr    bool
+		licenses   []api.License
+	}{
+		{
+			name:  "licenses + tty",
+			opts:  ListOptions{},
+			isTTY: true,
+			wantStdout: heredoc.Doc(`
+			KEY       NAME
+			mit       MIT License
+			lgpl-3.0  GNU Lesser General Public License v3.0
+			`),
+			wantErr: false,
+			licenses: []api.License{
+				{
+					Key:  "mit",
+					Name: "MIT License",
+				},
+				{
+					Key:  "lgpl-3.0",
+					Name: "GNU Lesser General Public License v3.0",
+				},
+			},
+		},
+		{
+			name:  "no licenses + tty",
+			opts:  ListOptions{},
+			isTTY: true,
+			wantStdout: heredoc.Doc(`
+			KEY  NAME
+			`),
+			wantErr:  false,
+			licenses: []api.License{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ios, _, stdout, _ := iostreams.Test()
+			ios.SetStdoutTTY(tt.isTTY)
+			ios.SetStdinTTY(tt.isTTY)
+			ios.SetStderrTTY(tt.isTTY)
+			tt.opts.IO = ios
+
+			r := &TableLicenseRenderer{}
+			err := r.Render(tt.licenses, &tt.opts)
+
+			if !tt.wantErr {
+				assert.NoError(t, err, "Expected no error while rendering table")
+			}
+
+			assert.Equal(t, tt.wantStdout, stdout.String(), "Rendered table differs from expected")
+
+		})
+	}
+}
+
+func TestListRun(t *testing.T) {
+	tests := []struct {
+		name       string
+		opts       *ListOptions
+		isTTY      bool
+		httpStubs  func(t *testing.T, reg *httpmock.Registry)
+		wantStdout string
+		wantStderr string
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name:  "license list tty",
+			isTTY: true,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses"),
+					httpmock.StringResponse(`[
+						{
+							"key": "mit",
+							"name": "MIT License",
+							"spdx_id": "MIT",
+							"url": "https://api.github.com/licenses/mit",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "lgpl-3.0",
+							"name": "GNU Lesser General Public License v3.0",
+							"spdx_id": "LGPL-3.0",
+							"url": "https://api.github.com/licenses/lgpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "mpl-2.0",
+							"name": "Mozilla Public License 2.0",
+							"spdx_id": "MPL-2.0",
+							"url": "https://api.github.com/licenses/mpl-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "agpl-3.0",
+							"name": "GNU Affero General Public License v3.0",
+							"spdx_id": "AGPL-3.0",
+							"url": "https://api.github.com/licenses/agpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "unlicense",
+							"name": "The Unlicense",
+							"spdx_id": "Unlicense",
+							"url": "https://api.github.com/licenses/unlicense",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "apache-2.0",
+							"name": "Apache License 2.0",
+							"spdx_id": "Apache-2.0",
+							"url": "https://api.github.com/licenses/apache-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "gpl-3.0",
+							"name": "GNU General Public License v3.0",
+							"spdx_id": "GPL-3.0",
+							"url": "https://api.github.com/licenses/gpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						}
+						]`,
+					))
+			},
+			wantStdout: heredoc.Doc(`
+				KEY         NAME
+				mit         MIT License
+				lgpl-3.0    GNU Lesser General Public License v3.0
+				mpl-2.0     Mozilla Public License 2.0
+				agpl-3.0    GNU Affero General Public License v3.0
+				unlicense   The Unlicense
+				apache-2.0  Apache License 2.0
+				gpl-3.0     GNU General Public License v3.0
+				`),
+			wantStderr: "",
+			opts:       &ListOptions{},
+		},
+		{
+			name:  "license list no licenses tty",
+			isTTY: true,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses"),
+					httpmock.StringResponse(`[]`),
+				)
+			},
+			wantStdout: "",
+			wantStderr: "",
+			wantErr:    true,
+			errMsg:     "no licenses found",
+			opts:       &ListOptions{},
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.opts.Config = func() (gh.Config, error) {
+			return config.NewBlankConfig(), nil
+		}
+		tt.opts.HTTPClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		ios, _, stdout, stderr := iostreams.Test()
+		ios.SetStdoutTTY(tt.isTTY)
+		ios.SetStdinTTY(tt.isTTY)
+		ios.SetStderrTTY(tt.isTTY)
+		tt.opts.IO = ios
+
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			err := listRun(tt.opts)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, tt.errMsg, err.Error())
+				return
+			}
+
+			assert.Equal(t, tt.wantStdout, stdout.String(), "Stdout differs from expected")
+			assert.Equal(t, tt.wantStderr, stderr.String(), "Stderr differs from expected")
+		})
+	}
+}
diff --git a/pkg/cmd/repo/repo.go b/pkg/cmd/repo/repo.go
index baaa0e10f..611ef49ea 100644
--- a/pkg/cmd/repo/repo.go
+++ b/pkg/cmd/repo/repo.go
@@ -11,6 +11,7 @@ import (
 	repoEditCmd "github.com/cli/cli/v2/pkg/cmd/repo/edit"
 	repoForkCmd "github.com/cli/cli/v2/pkg/cmd/repo/fork"
 	gardenCmd "github.com/cli/cli/v2/pkg/cmd/repo/garden"
+	licenseCmd "github.com/cli/cli/v2/pkg/cmd/repo/license"
 	repoListCmd "github.com/cli/cli/v2/pkg/cmd/repo/list"
 	repoRenameCmd "github.com/cli/cli/v2/pkg/cmd/repo/rename"
 	repoDefaultCmd "github.com/cli/cli/v2/pkg/cmd/repo/setdefault"
@@ -54,6 +55,7 @@ func NewCmdRepo(f *cmdutil.Factory) *cobra.Command {
 		repoSyncCmd.NewCmdSync(f, nil),
 		repoEditCmd.NewCmdEdit(f, nil),
 		deployKeyCmd.NewCmdDeployKey(f),
+		licenseCmd.NewCmdLicense(f),
 		repoRenameCmd.NewCmdRename(f, nil),
 		repoArchiveCmd.NewCmdArchive(f, nil),
 		repoUnarchiveCmd.NewCmdUnarchive(f, nil),
diff --git a/pkg/cmd/repo/shared/repo.go b/pkg/cmd/repo/shared/repo.go
index b980098b8..b2633573e 100644
--- a/pkg/cmd/repo/shared/repo.go
+++ b/pkg/cmd/repo/shared/repo.go
@@ -1,8 +1,11 @@
 package shared
 
 import (
+	"net/http"
 	"regexp"
 	"strings"
+
+	"github.com/cli/cli/v2/api"
 )
 
 var invalidCharactersRE = regexp.MustCompile(`[^\w._-]+`)
@@ -12,3 +15,14 @@ func NormalizeRepoName(repoName string) string {
 	newName := invalidCharactersRE.ReplaceAllString(repoName, "-")
 	return strings.TrimSuffix(newName, ".git")
 }
+
+// ListLicenseTemplates uses API v3 here because license template isn't supported by GraphQL yet.
+func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
+	var licenseTemplates []api.License
+	client := api.NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
+	if err != nil {
+		return nil, err
+	}
+	return licenseTemplates, nil
+}

From c843dddf0d7d5665fe01789cfa262c8efb80b653 Mon Sep 17 00:00:00 2001
From: Miroma <136986257+its-miroma@users.noreply.github.com>
Date: Wed, 25 Sep 2024 21:49:20 +0200
Subject: [PATCH 084/301] Add GPG key instructions to appropriate sections

---
 docs/install_linux.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index fabaa19aa..882ee3976 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -49,6 +49,9 @@ Alternatively, install from the [community repository](https://packages.fedorapr
 sudo dnf install gh
 ```
 
+> [!NOTE]
+> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
+
 Upgrade:
 
 ```bash
@@ -91,6 +94,9 @@ sudo zypper ref
 sudo zypper update gh
 ```
 
+> [!NOTE]
+> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
+
 ## Manual installation
 
 * [Download release binaries][releases page] that match your platform; or

From 4de63ac75b99e42ac6d2bd6504056c26335f5a2b Mon Sep 17 00:00:00 2001
From: Miroma <136986257+its-miroma@users.noreply.github.com>
Date: Wed, 25 Sep 2024 21:49:35 +0200
Subject: [PATCH 085/301] Include `dnf5` commands

---
 docs/install_linux.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index 882ee3976..9be6aed9b 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -43,6 +43,20 @@ sudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.re
 sudo dnf install gh --repo gh-cli
 ```
 
+<details>
+<summary>Show dnf5 commands</summary>
+
+If you're using `dnf5`, commands will vary slightly:
+
+```bash
+sudo dnf5 install dnf5-plugins
+sudo dnf5 config-manager addrepo --from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo
+sudo dnf5 install gh --repo gh-cli
+```
+
+For more details, check out the [`dnf5 config-manager` documentation](https://dnf5.readthedocs.io/en/latest/dnf5_plugins/config-manager.8.html).
+</details>
+
 Alternatively, install from the [community repository](https://packages.fedoraproject.org/pkgs/gh/gh/):
 
 ```bash

From 21f0d9466ecb23b3e76585f8b9e93452d35ff296 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 10:40:22 -0600
Subject: [PATCH 086/301] Divide shared repo package and add queries tests

---
 pkg/cmd/repo/create/create.go                 |  15 +-
 pkg/cmd/repo/fork/fork.go                     |   4 +-
 pkg/cmd/repo/license/list/list.go             |   4 +-
 pkg/cmd/repo/shared/format/format.go          |  14 ++
 .../{repo_test.go => format/format_test.go}   |   2 +-
 pkg/cmd/repo/shared/queries/queries.go        |  19 +++
 pkg/cmd/repo/shared/queries/queries_test.go   | 136 ++++++++++++++++++
 pkg/cmd/repo/shared/repo.go                   |  28 ----
 8 files changed, 182 insertions(+), 40 deletions(-)
 create mode 100644 pkg/cmd/repo/shared/format/format.go
 rename pkg/cmd/repo/shared/{repo_test.go => format/format_test.go} (98%)
 create mode 100644 pkg/cmd/repo/shared/queries/queries.go
 create mode 100644 pkg/cmd/repo/shared/queries/queries_test.go
 delete mode 100644 pkg/cmd/repo/shared/repo.go

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 4b8b18c70..a1ff22863 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -19,7 +19,8 @@ import (
 	"github.com/cli/cli/v2/git"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/ghrepo"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/format"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -244,7 +245,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		licenses, err := shared.ListLicenseTemplates(httpClient, hostname)
+		licenses, err := queries.ListLicenseTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -317,9 +318,9 @@ func createFromScratch(opts *CreateOptions) error {
 			return err
 		}
 
-		targetRepo := shared.NormalizeRepoName(opts.Name)
+		targetRepo := format.NormalizeRepoName(opts.Name)
 		if idx := strings.IndexRune(opts.Name, '/'); idx > 0 {
-			targetRepo = opts.Name[0:idx+1] + shared.NormalizeRepoName(opts.Name[idx+1:])
+			targetRepo = opts.Name[0:idx+1] + format.NormalizeRepoName(opts.Name[idx+1:])
 		}
 		confirmed, err := opts.Prompter.Confirm(fmt.Sprintf(`This will create "%s" as a %s repository on GitHub. Continue?`, targetRepo, strings.ToLower(opts.Visibility)), true)
 		if err != nil {
@@ -476,9 +477,9 @@ func createFromTemplate(opts *CreateOptions) error {
 	}
 	templateRepoMainBranch := templateRepo.DefaultBranchRef.Name
 
-	targetRepo := shared.NormalizeRepoName(opts.Name)
+	targetRepo := format.NormalizeRepoName(opts.Name)
 	if idx := strings.IndexRune(opts.Name, '/'); idx > 0 {
-		targetRepo = opts.Name[0:idx+1] + shared.NormalizeRepoName(opts.Name[idx+1:])
+		targetRepo = opts.Name[0:idx+1] + format.NormalizeRepoName(opts.Name[idx+1:])
 	}
 	confirmed, err := opts.Prompter.Confirm(fmt.Sprintf(`This will create "%s" as a %s repository on GitHub. Continue?`, targetRepo, strings.ToLower(opts.Visibility)), true)
 	if err != nil {
@@ -830,7 +831,7 @@ func interactiveLicense(client *http.Client, hostname string, prompter iprompter
 		return "", nil
 	}
 
-	licenses, err := shared.ListLicenseTemplates(client, hostname)
+	licenses, err := queries.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/repo/fork/fork.go b/pkg/cmd/repo/fork/fork.go
index a49f5d567..274af3083 100644
--- a/pkg/cmd/repo/fork/fork.go
+++ b/pkg/cmd/repo/fork/fork.go
@@ -16,7 +16,7 @@ import (
 	"github.com/cli/cli/v2/git"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/ghrepo"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/format"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -225,7 +225,7 @@ func forkRun(opts *ForkOptions) error {
 	}
 
 	// Rename the new repo if necessary
-	if opts.ForkName != "" && !strings.EqualFold(forkedRepo.RepoName(), shared.NormalizeRepoName(opts.ForkName)) {
+	if opts.ForkName != "" && !strings.EqualFold(forkedRepo.RepoName(), format.NormalizeRepoName(opts.ForkName)) {
 		forkedRepo, err = api.RenameRepo(apiClient, forkedRepo, opts.ForkName)
 		if err != nil {
 			return fmt.Errorf("could not rename fork: %w", err)
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 48f8a74d9..4e52a5c6c 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -6,7 +6,7 @@ import (
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/tableprinter"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -67,7 +67,7 @@ func listRun(opts *ListOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	licenses, err := shared.ListLicenseTemplates(client, hostname)
+	licenses, err := queries.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/shared/format/format.go b/pkg/cmd/repo/shared/format/format.go
new file mode 100644
index 000000000..5d29201ec
--- /dev/null
+++ b/pkg/cmd/repo/shared/format/format.go
@@ -0,0 +1,14 @@
+package format
+
+import (
+	"regexp"
+	"strings"
+)
+
+var invalidCharactersRE = regexp.MustCompile(`[^\w._-]+`)
+
+// NormalizeRepoName takes in the repo name the user inputted and normalizes it using the same logic as GitHub (GitHub.com/new)
+func NormalizeRepoName(repoName string) string {
+	newName := invalidCharactersRE.ReplaceAllString(repoName, "-")
+	return strings.TrimSuffix(newName, ".git")
+}
diff --git a/pkg/cmd/repo/shared/repo_test.go b/pkg/cmd/repo/shared/format/format_test.go
similarity index 98%
rename from pkg/cmd/repo/shared/repo_test.go
rename to pkg/cmd/repo/shared/format/format_test.go
index 2e9251840..6a781ac02 100644
--- a/pkg/cmd/repo/shared/repo_test.go
+++ b/pkg/cmd/repo/shared/format/format_test.go
@@ -1,4 +1,4 @@
-package shared
+package format
 
 import (
 	"testing"
diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
new file mode 100644
index 000000000..27616bc00
--- /dev/null
+++ b/pkg/cmd/repo/shared/queries/queries.go
@@ -0,0 +1,19 @@
+package queries
+
+import (
+	"net/http"
+
+	"github.com/cli/cli/v2/api"
+)
+
+// ListLicenseTemplates fetches available repository templates.
+// It uses API v3 because license template isn't supported by GraphQL.
+func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
+	var licenseTemplates []api.License
+	client := api.NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
+	if err != nil {
+		return nil, err
+	}
+	return licenseTemplates, nil
+}
diff --git a/pkg/cmd/repo/shared/queries/queries_test.go b/pkg/cmd/repo/shared/queries/queries_test.go
new file mode 100644
index 000000000..7babbb264
--- /dev/null
+++ b/pkg/cmd/repo/shared/queries/queries_test.go
@@ -0,0 +1,136 @@
+package queries
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestListLicenseTemplates(t *testing.T) {
+	tests := []struct {
+		name         string
+		httpStubs    func(t *testing.T, reg *httpmock.Registry)
+		hostname     string
+		wantLicenses []api.License
+		wantErr      bool
+		wantErrMsg   string
+		httpClient   func() (*http.Client, error)
+	}{
+		{
+			name: "happy path",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses"),
+					httpmock.StringResponse(`[
+						{
+							"key": "mit",
+							"name": "MIT License",
+							"spdx_id": "MIT",
+							"url": "https://api.github.com/licenses/mit",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "lgpl-3.0",
+							"name": "GNU Lesser General Public License v3.0",
+							"spdx_id": "LGPL-3.0",
+							"url": "https://api.github.com/licenses/lgpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "mpl-2.0",
+							"name": "Mozilla Public License 2.0",
+							"spdx_id": "MPL-2.0",
+							"url": "https://api.github.com/licenses/mpl-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "agpl-3.0",
+							"name": "GNU Affero General Public License v3.0",
+							"spdx_id": "AGPL-3.0",
+							"url": "https://api.github.com/licenses/agpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "unlicense",
+							"name": "The Unlicense",
+							"spdx_id": "Unlicense",
+							"url": "https://api.github.com/licenses/unlicense",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "apache-2.0",
+							"name": "Apache License 2.0",
+							"spdx_id": "Apache-2.0",
+							"url": "https://api.github.com/licenses/apache-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "gpl-3.0",
+							"name": "GNU General Public License v3.0",
+							"spdx_id": "GPL-3.0",
+							"url": "https://api.github.com/licenses/gpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						}
+						]`,
+					))
+			},
+			hostname: "api.github.com",
+			wantLicenses: []api.License{
+				{
+					Key:  "mit",
+					Name: "MIT License",
+				},
+				{
+					Key:  "lgpl-3.0",
+					Name: "GNU Lesser General Public License v3.0",
+				},
+				{
+					Key:  "mpl-2.0",
+					Name: "Mozilla Public License 2.0",
+				},
+				{
+					Key:  "agpl-3.0",
+					Name: "GNU Affero General Public License v3.0",
+				},
+				{
+					Key:  "unlicense",
+					Name: "The Unlicense",
+				},
+				{
+					Key:  "apache-2.0",
+					Name: "Apache License 2.0",
+				},
+				{
+					Key:  "gpl-3.0",
+					Name: "GNU General Public License v3.0",
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotLicenses, err := ListLicenseTemplates(client, tt.hostname)
+			if !tt.wantErr {
+				assert.NoError(t, err, "Expected no error while fetching /licenses")
+			}
+			if tt.wantErr {
+				assert.Error(t, err, "Expected error while fetching /licenses")
+			}
+			assert.Equal(t, tt.wantLicenses, gotLicenses, "Licenses fetched is not as expected")
+		})
+	}
+}
diff --git a/pkg/cmd/repo/shared/repo.go b/pkg/cmd/repo/shared/repo.go
deleted file mode 100644
index b2633573e..000000000
--- a/pkg/cmd/repo/shared/repo.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package shared
-
-import (
-	"net/http"
-	"regexp"
-	"strings"
-
-	"github.com/cli/cli/v2/api"
-)
-
-var invalidCharactersRE = regexp.MustCompile(`[^\w._-]+`)
-
-// NormalizeRepoName takes in the repo name the user inputted and normalizes it using the same logic as GitHub (GitHub.com/new)
-func NormalizeRepoName(repoName string) string {
-	newName := invalidCharactersRE.ReplaceAllString(repoName, "-")
-	return strings.TrimSuffix(newName, ".git")
-}
-
-// ListLicenseTemplates uses API v3 here because license template isn't supported by GraphQL yet.
-func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
-	var licenseTemplates []api.License
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
-	if err != nil {
-		return nil, err
-	}
-	return licenseTemplates, nil
-}

From 1aa2a824bac6b549ab6e07aff3ae87ec1cd686aa Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 10:42:54 -0600
Subject: [PATCH 087/301] Remove json output option

Because the API query uses REST, the JSON exporter doesn't work as expected.
---
 pkg/cmd/repo/license/list/list.go | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 4e52a5c6c..8d369c4ee 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -18,15 +18,9 @@ type LicenseRenderer interface {
 
 type TableLicenseRenderer struct{}
 
-var licenseFields = []string{
-	"key",
-	"name",
-}
-
 type ListOptions struct {
 	IO         *iostreams.IOStreams
 	HTTPClient func() (*http.Client, error)
-	Exporter   cmdutil.Exporter
 	Config     func() (gh.Config, error)
 }
 
@@ -50,8 +44,6 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 			return listRun(opts)
 		},
 	}
-	// cmdutil.AddFormatFlags(cmd, &opts.Exporter)
-	cmdutil.AddJSONFlags(cmd, &opts.Exporter, licenseFields)
 	return cmd
 }
 
@@ -76,10 +68,6 @@ func listRun(opts *ListOptions) error {
 		return cmdutil.NewNoResultsError("no licenses found")
 	}
 
-	if opts.Exporter != nil {
-		return opts.Exporter.Write(opts.IO, licenses)
-	}
-
 	r := &TableLicenseRenderer{}
 	return r.Render(licenses, opts)
 }

From 2f608e3772118d14c926a8778dd5acc1fc2b358f Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 11:46:37 -0600
Subject: [PATCH 088/301] Cleanup rendering and tests

---
 pkg/cmd/repo/license/list/list.go      | 11 +----
 pkg/cmd/repo/license/list/list_test.go | 67 +-------------------------
 2 files changed, 4 insertions(+), 74 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 8d369c4ee..7b931811f 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -12,12 +12,6 @@ import (
 	"github.com/spf13/cobra"
 )
 
-type LicenseRenderer interface {
-	Render([]api.License, ListOptions) error
-}
-
-type TableLicenseRenderer struct{}
-
 type ListOptions struct {
 	IO         *iostreams.IOStreams
 	HTTPClient func() (*http.Client, error)
@@ -68,11 +62,10 @@ func listRun(opts *ListOptions) error {
 		return cmdutil.NewNoResultsError("no licenses found")
 	}
 
-	r := &TableLicenseRenderer{}
-	return r.Render(licenses, opts)
+	return renderLicenseTemplatesTable(licenses, opts)
 }
 
-func (r *TableLicenseRenderer) Render(licenses []api.License, opts *ListOptions) error {
+func renderLicenseTemplatesTable(licenses []api.License, opts *ListOptions) error {
 	t := tableprinter.New(opts.IO, tableprinter.WithHeader("KEY", "NAME"))
 	for _, l := range licenses {
 		t.AddField(l.Key)
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index c84e3fff8..43d47c2df 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/MakeNowJust/heredoc"
-	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/config"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/pkg/cmdutil"
@@ -24,14 +23,14 @@ func TestNewCmdList(t *testing.T) {
 		tty     bool
 	}{
 		{
-			name:    "no arguments",
+			name:    "happy path no arguments",
 			args:    []string{},
 			wantErr: false,
 			tty:     false,
 		},
 		{
 			name:    "too many arguments",
-			args:    []string{"foo", "bar"},
+			args:    []string{"foo"},
 			wantErr: true,
 		},
 	}
@@ -63,68 +62,6 @@ func TestNewCmdList(t *testing.T) {
 	}
 }
 
-func TestTableLicenseRenderer(t *testing.T) {
-	tests := []struct {
-		name       string
-		opts       ListOptions
-		isTTY      bool
-		wantStdout string
-		wantErr    bool
-		licenses   []api.License
-	}{
-		{
-			name:  "licenses + tty",
-			opts:  ListOptions{},
-			isTTY: true,
-			wantStdout: heredoc.Doc(`
-			KEY       NAME
-			mit       MIT License
-			lgpl-3.0  GNU Lesser General Public License v3.0
-			`),
-			wantErr: false,
-			licenses: []api.License{
-				{
-					Key:  "mit",
-					Name: "MIT License",
-				},
-				{
-					Key:  "lgpl-3.0",
-					Name: "GNU Lesser General Public License v3.0",
-				},
-			},
-		},
-		{
-			name:  "no licenses + tty",
-			opts:  ListOptions{},
-			isTTY: true,
-			wantStdout: heredoc.Doc(`
-			KEY  NAME
-			`),
-			wantErr:  false,
-			licenses: []api.License{},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ios, _, stdout, _ := iostreams.Test()
-			ios.SetStdoutTTY(tt.isTTY)
-			ios.SetStdinTTY(tt.isTTY)
-			ios.SetStderrTTY(tt.isTTY)
-			tt.opts.IO = ios
-
-			r := &TableLicenseRenderer{}
-			err := r.Render(tt.licenses, &tt.opts)
-
-			if !tt.wantErr {
-				assert.NoError(t, err, "Expected no error while rendering table")
-			}
-
-			assert.Equal(t, tt.wantStdout, stdout.String(), "Rendered table differs from expected")
-
-		})
-	}
-}
-
 func TestListRun(t *testing.T) {
 	tests := []struct {
 		name       string

From ac779ba82a43df8ba601e7222417b84f675dc69b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 11:48:48 -0600
Subject: [PATCH 089/301] fix output capitalization

---
 pkg/cmd/repo/license/list/list.go      | 2 +-
 pkg/cmd/repo/license/list/list_test.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 7b931811f..573bd4e29 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -59,7 +59,7 @@ func listRun(opts *ListOptions) error {
 	}
 
 	if len(licenses) == 0 {
-		return cmdutil.NewNoResultsError("no licenses found")
+		return cmdutil.NewNoResultsError("No licenses found")
 	}
 
 	return renderLicenseTemplatesTable(licenses, opts)
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index 43d47c2df..a740b0f83 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -157,7 +157,7 @@ func TestListRun(t *testing.T) {
 			wantStdout: "",
 			wantStderr: "",
 			wantErr:    true,
-			errMsg:     "no licenses found",
+			errMsg:     "No licenses found",
 			opts:       &ListOptions{},
 		},
 	}

From 2b4464a3af1dc9d15fe4520d1cec89e5b70586b6 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 11:49:09 -0600
Subject: [PATCH 090/301] Fix ListLicenseTemplates doc

---
 pkg/cmd/repo/shared/queries/queries.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
index 27616bc00..fdb238fb4 100644
--- a/pkg/cmd/repo/shared/queries/queries.go
+++ b/pkg/cmd/repo/shared/queries/queries.go
@@ -6,7 +6,7 @@ import (
 	"github.com/cli/cli/v2/api"
 )
 
-// ListLicenseTemplates fetches available repository templates.
+// ListLicenseTemplates fetches available repository license templates.
 // It uses API v3 because license template isn't supported by GraphQL.
 func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
 	var licenseTemplates []api.License

From 25cdce2cecf7aef00f1d0e768d68b4aff1120094 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 11:59:15 -0600
Subject: [PATCH 091/301] Update license table headings and tests

---
 pkg/cmd/repo/license/list/list.go      |  2 +-
 pkg/cmd/repo/license/list/list_test.go | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 573bd4e29..b1d2b3578 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -66,7 +66,7 @@ func listRun(opts *ListOptions) error {
 }
 
 func renderLicenseTemplatesTable(licenses []api.License, opts *ListOptions) error {
-	t := tableprinter.New(opts.IO, tableprinter.WithHeader("KEY", "NAME"))
+	t := tableprinter.New(opts.IO, tableprinter.WithHeader("LICENSE KEY", "LICENSE NAME"))
 	for _, l := range licenses {
 		t.AddField(l.Key)
 		t.AddField(l.Name)
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index a740b0f83..711a7e728 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -133,14 +133,14 @@ func TestListRun(t *testing.T) {
 					))
 			},
 			wantStdout: heredoc.Doc(`
-				KEY         NAME
-				mit         MIT License
-				lgpl-3.0    GNU Lesser General Public License v3.0
-				mpl-2.0     Mozilla Public License 2.0
-				agpl-3.0    GNU Affero General Public License v3.0
-				unlicense   The Unlicense
-				apache-2.0  Apache License 2.0
-				gpl-3.0     GNU General Public License v3.0
+				LICENSE KEY  LICENSE NAME
+				mit          MIT License
+				lgpl-3.0     GNU Lesser General Public License v3.0
+				mpl-2.0      Mozilla Public License 2.0
+				agpl-3.0     GNU Affero General Public License v3.0
+				unlicense    The Unlicense
+				apache-2.0   Apache License 2.0
+				gpl-3.0      GNU General Public License v3.0
 				`),
 			wantStderr: "",
 			opts:       &ListOptions{},
@@ -189,8 +189,8 @@ func TestListRun(t *testing.T) {
 				return
 			}
 
-			assert.Equal(t, tt.wantStdout, stdout.String(), "Stdout differs from expected")
-			assert.Equal(t, tt.wantStderr, stderr.String(), "Stderr differs from expected")
+			assert.Equal(t, tt.wantStdout, stdout.String())
+			assert.Equal(t, tt.wantStderr, stderr.String())
 		})
 	}
 }

From 038b57c866ba0f0599df7317d54a2ef4b0e171c3 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 12:29:56 -0600
Subject: [PATCH 092/301] implement gitignore list

---
 pkg/cmd/repo/create/create.go               |   4 +-
 pkg/cmd/repo/create/http.go                 |  11 --
 pkg/cmd/repo/gitignore/gitignore.go         |  18 ++
 pkg/cmd/repo/gitignore/list/list.go         |  75 ++++++++
 pkg/cmd/repo/gitignore/list/list_test.go    | 190 ++++++++++++++++++++
 pkg/cmd/repo/license/license.go             |   2 +-
 pkg/cmd/repo/license/list/list.go           |  14 +-
 pkg/cmd/repo/license/list/list_test.go      |   4 +-
 pkg/cmd/repo/repo.go                        |   2 +
 pkg/cmd/repo/shared/queries/queries.go      |  12 ++
 pkg/cmd/repo/shared/queries/queries_test.go |  97 ++++++++++
 11 files changed, 406 insertions(+), 23 deletions(-)
 create mode 100644 pkg/cmd/repo/gitignore/gitignore.go
 create mode 100644 pkg/cmd/repo/gitignore/list/list.go
 create mode 100644 pkg/cmd/repo/gitignore/list/list_test.go

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index a1ff22863..760757928 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -228,7 +228,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		results, err := listGitIgnoreTemplates(httpClient, hostname)
+		results, err := queries.ListGitIgnoreTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -812,7 +812,7 @@ func interactiveGitIgnore(client *http.Client, hostname string, prompter iprompt
 		return "", nil
 	}
 
-	templates, err := listGitIgnoreTemplates(client, hostname)
+	templates, err := queries.ListGitIgnoreTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/repo/create/http.go b/pkg/cmd/repo/create/http.go
index ba99c3e4c..725fc48c5 100644
--- a/pkg/cmd/repo/create/http.go
+++ b/pkg/cmd/repo/create/http.go
@@ -339,17 +339,6 @@ func listTemplateRepositories(client *http.Client, hostname, owner string) ([]ap
 	return templateRepositories, nil
 }
 
-// listGitIgnoreTemplates uses API v3 here because gitignore template isn't supported by GraphQL yet.
-func listGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
-	var gitIgnoreTemplates []string
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
-	if err != nil {
-		return []string{}, err
-	}
-	return gitIgnoreTemplates, nil
-}
-
 // Returns the current username and any orgs that user is a member of.
 func userAndOrgs(httpClient *http.Client, hostname string) (string, []string, error) {
 	client := api.NewClientFromHTTP(httpClient)
diff --git a/pkg/cmd/repo/gitignore/gitignore.go b/pkg/cmd/repo/gitignore/gitignore.go
new file mode 100644
index 000000000..260b506c5
--- /dev/null
+++ b/pkg/cmd/repo/gitignore/gitignore.go
@@ -0,0 +1,18 @@
+package gitignore
+
+import (
+	cmdList "github.com/cli/cli/v2/pkg/cmd/repo/gitignore/list"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/spf13/cobra"
+)
+
+func NewCmdGitIgnore(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "gitignore <command>",
+		Short: "View available repository .gitignore template",
+	}
+
+	cmd.AddCommand(cmdList.NewCmdList(f, nil))
+
+	return cmd
+}
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
new file mode 100644
index 000000000..7de608566
--- /dev/null
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -0,0 +1,75 @@
+package list
+
+import (
+	"net/http"
+
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/internal/tableprinter"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/spf13/cobra"
+)
+
+type ListOptions struct {
+	IO         *iostreams.IOStreams
+	HTTPClient func() (*http.Client, error)
+	Config     func() (gh.Config, error)
+}
+
+func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Command {
+	opts := &ListOptions{
+		IO:         f.IOStreams,
+		HTTPClient: f.HttpClient,
+		Config:     f.Config,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "list",
+		Short:   "List available repository .gitignore templates",
+		Aliases: []string{"ls"},
+		Args:    cmdutil.ExactArgs(0, "gh repo gitignore list takes no arguments"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+
+			if runF != nil {
+				return runF(opts)
+			}
+			return listRun(opts)
+		},
+	}
+	return cmd
+}
+
+func listRun(opts *ListOptions) error {
+	client, err := opts.HTTPClient()
+	if err != nil {
+		return err
+	}
+
+	cfg, err := opts.Config()
+	if err != nil {
+		return err
+	}
+
+	hostname, _ := cfg.Authentication().DefaultHost()
+	gitIgnoreTemplates, err := queries.ListGitIgnoreTemplates(client, hostname)
+	if err != nil {
+		return err
+	}
+
+	if len(gitIgnoreTemplates) == 0 {
+		return cmdutil.NewNoResultsError("No .gitignore templates found")
+	}
+
+	return renderGitIgnoreTemplatesTable(gitIgnoreTemplates, opts)
+}
+
+func renderGitIgnoreTemplatesTable(gitIgnoreTemplates []string, opts *ListOptions) error {
+	t := tableprinter.New(opts.IO, tableprinter.WithHeader("GITIGNORE"))
+	for _, gt := range gitIgnoreTemplates {
+		t.AddField(gt)
+		t.EndRow()
+	}
+
+	return t.Render()
+}
diff --git a/pkg/cmd/repo/gitignore/list/list_test.go b/pkg/cmd/repo/gitignore/list/list_test.go
new file mode 100644
index 000000000..d7a0ef9e2
--- /dev/null
+++ b/pkg/cmd/repo/gitignore/list/list_test.go
@@ -0,0 +1,190 @@
+package list
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewCmdList(t *testing.T) {
+	tests := []struct {
+		name    string
+		args    []string
+		wantErr bool
+		tty     bool
+	}{
+		{
+			name:    "happy path no arguments",
+			args:    []string{},
+			wantErr: false,
+			tty:     false,
+		},
+		{
+			name:    "too many arguments",
+			args:    []string{"foo"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ios, _, _, _ := iostreams.Test()
+			ios.SetStdinTTY(tt.tty)
+			ios.SetStdoutTTY(tt.tty)
+			ios.SetStderrTTY(tt.tty)
+
+			f := &cmdutil.Factory{
+				IOStreams: ios,
+			}
+			cmd := NewCmdList(f, func(*ListOptions) error {
+				return nil
+			})
+			cmd.SetArgs(tt.args)
+			cmd.SetIn(&bytes.Buffer{})
+			cmd.SetOut(&bytes.Buffer{})
+			cmd.SetErr(&bytes.Buffer{})
+
+			_, err := cmd.ExecuteC()
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestListRun(t *testing.T) {
+	tests := []struct {
+		name       string
+		opts       *ListOptions
+		isTTY      bool
+		httpStubs  func(t *testing.T, reg *httpmock.Registry)
+		wantStdout string
+		wantStderr string
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name:  "gitignore list tty",
+			isTTY: true,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates"),
+					httpmock.StringResponse(`[
+						"AL",
+						"Actionscript",
+						"Ada",
+						"Agda",
+						"Android",
+						"AppEngine",
+						"AppceleratorTitanium",
+						"ArchLinuxPackages",
+						"Autotools",
+						"Ballerina",
+						"C",
+						"C++",
+						"CFWheels",
+						"CMake",
+						"CUDA",
+						"CakePHP",
+						"ChefCookbook",
+						"Clojure",
+						"CodeIgniter",
+						"CommonLisp",
+						"Composer",
+						"Concrete5",
+						"Coq",
+						"CraftCMS",
+						"D"
+						]`,
+					))
+			},
+			wantStdout: heredoc.Doc(`
+				GITIGNORE
+				AL
+				Actionscript
+				Ada
+				Agda
+				Android
+				AppEngine
+				AppceleratorTitanium
+				ArchLinuxPackages
+				Autotools
+				Ballerina
+				C
+				C++
+				CFWheels
+				CMake
+				CUDA
+				CakePHP
+				ChefCookbook
+				Clojure
+				CodeIgniter
+				CommonLisp
+				Composer
+				Concrete5
+				Coq
+				CraftCMS
+				D
+				`),
+			wantStderr: "",
+			opts:       &ListOptions{},
+		},
+		{
+			name:  "gitignore list no .gitignore templates tty",
+			isTTY: true,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates"),
+					httpmock.StringResponse(`[]`),
+				)
+			},
+			wantStdout: "",
+			wantStderr: "",
+			wantErr:    true,
+			errMsg:     "No .gitignore templates found",
+			opts:       &ListOptions{},
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.opts.Config = func() (gh.Config, error) {
+			return config.NewBlankConfig(), nil
+		}
+		tt.opts.HTTPClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		ios, _, stdout, stderr := iostreams.Test()
+		ios.SetStdoutTTY(tt.isTTY)
+		ios.SetStdinTTY(tt.isTTY)
+		ios.SetStderrTTY(tt.isTTY)
+		tt.opts.IO = ios
+
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			err := listRun(tt.opts)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, tt.errMsg, err.Error())
+				return
+			}
+
+			assert.Equal(t, tt.wantStdout, stdout.String())
+			assert.Equal(t, tt.wantStderr, stderr.String())
+		})
+	}
+}
diff --git a/pkg/cmd/repo/license/license.go b/pkg/cmd/repo/license/license.go
index 84896f2cd..a28b14f0b 100644
--- a/pkg/cmd/repo/license/license.go
+++ b/pkg/cmd/repo/license/license.go
@@ -9,7 +9,7 @@ import (
 func NewCmdLicense(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "license <command>",
-		Short: "View available repository license options",
+		Short: "View available repository license templates",
 	}
 
 	cmd.AddCommand(cmdList.NewCmdList(f, nil))
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index b1d2b3578..2ef9e7204 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -27,7 +27,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:     "list",
-		Short:   "List available repository license options",
+		Short:   "List available repository license templates",
 		Aliases: []string{"ls"},
 		Args:    cmdutil.ExactArgs(0, "gh repo license list takes no arguments"),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -53,21 +53,21 @@ func listRun(opts *ListOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	licenses, err := queries.ListLicenseTemplates(client, hostname)
+	licenseTemplates, err := queries.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return err
 	}
 
-	if len(licenses) == 0 {
-		return cmdutil.NewNoResultsError("No licenses found")
+	if len(licenseTemplates) == 0 {
+		return cmdutil.NewNoResultsError("No repository license templates found")
 	}
 
-	return renderLicenseTemplatesTable(licenses, opts)
+	return renderLicenseTemplatesTable(licenseTemplates, opts)
 }
 
-func renderLicenseTemplatesTable(licenses []api.License, opts *ListOptions) error {
+func renderLicenseTemplatesTable(licenseTemplates []api.License, opts *ListOptions) error {
 	t := tableprinter.New(opts.IO, tableprinter.WithHeader("LICENSE KEY", "LICENSE NAME"))
-	for _, l := range licenses {
+	for _, l := range licenseTemplates {
 		t.AddField(l.Key)
 		t.AddField(l.Name)
 		t.EndRow()
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index 711a7e728..b01d64d9a 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -146,7 +146,7 @@ func TestListRun(t *testing.T) {
 			opts:       &ListOptions{},
 		},
 		{
-			name:  "license list no licenses tty",
+			name:  "license list no license templates tty",
 			isTTY: true,
 			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
 				reg.Register(
@@ -157,7 +157,7 @@ func TestListRun(t *testing.T) {
 			wantStdout: "",
 			wantStderr: "",
 			wantErr:    true,
-			errMsg:     "No licenses found",
+			errMsg:     "No repository license templates found",
 			opts:       &ListOptions{},
 		},
 	}
diff --git a/pkg/cmd/repo/repo.go b/pkg/cmd/repo/repo.go
index 611ef49ea..14a4bf49c 100644
--- a/pkg/cmd/repo/repo.go
+++ b/pkg/cmd/repo/repo.go
@@ -11,6 +11,7 @@ import (
 	repoEditCmd "github.com/cli/cli/v2/pkg/cmd/repo/edit"
 	repoForkCmd "github.com/cli/cli/v2/pkg/cmd/repo/fork"
 	gardenCmd "github.com/cli/cli/v2/pkg/cmd/repo/garden"
+	gitIgnoreCmd "github.com/cli/cli/v2/pkg/cmd/repo/gitignore"
 	licenseCmd "github.com/cli/cli/v2/pkg/cmd/repo/license"
 	repoListCmd "github.com/cli/cli/v2/pkg/cmd/repo/list"
 	repoRenameCmd "github.com/cli/cli/v2/pkg/cmd/repo/rename"
@@ -56,6 +57,7 @@ func NewCmdRepo(f *cmdutil.Factory) *cobra.Command {
 		repoEditCmd.NewCmdEdit(f, nil),
 		deployKeyCmd.NewCmdDeployKey(f),
 		licenseCmd.NewCmdLicense(f),
+		gitIgnoreCmd.NewCmdGitIgnore(f),
 		repoRenameCmd.NewCmdRename(f, nil),
 		repoArchiveCmd.NewCmdArchive(f, nil),
 		repoUnarchiveCmd.NewCmdUnarchive(f, nil),
diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
index fdb238fb4..dea02de6c 100644
--- a/pkg/cmd/repo/shared/queries/queries.go
+++ b/pkg/cmd/repo/shared/queries/queries.go
@@ -17,3 +17,15 @@ func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.Licen
 	}
 	return licenseTemplates, nil
 }
+
+// ListGitIgnoreTemplates fetches available repository gitignore templates.
+// It uses API v3 here because gitignore template isn't supported by GraphQL.
+func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
+	var gitIgnoreTemplates []string
+	client := api.NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
+	if err != nil {
+		return []string{}, err
+	}
+	return gitIgnoreTemplates, nil
+}
diff --git a/pkg/cmd/repo/shared/queries/queries_test.go b/pkg/cmd/repo/shared/queries/queries_test.go
index 7babbb264..097467cfa 100644
--- a/pkg/cmd/repo/shared/queries/queries_test.go
+++ b/pkg/cmd/repo/shared/queries/queries_test.go
@@ -134,3 +134,100 @@ func TestListLicenseTemplates(t *testing.T) {
 		})
 	}
 }
+
+func TestListGitIgnoreTemplates(t *testing.T) {
+	tests := []struct {
+		name                   string
+		httpStubs              func(t *testing.T, reg *httpmock.Registry)
+		wantGitIgnoreTemplates []string
+		wantErr                bool
+		wantErrMsg             string
+		httpClient             func() (*http.Client, error)
+	}{
+		{
+			name: "happy path",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates"),
+					httpmock.StringResponse(`[
+						"AL",
+						"Actionscript",
+						"Ada",
+						"Agda",
+						"Android",
+						"AppEngine",
+						"AppceleratorTitanium",
+						"ArchLinuxPackages",
+						"Autotools",
+						"Ballerina",
+						"C",
+						"C++",
+						"CFWheels",
+						"CMake",
+						"CUDA",
+						"CakePHP",
+						"ChefCookbook",
+						"Clojure",
+						"CodeIgniter",
+						"CommonLisp",
+						"Composer",
+						"Concrete5",
+						"Coq",
+						"CraftCMS",
+						"D"
+						]`,
+					))
+			},
+			wantGitIgnoreTemplates: []string{
+				"AL",
+				"Actionscript",
+				"Ada",
+				"Agda",
+				"Android",
+				"AppEngine",
+				"AppceleratorTitanium",
+				"ArchLinuxPackages",
+				"Autotools",
+				"Ballerina",
+				"C",
+				"C++",
+				"CFWheels",
+				"CMake",
+				"CUDA",
+				"CakePHP",
+				"ChefCookbook",
+				"Clojure",
+				"CodeIgniter",
+				"CommonLisp",
+				"Composer",
+				"Concrete5",
+				"Coq",
+				"CraftCMS",
+				"D",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, "api.github.com")
+			if !tt.wantErr {
+				assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
+			}
+			if tt.wantErr {
+				assert.Error(t, err, "Expected error while fetching /gitignore/templates")
+			}
+			assert.Equal(t, tt.wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
+		})
+	}
+}

From c76acb6aff9c100b73edfe5ca1b9c6c9f599e06b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 17:26:04 -0600
Subject: [PATCH 093/301] Implement gitignore view

---
 api/queries_repo.go                         |   5 +
 pkg/cmd/repo/gitignore/gitignore.go         |   4 +-
 pkg/cmd/repo/gitignore/list/list.go         |  11 +-
 pkg/cmd/repo/gitignore/list/list_test.go    |   2 +-
 pkg/cmd/repo/gitignore/view/view.go         | 102 +++++++++++
 pkg/cmd/repo/gitignore/view/view_test.go    | 186 ++++++++++++++++++++
 pkg/cmd/repo/license/list/list.go           |   7 +
 pkg/cmd/repo/shared/queries/queries.go      |  13 ++
 pkg/cmd/repo/shared/queries/queries_test.go |  54 ++++++
 9 files changed, 380 insertions(+), 4 deletions(-)
 create mode 100644 pkg/cmd/repo/gitignore/view/view.go
 create mode 100644 pkg/cmd/repo/gitignore/view/view_test.go

diff --git a/api/queries_repo.go b/api/queries_repo.go
index 32cb5ff3b..2e2f711ca 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -211,6 +211,11 @@ type License struct {
 	Name string `json:"name"`
 }
 
+type GitIgnore struct {
+	Name   string `json:"name"`
+	Source string `json:"source"`
+}
+
 // RepoOwner is the login name of the owner
 func (r Repository) RepoOwner() string {
 	return r.Owner.Login
diff --git a/pkg/cmd/repo/gitignore/gitignore.go b/pkg/cmd/repo/gitignore/gitignore.go
index 260b506c5..8a9b8468e 100644
--- a/pkg/cmd/repo/gitignore/gitignore.go
+++ b/pkg/cmd/repo/gitignore/gitignore.go
@@ -2,6 +2,7 @@ package gitignore
 
 import (
 	cmdList "github.com/cli/cli/v2/pkg/cmd/repo/gitignore/list"
+	cmdView "github.com/cli/cli/v2/pkg/cmd/repo/gitignore/view"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/spf13/cobra"
 )
@@ -9,10 +10,11 @@ import (
 func NewCmdGitIgnore(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "gitignore <command>",
-		Short: "View available repository .gitignore template",
+		Short: "List and view available repository gitignore templates",
 	}
 
 	cmd.AddCommand(cmdList.NewCmdList(f, nil))
+	cmd.AddCommand(cmdView.NewCmdView(f, nil))
 
 	return cmd
 }
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index 7de608566..cddaeea83 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -1,6 +1,7 @@
 package list
 
 import (
+	"fmt"
 	"net/http"
 
 	"github.com/cli/cli/v2/internal/gh"
@@ -26,7 +27,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:     "list",
-		Short:   "List available repository .gitignore templates",
+		Short:   "List available repository gitignore templates",
 		Aliases: []string{"ls"},
 		Args:    cmdutil.ExactArgs(0, "gh repo gitignore list takes no arguments"),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -51,6 +52,12 @@ func listRun(opts *ListOptions) error {
 		return err
 	}
 
+	if err := opts.IO.StartPager(); err == nil {
+		defer opts.IO.StopPager()
+	} else {
+		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	}
+
 	hostname, _ := cfg.Authentication().DefaultHost()
 	gitIgnoreTemplates, err := queries.ListGitIgnoreTemplates(client, hostname)
 	if err != nil {
@@ -58,7 +65,7 @@ func listRun(opts *ListOptions) error {
 	}
 
 	if len(gitIgnoreTemplates) == 0 {
-		return cmdutil.NewNoResultsError("No .gitignore templates found")
+		return cmdutil.NewNoResultsError("No gitignore templates found")
 	}
 
 	return renderGitIgnoreTemplatesTable(gitIgnoreTemplates, opts)
diff --git a/pkg/cmd/repo/gitignore/list/list_test.go b/pkg/cmd/repo/gitignore/list/list_test.go
index d7a0ef9e2..3a68ab511 100644
--- a/pkg/cmd/repo/gitignore/list/list_test.go
+++ b/pkg/cmd/repo/gitignore/list/list_test.go
@@ -151,7 +151,7 @@ func TestListRun(t *testing.T) {
 			wantStdout: "",
 			wantStderr: "",
 			wantErr:    true,
-			errMsg:     "No .gitignore templates found",
+			errMsg:     "No gitignore templates found",
 			opts:       &ListOptions{},
 		},
 	}
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
new file mode 100644
index 000000000..917a66481
--- /dev/null
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -0,0 +1,102 @@
+package view
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/spf13/cobra"
+)
+
+type ViewOptions struct {
+	IO         *iostreams.IOStreams
+	HTTPClient func() (*http.Client, error)
+	Config     func() (gh.Config, error)
+	Template   string
+}
+
+func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Command {
+	opts := &ViewOptions{
+		IO:         f.IOStreams,
+		HTTPClient: f.HttpClient,
+		Config:     f.Config,
+		Template:   "",
+	}
+
+	cmd := &cobra.Command{
+		Use:   "view <template>",
+		Short: "View an available repository gitignore template",
+		Long: heredoc.Docf(`
+		View an available repository %[1]s.gitignore%[1]s template.
+		
+		%[1]s<template>%[1]s is a case-sensitive %[1]s.gitignore%[1]s template name.
+		`, "`"),
+		Args: cmdutil.ExactArgs(1, "gh repo gitignore view only takes a single template argument"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			opts.Template = args[0]
+			if runF != nil {
+				return runF(opts)
+			}
+			return viewRun(opts)
+		},
+	}
+	return cmd
+}
+
+func viewRun(opts *ViewOptions) error {
+	if opts.Template == "" {
+		return errors.New("no template provided")
+	}
+
+	client, err := opts.HTTPClient()
+	if err != nil {
+		return err
+	}
+
+	cfg, err := opts.Config()
+	if err != nil {
+		return err
+	}
+
+	if err := opts.IO.StartPager(); err == nil {
+		defer opts.IO.StopPager()
+	} else {
+		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	}
+
+	hostname, _ := cfg.Authentication().DefaultHost()
+	gitIgnore, err := queries.GitIgnoreTemplate(client, hostname, opts.Template)
+	if err != nil {
+		if strings.Contains(err.Error(), "HTTP 404") {
+			return fmt.Errorf("'%s' is not a valid gitignore template. Run `gh repo gitignore list` for options", opts.Template)
+		}
+		return err
+	}
+
+	return renderGitIgnore(gitIgnore, opts)
+}
+
+func renderGitIgnore(licenseTemplate api.GitIgnore, opts *ViewOptions) error {
+	// I wanted to render this in a markdown code block and benefit
+	// from .gitignore syntax highlighting. But, the upstream syntax highlighter
+	// does not currently support .gitignore.
+	// So, I just add a newline and print the content as is instead.
+	// Ref: https://github.com/alecthomas/chroma/pull/755
+	var out string
+	if opts.IO.IsStdoutTTY() {
+		out = "\n"
+	}
+	out += licenseTemplate.Source
+	_, err := opts.IO.Out.Write([]byte(out))
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/cmd/repo/gitignore/view/view_test.go b/pkg/cmd/repo/gitignore/view/view_test.go
new file mode 100644
index 000000000..3ab1bb25b
--- /dev/null
+++ b/pkg/cmd/repo/gitignore/view/view_test.go
@@ -0,0 +1,186 @@
+package view
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestViewRun(t *testing.T) {
+	tests := []struct {
+		name       string
+		opts       *ViewOptions
+		isTTY      bool
+		httpStubs  func(t *testing.T, reg *httpmock.Registry)
+		wantStdout string
+		wantStderr string
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name:    "No template",
+			opts:    &ViewOptions{},
+			wantErr: true,
+			errMsg:  "no template provided",
+		},
+		{
+			name:    "happy path with template",
+			opts:    &ViewOptions{Template: "Go"},
+			wantErr: false,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates/Go"),
+					httpmock.StringResponse(`{
+						"name": "Go",
+						"source": "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n"
+						}`,
+					))
+			},
+			wantStdout: heredoc.Doc(`# If you prefer the allow list template instead of the deny list, see community template:
+				# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+				#
+				# Binaries for programs and plugins
+				*.exe
+				*.exe~
+				*.dll
+				*.so
+				*.dylib
+
+				# Test binary, built with go test -c
+				*.test
+
+				# Output of the go coverage tool, specifically when used with LiteIDE
+				*.out
+
+				# Dependency directories (remove the comment below to include it)
+				# vendor/
+
+				# Go workspace file
+				go.work
+				go.work.sum
+
+				# env file
+				.env
+				`),
+		},
+		{
+			name:    "non-existent template",
+			opts:    &ViewOptions{Template: "non-existent"},
+			wantErr: true,
+			errMsg:  "'non-existent' is not a valid gitignore template. Run `gh repo gitignore list` for options",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates/non-existent"),
+					httpmock.StatusStringResponse(404, `{
+						"message": "Not Found",
+						"documentation_url": "https://docs.github.com/v3/gitignore",
+						"status": "404"
+						}`,
+					))
+			},
+		},
+	}
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.opts.Config = func() (gh.Config, error) {
+			return config.NewBlankConfig(), nil
+		}
+		tt.opts.HTTPClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		ios, _, stdout, stderr := iostreams.Test()
+		ios.SetStdoutTTY(tt.isTTY)
+		ios.SetStdinTTY(tt.isTTY)
+		ios.SetStderrTTY(tt.isTTY)
+		tt.opts.IO = ios
+
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			err := viewRun(tt.opts)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, tt.errMsg, err.Error())
+				return
+			}
+
+			assert.Equal(t, tt.wantStdout, stdout.String())
+			assert.Equal(t, tt.wantStderr, stderr.String())
+		})
+	}
+}
+
+func TestNewCmdView(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		wantErr  bool
+		wantOpts *ViewOptions
+		tty      bool
+	}{
+		{
+			name:    "No template",
+			args:    []string{},
+			wantErr: true,
+			wantOpts: &ViewOptions{
+				Template: "",
+			},
+		},
+		{
+			name:    "Happy path single template",
+			args:    []string{"Go"},
+			wantErr: false,
+			wantOpts: &ViewOptions{
+				Template: "Go",
+			},
+		},
+		{
+			name:    "Happy path too many templates",
+			args:    []string{"Go", "Ruby"},
+			wantErr: true,
+			wantOpts: &ViewOptions{
+				Template: "",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ios, _, _, _ := iostreams.Test()
+			ios.SetStdinTTY(tt.tty)
+			ios.SetStdoutTTY(tt.tty)
+			ios.SetStderrTTY(tt.tty)
+
+			f := &cmdutil.Factory{
+				IOStreams: ios,
+			}
+			cmd := NewCmdView(f, func(*ViewOptions) error {
+				return nil
+			})
+			cmd.SetArgs(tt.args)
+			cmd.SetIn(&bytes.Buffer{})
+			cmd.SetOut(&bytes.Buffer{})
+			cmd.SetErr(&bytes.Buffer{})
+
+			_, err := cmd.ExecuteC()
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+
+			assert.Equal(t, tt.wantOpts.Template, tt.wantOpts.Template)
+		})
+	}
+}
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 2ef9e7204..ebb23bffb 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -1,6 +1,7 @@
 package list
 
 import (
+	"fmt"
 	"net/http"
 
 	"github.com/cli/cli/v2/api"
@@ -52,6 +53,12 @@ func listRun(opts *ListOptions) error {
 		return err
 	}
 
+	if err := opts.IO.StartPager(); err == nil {
+		defer opts.IO.StopPager()
+	} else {
+		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	}
+
 	hostname, _ := cfg.Authentication().DefaultHost()
 	licenseTemplates, err := queries.ListLicenseTemplates(client, hostname)
 	if err != nil {
diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
index dea02de6c..8b5185823 100644
--- a/pkg/cmd/repo/shared/queries/queries.go
+++ b/pkg/cmd/repo/shared/queries/queries.go
@@ -1,6 +1,7 @@
 package queries
 
 import (
+	"fmt"
 	"net/http"
 
 	"github.com/cli/cli/v2/api"
@@ -29,3 +30,15 @@ func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 	}
 	return gitIgnoreTemplates, nil
 }
+
+// ViewGitIgnoreTemplate fetches available repository gitignore templates.
+// It uses API v3 here because gitignore template isn't supported by GraphQL.
+func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplate string) (api.GitIgnore, error) {
+	var gitIgnoreTemplateResponse api.GitIgnore
+	client := api.NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplate), nil, &gitIgnoreTemplateResponse)
+	if err != nil {
+		return api.GitIgnore{}, err
+	}
+	return gitIgnoreTemplateResponse, nil
+}
diff --git a/pkg/cmd/repo/shared/queries/queries_test.go b/pkg/cmd/repo/shared/queries/queries_test.go
index 097467cfa..023c6f231 100644
--- a/pkg/cmd/repo/shared/queries/queries_test.go
+++ b/pkg/cmd/repo/shared/queries/queries_test.go
@@ -1,6 +1,7 @@
 package queries
 
 import (
+	"fmt"
 	"net/http"
 	"testing"
 
@@ -231,3 +232,56 @@ func TestListGitIgnoreTemplates(t *testing.T) {
 		})
 	}
 }
+
+func TestGitIgnoreTemplate(t *testing.T) {
+	tests := []struct {
+		name                  string
+		httpStubs             func(t *testing.T, reg *httpmock.Registry)
+		gitIgnoreTemplateName string
+		wantGitIgnoreTemplate api.GitIgnore
+		wantErr               bool
+		wantErrMsg            string
+		httpClient            func() (*http.Client, error)
+	}{
+		{
+			name:                  "happy path",
+			gitIgnoreTemplateName: "Go",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates/Go"),
+					httpmock.StringResponse(`{
+						"name": "Go",
+						"source": "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n"
+						}`,
+					))
+			},
+			wantGitIgnoreTemplate: api.GitIgnore{
+				Name:   "Go",
+				Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", tt.gitIgnoreTemplateName)
+			if !tt.wantErr {
+				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
+			}
+			if tt.wantErr {
+				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
+			}
+			assert.Equal(t, tt.wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.gitIgnoreTemplateName))
+		})
+	}
+}

From 0bc0f8c8ebd4c20f217b876d02c3a0c939d26fdd Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 29 Sep 2024 19:09:46 -0600
Subject: [PATCH 094/301] Implement license view

---
 api/queries_repo.go                         |  14 +-
 pkg/cmd/repo/gitignore/view/view.go         |   8 +-
 pkg/cmd/repo/license/license.go             |   2 +
 pkg/cmd/repo/license/view/view.go           | 100 ++++++++
 pkg/cmd/repo/license/view/view_test.go      | 263 ++++++++++++++++++++
 pkg/cmd/repo/shared/queries/queries.go      |  16 +-
 pkg/cmd/repo/shared/queries/queries_test.go |  98 ++++++--
 7 files changed, 479 insertions(+), 22 deletions(-)
 create mode 100644 pkg/cmd/repo/license/view/view.go
 create mode 100644 pkg/cmd/repo/license/view/view_test.go

diff --git a/api/queries_repo.go b/api/queries_repo.go
index 2e2f711ca..136299f73 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -207,8 +207,18 @@ type IssueLabel struct {
 }
 
 type License struct {
-	Key  string `json:"key"`
-	Name string `json:"name"`
+	Key            string   `json:"key"`
+	Name           string   `json:"name"`
+	SPDXID         string   `json:"spdx_id"`
+	URL            string   `json:"url"`
+	NodeID         string   `json:"node_id"`
+	HTMLURL        string   `json:"html_url"`
+	Description    string   `json:"description"`
+	Implementation string   `json:"implementation"`
+	Permissions    []string `json:"permissions"`
+	Conditions     []string `json:"conditions"`
+	Limitations    []string `json:"limitations"`
+	Body           string   `json:"body"`
 }
 
 type GitIgnore struct {
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index 917a66481..edd1f073a 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -89,12 +89,12 @@ func renderGitIgnore(licenseTemplate api.GitIgnore, opts *ViewOptions) error {
 	// does not currently support .gitignore.
 	// So, I just add a newline and print the content as is instead.
 	// Ref: https://github.com/alecthomas/chroma/pull/755
-	var out string
+	var out strings.Builder
 	if opts.IO.IsStdoutTTY() {
-		out = "\n"
+		out.WriteString("\n")
 	}
-	out += licenseTemplate.Source
-	_, err := opts.IO.Out.Write([]byte(out))
+	out.WriteString(licenseTemplate.Source)
+	_, err := opts.IO.Out.Write([]byte(out.String()))
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/license/license.go b/pkg/cmd/repo/license/license.go
index a28b14f0b..a768d0ce7 100644
--- a/pkg/cmd/repo/license/license.go
+++ b/pkg/cmd/repo/license/license.go
@@ -2,6 +2,7 @@ package license
 
 import (
 	cmdList "github.com/cli/cli/v2/pkg/cmd/repo/license/list"
+	cmdView "github.com/cli/cli/v2/pkg/cmd/repo/license/view"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/spf13/cobra"
 )
@@ -13,6 +14,7 @@ func NewCmdLicense(f *cmdutil.Factory) *cobra.Command {
 	}
 
 	cmd.AddCommand(cmdList.NewCmdList(f, nil))
+	cmd.AddCommand(cmdView.NewCmdView(f, nil))
 
 	return cmd
 }
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
new file mode 100644
index 000000000..a805e7117
--- /dev/null
+++ b/pkg/cmd/repo/license/view/view.go
@@ -0,0 +1,100 @@
+package view
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/spf13/cobra"
+)
+
+type ViewOptions struct {
+	IO         *iostreams.IOStreams
+	HTTPClient func() (*http.Client, error)
+	Config     func() (gh.Config, error)
+	License    string
+}
+
+func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Command {
+	opts := &ViewOptions{
+		IO:         f.IOStreams,
+		HTTPClient: f.HttpClient,
+		Config:     f.Config,
+		License:    "",
+	}
+
+	cmd := &cobra.Command{
+		Use:   "view <license>",
+		Short: "View an available repository license template",
+		Long: heredoc.Docf(`
+		View an available repository license template.
+		
+		%[1]s<license>%[1]s is a license name or SPDX ID.
+		`, "`"),
+		Args: cmdutil.ExactArgs(1, "gh repo licese view only takes a single license argument"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			opts.License = args[0]
+			if runF != nil {
+				return runF(opts)
+			}
+			return viewRun(opts)
+		},
+	}
+	return cmd
+}
+
+func viewRun(opts *ViewOptions) error {
+	if opts.License == "" {
+		return errors.New("no license provided")
+	}
+
+	client, err := opts.HTTPClient()
+	if err != nil {
+		return err
+	}
+
+	cfg, err := opts.Config()
+	if err != nil {
+		return err
+	}
+
+	if err := opts.IO.StartPager(); err == nil {
+		defer opts.IO.StopPager()
+	} else {
+		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	}
+
+	hostname, _ := cfg.Authentication().DefaultHost()
+	license, err := queries.LicenseTemplate(client, hostname, opts.License)
+	if err != nil {
+		if strings.Contains(err.Error(), "HTTP 404") {
+			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID. Run `gh repo license list` for options", opts.License)
+		}
+		return err
+	}
+
+	return renderLicense(license, opts)
+}
+
+func renderLicense(licenseTemplate api.License, opts *ViewOptions) error {
+	cs := opts.IO.ColorScheme()
+	var out strings.Builder
+	if opts.IO.IsStdoutTTY() {
+		out.WriteString(fmt.Sprintf("\n%s\n", cs.Gray(licenseTemplate.Description)))
+		out.WriteString(fmt.Sprintf("\n%s\n", cs.Grayf("To implement: %s", licenseTemplate.Implementation)))
+		out.WriteString(fmt.Sprintf("\n%s\n\n", cs.Grayf("For more information, see: %s", licenseTemplate.HTMLURL)))
+	}
+	out.WriteString(licenseTemplate.Body)
+	_, err := opts.IO.Out.Write([]byte(out.String()))
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/cmd/repo/license/view/view_test.go b/pkg/cmd/repo/license/view/view_test.go
new file mode 100644
index 000000000..e83860274
--- /dev/null
+++ b/pkg/cmd/repo/license/view/view_test.go
@@ -0,0 +1,263 @@
+package view
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewCmdView(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		wantErr  bool
+		wantOpts *ViewOptions
+		tty      bool
+	}{
+		{
+			name:    "No license name or SPDX ID provided",
+			args:    []string{},
+			wantErr: true,
+			wantOpts: &ViewOptions{
+				License: "",
+			},
+		},
+		{
+			name:    "Happy path single license name",
+			args:    []string{"mit"},
+			wantErr: false,
+			wantOpts: &ViewOptions{
+				License: "mit",
+			},
+		},
+		{
+			name:    "Happy path too many license names",
+			args:    []string{"mit", "apache-2.0"},
+			wantErr: true,
+			wantOpts: &ViewOptions{
+				License: "",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ios, _, _, _ := iostreams.Test()
+			ios.SetStdinTTY(tt.tty)
+			ios.SetStdoutTTY(tt.tty)
+			ios.SetStderrTTY(tt.tty)
+
+			f := &cmdutil.Factory{
+				IOStreams: ios,
+			}
+			cmd := NewCmdView(f, func(*ViewOptions) error {
+				return nil
+			})
+			cmd.SetArgs(tt.args)
+			cmd.SetIn(&bytes.Buffer{})
+			cmd.SetOut(&bytes.Buffer{})
+			cmd.SetErr(&bytes.Buffer{})
+
+			_, err := cmd.ExecuteC()
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+
+			assert.Equal(t, tt.wantOpts.License, tt.wantOpts.License)
+		})
+	}
+}
+
+func TestViewRun(t *testing.T) {
+	tests := []struct {
+		name       string
+		opts       *ViewOptions
+		isTTY      bool
+		httpStubs  func(t *testing.T, reg *httpmock.Registry)
+		wantStdout string
+		wantStderr string
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name:    "happy path with license no tty",
+			opts:    &ViewOptions{License: "mit"},
+			wantErr: false,
+			isTTY:   false,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses/mit"),
+					httpmock.StringResponse(`{
+						"key": "mit",
+						"name": "MIT License",
+						"spdx_id": "MIT",
+						"url": "https://api.github.com/licenses/mit",
+						"node_id": "MDc6TGljZW5zZTEz",
+						"html_url": "http://choosealicense.com/licenses/mit/",
+						"description": "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+						"implementation": "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+						"permissions": [
+							"commercial-use",
+							"modifications",
+							"distribution",
+							"private-use"
+						],
+						"conditions": [
+							"include-copyright"
+						],
+						"limitations": [
+							"liability",
+							"warranty"
+						],
+						"body": "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+						"featured": true
+						}`))
+			},
+			wantStdout: heredoc.Doc(`
+				MIT License
+
+				Copyright (c) [year] [fullname]
+
+				Permission is hereby granted, free of charge, to any person obtaining a copy
+				of this software and associated documentation files (the "Software"), to deal
+				in the Software without restriction, including without limitation the rights
+				to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+				copies of the Software, and to permit persons to whom the Software is
+				furnished to do so, subject to the following conditions:
+
+				The above copyright notice and this permission notice shall be included in all
+				copies or substantial portions of the Software.
+
+				THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+				IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+				FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+				AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+				LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+				OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+				SOFTWARE.
+				`),
+		},
+		{
+			name:    "happy path with license tty",
+			opts:    &ViewOptions{License: "mit"},
+			wantErr: false,
+			isTTY:   true,
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses/mit"),
+					httpmock.StringResponse(`{
+						"key": "mit",
+						"name": "MIT License",
+						"spdx_id": "MIT",
+						"url": "https://api.github.com/licenses/mit",
+						"node_id": "MDc6TGljZW5zZTEz",
+						"html_url": "http://choosealicense.com/licenses/mit/",
+						"description": "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+						"implementation": "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+						"permissions": [
+							"commercial-use",
+							"modifications",
+							"distribution",
+							"private-use"
+						],
+						"conditions": [
+							"include-copyright"
+						],
+						"limitations": [
+							"liability",
+							"warranty"
+						],
+						"body": "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+						"featured": true
+						}`))
+			},
+			wantStdout: heredoc.Doc(`
+
+				A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.
+
+				To implement: Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.
+
+				For more information, see: http://choosealicense.com/licenses/mit/
+
+				MIT License
+
+				Copyright (c) [year] [fullname]
+
+				Permission is hereby granted, free of charge, to any person obtaining a copy
+				of this software and associated documentation files (the "Software"), to deal
+				in the Software without restriction, including without limitation the rights
+				to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+				copies of the Software, and to permit persons to whom the Software is
+				furnished to do so, subject to the following conditions:
+
+				The above copyright notice and this permission notice shall be included in all
+				copies or substantial portions of the Software.
+
+				THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+				IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+				FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+				AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+				LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+				OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+				SOFTWARE.
+				`),
+		},
+		{
+			name:    "License not found",
+			opts:    &ViewOptions{License: "404"},
+			wantErr: true,
+			errMsg:  "'404' is not a valid license template name or SPDX ID. Run `gh repo license list` for options",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses/404"),
+					httpmock.StatusStringResponse(404, `{
+						"message": "Not Found",
+						"documentation_url": "https://docs.github.com/rest/licenses/licenses#get-a-license",
+						"status": "404"
+						}`,
+					))
+			},
+		},
+	}
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.opts.Config = func() (gh.Config, error) {
+			return config.NewBlankConfig(), nil
+		}
+		tt.opts.HTTPClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		ios, _, stdout, stderr := iostreams.Test()
+		ios.SetStdoutTTY(tt.isTTY)
+		ios.SetStdinTTY(tt.isTTY)
+		ios.SetStderrTTY(tt.isTTY)
+		tt.opts.IO = ios
+
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			err := viewRun(tt.opts)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, tt.errMsg, err.Error())
+				return
+			}
+
+			assert.Equal(t, tt.wantStdout, stdout.String())
+			assert.Equal(t, tt.wantStderr, stderr.String())
+		})
+	}
+}
diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
index 8b5185823..d017173ab 100644
--- a/pkg/cmd/repo/shared/queries/queries.go
+++ b/pkg/cmd/repo/shared/queries/queries.go
@@ -19,6 +19,18 @@ func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.Licen
 	return licenseTemplates, nil
 }
 
+// LicenseTemplate fetches an available repository license template.
+// It uses API v3 because license template isn't supported by GraphQL.
+func LicenseTemplate(httpClient *http.Client, hostname string, licenseTemplateName string) (api.License, error) {
+	var licenseTemplates api.License
+	client := api.NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", fmt.Sprintf("licenses/%v", licenseTemplateName), nil, &licenseTemplates)
+	if err != nil {
+		return api.License{}, err
+	}
+	return licenseTemplates, nil
+}
+
 // ListGitIgnoreTemplates fetches available repository gitignore templates.
 // It uses API v3 here because gitignore template isn't supported by GraphQL.
 func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
@@ -33,10 +45,10 @@ func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 
 // ViewGitIgnoreTemplate fetches available repository gitignore templates.
 // It uses API v3 here because gitignore template isn't supported by GraphQL.
-func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplate string) (api.GitIgnore, error) {
+func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (api.GitIgnore, error) {
 	var gitIgnoreTemplateResponse api.GitIgnore
 	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplate), nil, &gitIgnoreTemplateResponse)
+	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName), nil, &gitIgnoreTemplateResponse)
 	if err != nil {
 		return api.GitIgnore{}, err
 	}
diff --git a/pkg/cmd/repo/shared/queries/queries_test.go b/pkg/cmd/repo/shared/queries/queries_test.go
index 023c6f231..bb4d716a7 100644
--- a/pkg/cmd/repo/shared/queries/queries_test.go
+++ b/pkg/cmd/repo/shared/queries/queries_test.go
@@ -81,32 +81,102 @@ func TestListLicenseTemplates(t *testing.T) {
 			hostname: "api.github.com",
 			wantLicenses: []api.License{
 				{
-					Key:  "mit",
-					Name: "MIT License",
+					Key:            "mit",
+					Name:           "MIT License",
+					SPDXID:         "MIT",
+					URL:            "https://api.github.com/licenses/mit",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "lgpl-3.0",
-					Name: "GNU Lesser General Public License v3.0",
+					Key:            "lgpl-3.0",
+					Name:           "GNU Lesser General Public License v3.0",
+					SPDXID:         "LGPL-3.0",
+					URL:            "https://api.github.com/licenses/lgpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "mpl-2.0",
-					Name: "Mozilla Public License 2.0",
+					Key:            "mpl-2.0",
+					Name:           "Mozilla Public License 2.0",
+					SPDXID:         "MPL-2.0",
+					URL:            "https://api.github.com/licenses/mpl-2.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "agpl-3.0",
-					Name: "GNU Affero General Public License v3.0",
+					Key:            "agpl-3.0",
+					Name:           "GNU Affero General Public License v3.0",
+					SPDXID:         "AGPL-3.0",
+					URL:            "https://api.github.com/licenses/agpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "unlicense",
-					Name: "The Unlicense",
+					Key:            "unlicense",
+					Name:           "The Unlicense",
+					SPDXID:         "Unlicense",
+					URL:            "https://api.github.com/licenses/unlicense",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "apache-2.0",
-					Name: "Apache License 2.0",
+					Key:            "apache-2.0",
+					Name:           "Apache License 2.0",
+					SPDXID:         "Apache-2.0",
+					URL:            "https://api.github.com/licenses/apache-2.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 				{
-					Key:  "gpl-3.0",
-					Name: "GNU General Public License v3.0",
+					Key:            "gpl-3.0",
+					Name:           "GNU General Public License v3.0",
+					SPDXID:         "GPL-3.0",
+					URL:            "https://api.github.com/licenses/gpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
 				},
 			},
 			wantErr: false,

From 0b29beacf45fa26aa7a9def1b89a29b106654b19 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 30 Sep 2024 14:47:24 -0600
Subject: [PATCH 095/301] Update docs to allow community submitted designs

---
 .github/CONTRIBUTING.md                       | 24 ++++++--
 .../submit-a-design-proposal.md               | 58 +++++++++++++++++++
 docs/triage.md                                | 27 +++++----
 3 files changed, 95 insertions(+), 14 deletions(-)
 create mode 100644 .github/ISSUE_TEMPLATE/submit-a-design-proposal.md

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 9f5d56376..5620dfadf 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -6,16 +6,17 @@ We accept pull requests for bug fixes and features where we've discussed the app
 
 Please do:
 
-* Check existing issues to verify that the [bug][bug issues] or [feature request][feature request issues] has not already been submitted.
+* Check existing issues to verify that an [bug][bug issues] or [feature request][feature request issues] has not already been submitted for the same problem or feature.
 * Open an issue if things aren't working as expected.
 * Open an issue to propose a significant change.
+* Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design).
 * Open a pull request to fix a bug.
 * Open a pull request to fix documentation about a command.
 * Open a pull request for any issue labelled [`help wanted`][hw] or [`good first issue`][gfi].
 
 Please avoid:
 
-* Opening pull requests for issues marked `needs-design`, `needs-investigation`, or `blocked`.
+* Opening pull requests for issues marked `needs-investigation`, or `blocked`.
 * Opening pull requests that haven't been approved for work in an issue
 * Adding installation instructions specifically for your OS/package manager.
 * Opening pull requests for any issue marked `core`. These issues require additional context from
@@ -50,9 +51,23 @@ Please note that this project adheres to a [Contributor Code of Conduct][code-of
 
 We generate manual pages from source on every release. You do not need to submit pull requests for documentation specifically; manual pages for commands will automatically get updated after your pull requests gets accepted.
 
-## Design guidelines
+## Design guidelines  
 
-You may reference the [CLI Design System][] when suggesting features, and are welcome to use our [Google Docs Template][] to suggest designs.
+### Proposing a design
+
+You may propose a design to solve an open bug or feature request issue that has both [the `needs-design` and `help-wanted` labels][needs design and help wanted].
+
+To propose a design:
+
+- Open a new issue using the [design proposal issue template](./ISSUE_TEMPLATE/submit-a-design-proposal.md).
+- Include a link to the issue that the design is for.
+- Describe the design you are proposing to resolve the issue, leveraging the [CLI Design System][].
+- Mock up the design you are proposing using our [Google Docs Template][] or code blocks.
+  - Mock ups should cleary illustrate the command(s) being run and the expected output(s).
+
+### Revewing a design
+
+Maintainers will review the design proposal and provide feedback. Once a maintainer approves the design and adds the [`help wanted`][hw] label to the issue, a PR can be opened to provide the implementation.
 
 ## Resources
 
@@ -62,6 +77,7 @@ You may reference the [CLI Design System][] when suggesting features, and are we
 
 
 [bug issues]: https://github.com/cli/cli/issues?q=is%3Aopen+is%3Aissue+label%3Abug
+[needs design and help wanted]: https://github.com/cli/cli/issues?q=state%3Aclosed%20is%3Aissue%20label%3Aneeds-design%20label%3A%22help%20wanted%22
 [feature request issues]: https://github.com/cli/cli/issues?q=is%3Aopen+is%3Aissue+label%3Aenhancement
 [hw]: https://github.com/cli/cli/labels/help%20wanted
 [gfi]: https://github.com/cli/cli/labels/good%20first%20issue
diff --git a/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md b/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
new file mode 100644
index 000000000..0467ff77a
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
@@ -0,0 +1,58 @@
+---
+name: "🎨 Submit a design proposal"
+about: Submit a design to resolve an open issue that has both `needs-design` and `help-wanted` labels
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+<!-- See [CONTRIBUTING.md](../CONTRIBUTING.md#proposing-a-design) for more information.-->
+
+### Link to issue for design submission
+
+<!-- 
+Provide a link to the issue this design is for.
+
+All design submissions must be linked to an open issue that
+has both the `needs-design` and `help-wanted` labels.
+-->
+
+### Proposed Design
+
+<!--
+Describe the design you are proposing to resolve the issue.
+
+All CLI designs must adhere to the [Pimer CLI design reference](https://primer.style/cli/).
+-->
+
+### Mockup
+
+<!--
+Provide a mockup of the design you are proposing. All mockups should clearly illustrate the command(s) being run and the expected output(s). 
+
+When color and formatting are important, consider using our [CLI design Google Docs Template](https://docs.google.com/document/d/1JIRErIUuJ6fTgabiFYfCH3x91pyHuytbfa0QLnTfXKM/edit#heading=h.or54sa47ylpg).
+
+Code blocks can also be used to submit a design mockup - remember to include the command(s) being run. Example:
+
+```shell
+$ gh issue list --json title -L 5
+[
+  {
+    "title": "`gh pr checks <pr> --required` should not fail when there are no required checks"
+  },
+  {
+    "title": "gh pr view commits should include commit description"
+  },
+  {
+    "title": "Adapt the color of the device code to the color used by the terminal"
+  },
+  {
+    "title": "`gh pr create` does not default to fork when user has write access to upstream"
+  },
+  {
+    "title": "First party discussions support"
+  }
+]
+```
+-->
\ No newline at end of file
diff --git a/docs/triage.md b/docs/triage.md
index d78a81aed..67027b00e 100644
--- a/docs/triage.md
+++ b/docs/triage.md
@@ -33,27 +33,34 @@ the changeset is feasible and to allow the associated CI run for new contributor
 
 - can this be closed outright?
   - e.g. spam/junk
+  - add the `invalid` label
   - close without comment
 - do we not want to do it?
-  - e.g. have already discussed not wanting to do or duplicate issue
+  - e.g. we have already discussed not wanting to do or it's a duplicate issue
+  - add the appropriate label (e.g. `duplicate`)
   - comment and close
-- are we ok with outside contribution for this?
-  - e.g. the task is relatively straightforward, but no people on our team have the bandwidth to take it on at the moment
+- do we want outside contribution for this?
+  - e.g. the task is relatively straightforward, the core team does not have the bandwidth to take it on
   - ensure that the thread contains all the context necessary for someone new to pick this up
-  - add `help wanted` label
+  - add the `help wanted` label
   - consider adding `good first issue` label
+  - comment acknowledging that that we are accepting contributions for this and add any other details you feel may be necessary to complete the work
+- do we want outside design contribution for this?
+  - e.g. the task is worthwhile, but needs design work to flesh out the details before implementation and the core team does not have the bandwidth to take it on
+  - ensure that the thread contains all the context necessary for someone new to pick this up
+  - add both the `help wanted` and `needs-design` labels
+  - comment acknowledging that that we are accepting contributions for this and add any other details you feel may be necessary to complete the work
 - do we want to do it?
+  - add the `core` label
   - comment acknowledging that
-  - add `core` label
-  - add to the project “TODO” column if this is something that should ship soon
 - is it intriguing, but requires discussion?
-  - label `discuss`
-  - label `needs-investigation` if engineering research is required before action can be taken
+  - Add the `discuss` label
+  - Add the `needs-investigation` label if engineering research is required before action can be taken
 - does it need more info from the issue author?
   - ask the user for details
-  - add `needs-user-input` label
+  - add the `needs-user-input` label
 - is it a usage/support question?
-  - consider converting the Issue to a Discussion
+  - Convert the Issue to a Discussion
 
 ## Weekly PR audit
 

From aef01e22d7c375199fc838fde97730381807b6b0 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 30 Sep 2024 15:03:50 -0600
Subject: [PATCH 096/301] Revise wording

---
 .github/CONTRIBUTING.md | 4 ++--
 docs/triage.md          | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 5620dfadf..2a3a09c13 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -65,9 +65,9 @@ To propose a design:
 - Mock up the design you are proposing using our [Google Docs Template][] or code blocks.
   - Mock ups should cleary illustrate the command(s) being run and the expected output(s).
 
-### Revewing a design
+### (core team only) Revewing a design
 
-Maintainers will review the design proposal and provide feedback. Once a maintainer approves the design and adds the [`help wanted`][hw] label to the issue, a PR can be opened to provide the implementation.
+A member of the core team will [triage](../docs/triage.md) the design proposal. Once a member of the core team has reviewd the design, they may add the [`help wanted`][hw] label to the issue, so a PR can be opened to provide the implementation.
 
 ## Resources
 
diff --git a/docs/triage.md b/docs/triage.md
index 67027b00e..d25d28c63 100644
--- a/docs/triage.md
+++ b/docs/triage.md
@@ -39,13 +39,13 @@ the changeset is feasible and to allow the associated CI run for new contributor
   - e.g. we have already discussed not wanting to do or it's a duplicate issue
   - add the appropriate label (e.g. `duplicate`)
   - comment and close
-- do we want outside contribution for this?
+- do we want external contribution for this?
   - e.g. the task is relatively straightforward, the core team does not have the bandwidth to take it on
   - ensure that the thread contains all the context necessary for someone new to pick this up
   - add the `help wanted` label
   - consider adding `good first issue` label
   - comment acknowledging that that we are accepting contributions for this and add any other details you feel may be necessary to complete the work
-- do we want outside design contribution for this?
+- do we want external design contribution for this?
   - e.g. the task is worthwhile, but needs design work to flesh out the details before implementation and the core team does not have the bandwidth to take it on
   - ensure that the thread contains all the context necessary for someone new to pick this up
   - add both the `help wanted` and `needs-design` labels

From 7b8e8be7d45da6499168ec49356ba012881d67bb Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 30 Sep 2024 15:13:19 -0600
Subject: [PATCH 097/301] Remove trailing space from heading

---
 .github/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 2a3a09c13..c9a5f8dae 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -51,7 +51,7 @@ Please note that this project adheres to a [Contributor Code of Conduct][code-of
 
 We generate manual pages from source on every release. You do not need to submit pull requests for documentation specifically; manual pages for commands will automatically get updated after your pull requests gets accepted.
 
-## Design guidelines  
+## Design guidelines
 
 ### Proposing a design
 

From 89628a40f94e5177e5d02d8fab5a586f436fdb29 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 30 Sep 2024 15:13:43 -0600
Subject: [PATCH 098/301] fix typo

---
 docs/triage.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/triage.md b/docs/triage.md
index d25d28c63..90042263c 100644
--- a/docs/triage.md
+++ b/docs/triage.md
@@ -40,7 +40,7 @@ the changeset is feasible and to allow the associated CI run for new contributor
   - add the appropriate label (e.g. `duplicate`)
   - comment and close
 - do we want external contribution for this?
-  - e.g. the task is relatively straightforward, the core team does not have the bandwidth to take it on
+  - e.g. the task is relatively straightforward, but the core team does not have the bandwidth to take it on
   - ensure that the thread contains all the context necessary for someone new to pick this up
   - add the `help wanted` label
   - consider adding `good first issue` label

From efe9841caf9ca58fd9d31441c70a18a8cff022a9 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 30 Sep 2024 15:14:59 -0600
Subject: [PATCH 099/301] Fix typo and wordsmithing

---
 .github/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index c9a5f8dae..d7456873e 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -6,7 +6,7 @@ We accept pull requests for bug fixes and features where we've discussed the app
 
 Please do:
 
-* Check existing issues to verify that an [bug][bug issues] or [feature request][feature request issues] has not already been submitted for the same problem or feature.
+* Check existing issues to verify that an existing [bug][bug issues] or [feature request][feature request issues] issue does not already exist for the same problem or feature.
 * Open an issue if things aren't working as expected.
 * Open an issue to propose a significant change.
 * Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design).

From 023a44904a9f1ddbb1866533e4d03048d040b456 Mon Sep 17 00:00:00 2001
From: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Date: Tue, 1 Oct 2024 12:02:54 -0600
Subject: [PATCH 100/301] Update SECURITY.md

---
 .github/SECURITY.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 15f909b71..50e489c54 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -2,7 +2,10 @@ GitHub takes the security of our software products and services seriously, inclu
 
 If you believe you have found a security vulnerability in GitHub CLI, you can report it to us in one of two ways:
 
-* Report it to this repository directly using [private vulnerability reporting][]. Such reports are not eligible for a bounty reward.
+* Report it to this repository directly using [private vulnerability reporting][].
+  * Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
+  * POCs and links to code are greatly encouraged.
+  * Such reports are not eligible for a bounty reward.
 
 * Submit the report through [HackerOne][] to be eligible for a bounty reward.
 

From 29192daa23144479bf75c91173cc81e4ac52727b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Oct 2024 18:15:14 +0000
Subject: [PATCH 101/301] build(deps): bump
 github.com/theupdateframework/go-tuf/v2

Bumps [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf) from 2.0.0 to 2.0.1.
- [Release notes](https://github.com/theupdateframework/go-tuf/releases)
- [Changelog](https://github.com/theupdateframework/go-tuf/blob/master/.goreleaser.yaml)
- [Commits](https://github.com/theupdateframework/go-tuf/compare/v2.0.0...v2.0.1)

---
updated-dependencies:
- dependency-name: github.com/theupdateframework/go-tuf/v2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 42cfe7ff8..f4ef7989f 100644
--- a/go.mod
+++ b/go.mod
@@ -143,7 +143,7 @@ require (
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/theupdateframework/go-tuf v0.7.0 // indirect
-	github.com/theupdateframework/go-tuf/v2 v2.0.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.0.1 // indirect
 	github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/transparency-dev/merkle v0.0.2 // indirect
diff --git a/go.sum b/go.sum
index 3b1fb2c2d..4f5689856 100644
--- a/go.sum
+++ b/go.sum
@@ -441,8 +441,8 @@ github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
-github.com/theupdateframework/go-tuf/v2 v2.0.0 h1:rD8d9RotYBprZVgC+9oyTZ5MmawepnTSTqoDuxjWgbs=
-github.com/theupdateframework/go-tuf/v2 v2.0.0/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
+github.com/theupdateframework/go-tuf/v2 v2.0.1 h1:11p9tXpq10KQEujxjcIjDSivMKCMLguls7erXHZnxJQ=
+github.com/theupdateframework/go-tuf/v2 v2.0.1/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
 github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e h1:BuzhfgfWQbX0dWzYzT1zsORLnHRv3bcRcsaUk0VmXA8=
 github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e/go.mod h1:/Tnicc6m/lsJE0irFMA0LfIwTBo4QP7A8IfyIv4zZKI=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=

From 289b9bc712027c391049e05a903acfe8727d67ae Mon Sep 17 00:00:00 2001
From: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Date: Tue, 1 Oct 2024 17:24:23 -0600
Subject: [PATCH 102/301] Apply suggestions from code review

Co-authored-by: Tyler McGoffin <jtmcg@github.com>
---
 .github/CONTRIBUTING.md                            | 6 +++---
 .github/ISSUE_TEMPLATE/submit-a-design-proposal.md | 2 +-
 docs/triage.md                                     | 2 --
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index d7456873e..35b211236 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -9,14 +9,14 @@ Please do:
 * Check existing issues to verify that an existing [bug][bug issues] or [feature request][feature request issues] issue does not already exist for the same problem or feature.
 * Open an issue if things aren't working as expected.
 * Open an issue to propose a significant change.
-* Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design).
+* Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design) instructions below.
 * Open a pull request to fix a bug.
 * Open a pull request to fix documentation about a command.
 * Open a pull request for any issue labelled [`help wanted`][hw] or [`good first issue`][gfi].
 
 Please avoid:
 
-* Opening pull requests for issues marked `needs-investigation`, or `blocked`.
+* Opening pull requests for issues marked `needs-design`, `needs-investigation`, or `blocked`.
 * Opening pull requests that haven't been approved for work in an issue
 * Adding installation instructions specifically for your OS/package manager.
 * Opening pull requests for any issue marked `core`. These issues require additional context from
@@ -67,7 +67,7 @@ To propose a design:
 
 ### (core team only) Revewing a design
 
-A member of the core team will [triage](../docs/triage.md) the design proposal. Once a member of the core team has reviewd the design, they may add the [`help wanted`][hw] label to the issue, so a PR can be opened to provide the implementation.
+A member of the core team will [triage](../docs/triage.md) the design proposal. Once a member of the core team has reviewed the design, they may add the [`help wanted`][hw] label to the issue, so a PR can be opened to provide the implementation.
 
 ## Resources
 
diff --git a/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md b/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
index 0467ff77a..fab4b7a88 100644
--- a/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
+++ b/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
@@ -23,7 +23,7 @@ has both the `needs-design` and `help-wanted` labels.
 <!--
 Describe the design you are proposing to resolve the issue.
 
-All CLI designs must adhere to the [Pimer CLI design reference](https://primer.style/cli/).
+All CLI designs must adhere to the [Primer CLI design reference](https://primer.style/cli/).
 -->
 
 ### Mockup
diff --git a/docs/triage.md b/docs/triage.md
index 90042263c..9d54fcfe7 100644
--- a/docs/triage.md
+++ b/docs/triage.md
@@ -44,12 +44,10 @@ the changeset is feasible and to allow the associated CI run for new contributor
   - ensure that the thread contains all the context necessary for someone new to pick this up
   - add the `help wanted` label
   - consider adding `good first issue` label
-  - comment acknowledging that that we are accepting contributions for this and add any other details you feel may be necessary to complete the work
 - do we want external design contribution for this?
   - e.g. the task is worthwhile, but needs design work to flesh out the details before implementation and the core team does not have the bandwidth to take it on
   - ensure that the thread contains all the context necessary for someone new to pick this up
   - add both the `help wanted` and `needs-design` labels
-  - comment acknowledging that that we are accepting contributions for this and add any other details you feel may be necessary to complete the work
 - do we want to do it?
   - add the `core` label
   - comment acknowledging that

From e6d39eb886610e7f74e76cc83085c5d96c8afd14 Mon Sep 17 00:00:00 2001
From: Ulf Adams <ulfjack@users.noreply.github.com>
Date: Mon, 6 Mar 2023 22:43:59 +0100
Subject: [PATCH 103/301] Print the login URL even when opening a browser

Fixes https://github.com/cli/cli/issues/5500.
---
 internal/authflow/flow.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/authflow/flow.go b/internal/authflow/flow.go
index 370e08784..3fc753b44 100644
--- a/internal/authflow/flow.go
+++ b/internal/authflow/flow.go
@@ -72,7 +72,7 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 				return nil
 			}
 
-			fmt.Fprintf(w, "%s to open %s in your browser... ", cs.Bold("Press Enter"), oauthHost)
+			fmt.Fprintf(w, "%s to open %s in your browser... ", cs.Bold("Press Enter"), authURL)
 			_ = waitForEnter(IO.In)
 
 			if err := b.Browse(authURL); err != nil {

From 5fc311374aa270c713593e4f808234d4b374a338 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 4 Oct 2024 10:08:48 -0700
Subject: [PATCH 104/301] Add handling of empty titles for Issues and PRs

Currently, the prompter doesn't enforce the requirement of a title for PR
and Issue creation. However, that creates the UX where a user can enter a
blank title, spend time filling out a detailed body, then fail to create
the issue or pr when the request is sent to the api because the title is
blank. This attempts to handle that before sending a request to the api,
enforcing that, when prompting, the title of an issue is not blank.
---
 pkg/cmd/pr/shared/survey.go | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/pr/shared/survey.go b/pkg/cmd/pr/shared/survey.go
index 5b8bde0eb..a059b288c 100644
--- a/pkg/cmd/pr/shared/survey.go
+++ b/pkg/cmd/pr/shared/survey.go
@@ -111,9 +111,16 @@ func BodySurvey(p Prompt, state *IssueMetadataState, templateContent string) err
 }
 
 func TitleSurvey(p Prompt, state *IssueMetadataState) error {
-	result, err := p.Input("Title", state.Title)
-	if err != nil {
-		return err
+	var err error
+	result := ""
+	for result == "" {
+		result, err = p.Input("Title (required)", state.Title)
+		if err != nil {
+			return err
+		}
+		if result == "" {
+			fmt.Println("X Title cannot be blank.")
+		}
 	}
 
 	if result != state.Title {

From 4aff4ebe12a5365380dbea56d282249cdda7a173 Mon Sep 17 00:00:00 2001
From: Scott Mcdermott <scott@smemsh.net>
Date: Sun, 15 Sep 2024 22:37:43 -0700
Subject: [PATCH 105/301] Allow user to override markdown wrap width via
 $GH_MDWIDTH from environment

---
 pkg/cmd/root/help_topic.go |  4 ++++
 pkg/markdown/markdown.go   | 14 +++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/root/help_topic.go b/pkg/cmd/root/help_topic.go
index 3da5bf476..e76dd2271 100644
--- a/pkg/cmd/root/help_topic.go
+++ b/pkg/cmd/root/help_topic.go
@@ -99,6 +99,10 @@ var HelpTopics = []helpTopic{
 
 			%[1]sGH_PATH%[1]s: set the path to the gh executable, useful for when gh can not properly determine
 			its own path such as in the cygwin terminal.
+
+			%[1]sGH_MDWIDTH%[1]s: default maximum width for markdown render wrapping.  The max width of lines
+			wrapped on the terminal will be taken as the lesser of the terminal width, this value, or 120 if
+			not specified.  This value is used, for example, with %[1]spr view%[1]s subcommand.
 		`, "`"),
 	},
 	{
diff --git a/pkg/markdown/markdown.go b/pkg/markdown/markdown.go
index f3f4951af..63bd9233e 100644
--- a/pkg/markdown/markdown.go
+++ b/pkg/markdown/markdown.go
@@ -1,6 +1,9 @@
 package markdown
 
 import (
+	"os"
+	"strconv"
+
 	"github.com/charmbracelet/glamour"
 	ghMarkdown "github.com/cli/go-gh/v2/pkg/markdown"
 )
@@ -10,11 +13,16 @@ func WithoutIndentation() glamour.TermRendererOption {
 }
 
 // WithWrap is a rendering option that set the character limit for soft
-// wrapping the markdown rendering. There is a max limit of 120 characters.
+// wrapping the markdown rendering. There is a max limit of 120 characters,
+// unless the user overrides with an environment variable.
 // If 0 is passed then wrapping is disabled.
 func WithWrap(w int) glamour.TermRendererOption {
-	if w > 120 {
-		w = 120
+	width, err := strconv.Atoi(os.Getenv("GH_MDWIDTH"))
+	if err != nil {
+		width = 120
+	}
+	if w > width {
+		w = width
 	}
 	return ghMarkdown.WithWrap(w)
 }

From 3be44fb6e25fe5b6425d2a2534d62dd80e04a9b0 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 6 Oct 2024 11:51:16 -0600
Subject: [PATCH 106/301] Move API calls to queries_repo.go

---
 api/queries_repo.go                         |  49 +++
 api/queries_repo_test.go                    | 441 ++++++++++++++++++++
 pkg/cmd/repo/create/create.go               |   9 +-
 pkg/cmd/repo/gitignore/list/list.go         |   4 +-
 pkg/cmd/repo/gitignore/view/view.go         |   3 +-
 pkg/cmd/repo/license/list/list.go           |   3 +-
 pkg/cmd/repo/license/view/view.go           |   3 +-
 pkg/cmd/repo/shared/queries/queries.go      |  56 ---
 pkg/cmd/repo/shared/queries/queries_test.go | 357 ----------------
 9 files changed, 499 insertions(+), 426 deletions(-)
 delete mode 100644 pkg/cmd/repo/shared/queries/queries.go
 delete mode 100644 pkg/cmd/repo/shared/queries/queries_test.go

diff --git a/api/queries_repo.go b/api/queries_repo.go
index 136299f73..efa0c7152 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -219,6 +219,7 @@ type License struct {
 	Conditions     []string `json:"conditions"`
 	Limitations    []string `json:"limitations"`
 	Body           string   `json:"body"`
+	Featured       bool     `json:"featured"`
 }
 
 type GitIgnore struct {
@@ -1406,3 +1407,51 @@ func RepoExists(client *Client, repo ghrepo.Interface) (bool, error) {
 		return false, ghAPI.HandleHTTPError(resp)
 	}
 }
+
+// ListLicenseTemplates fetches available repository license templates.
+// It uses API v3 because license template isn't supported by GraphQL.
+func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]License, error) {
+	var licenseTemplates []License
+	client := NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
+	if err != nil {
+		return nil, err
+	}
+	return licenseTemplates, nil
+}
+
+// LicenseTemplate fetches an available repository license template.
+// It uses API v3 because license template isn't supported by GraphQL.
+func LicenseTemplate(httpClient *http.Client, hostname string, licenseTemplateName string) (License, error) {
+	var licenseTemplates License
+	client := NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", fmt.Sprintf("licenses/%v", licenseTemplateName), nil, &licenseTemplates)
+	if err != nil {
+		return License{}, err
+	}
+	return licenseTemplates, nil
+}
+
+// ListGitIgnoreTemplates fetches available repository gitignore templates.
+// It uses API v3 here because gitignore template isn't supported by GraphQL.
+func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
+	var gitIgnoreTemplates []string
+	client := NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
+	if err != nil {
+		return []string{}, err
+	}
+	return gitIgnoreTemplates, nil
+}
+
+// ViewGitIgnoreTemplate fetches available repository gitignore templates.
+// It uses API v3 here because gitignore template isn't supported by GraphQL.
+func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (GitIgnore, error) {
+	var gitIgnoreTemplateResponse GitIgnore
+	client := NewClientFromHTTP(httpClient)
+	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName), nil, &gitIgnoreTemplateResponse)
+	if err != nil {
+		return GitIgnore{}, err
+	}
+	return gitIgnoreTemplateResponse, nil
+}
diff --git a/api/queries_repo_test.go b/api/queries_repo_test.go
index 026fa4591..c01731a23 100644
--- a/api/queries_repo_test.go
+++ b/api/queries_repo_test.go
@@ -566,3 +566,444 @@ func TestForkRepoReturnsErrorWhenForkIsNotPossible(t *testing.T) {
 	// Then it provides a useful error message
 	require.Equal(t, fmt.Errorf("%s/%s cannot be forked. A single user account cannot own both a parent and fork.", ownerLogin, repoName), err)
 }
+
+func TestListLicenseTemplates(t *testing.T) {
+	tests := []struct {
+		name         string
+		httpStubs    func(t *testing.T, reg *httpmock.Registry)
+		hostname     string
+		wantLicenses []License
+		wantErr      bool
+		wantErrMsg   string
+		httpClient   func() (*http.Client, error)
+	}{
+		{
+			name: "happy path",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses"),
+					httpmock.StringResponse(`[
+						{
+							"key": "mit",
+							"name": "MIT License",
+							"spdx_id": "MIT",
+							"url": "https://api.github.com/licenses/mit",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "lgpl-3.0",
+							"name": "GNU Lesser General Public License v3.0",
+							"spdx_id": "LGPL-3.0",
+							"url": "https://api.github.com/licenses/lgpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "mpl-2.0",
+							"name": "Mozilla Public License 2.0",
+							"spdx_id": "MPL-2.0",
+							"url": "https://api.github.com/licenses/mpl-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "agpl-3.0",
+							"name": "GNU Affero General Public License v3.0",
+							"spdx_id": "AGPL-3.0",
+							"url": "https://api.github.com/licenses/agpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "unlicense",
+							"name": "The Unlicense",
+							"spdx_id": "Unlicense",
+							"url": "https://api.github.com/licenses/unlicense",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "apache-2.0",
+							"name": "Apache License 2.0",
+							"spdx_id": "Apache-2.0",
+							"url": "https://api.github.com/licenses/apache-2.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						},
+						{
+							"key": "gpl-3.0",
+							"name": "GNU General Public License v3.0",
+							"spdx_id": "GPL-3.0",
+							"url": "https://api.github.com/licenses/gpl-3.0",
+							"node_id": "MDc6TGljZW5zZW1pdA=="
+						}
+						]`,
+					))
+			},
+			hostname: "api.github.com",
+			wantLicenses: []License{
+				{
+					Key:            "mit",
+					Name:           "MIT License",
+					SPDXID:         "MIT",
+					URL:            "https://api.github.com/licenses/mit",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "lgpl-3.0",
+					Name:           "GNU Lesser General Public License v3.0",
+					SPDXID:         "LGPL-3.0",
+					URL:            "https://api.github.com/licenses/lgpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "mpl-2.0",
+					Name:           "Mozilla Public License 2.0",
+					SPDXID:         "MPL-2.0",
+					URL:            "https://api.github.com/licenses/mpl-2.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "agpl-3.0",
+					Name:           "GNU Affero General Public License v3.0",
+					SPDXID:         "AGPL-3.0",
+					URL:            "https://api.github.com/licenses/agpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "unlicense",
+					Name:           "The Unlicense",
+					SPDXID:         "Unlicense",
+					URL:            "https://api.github.com/licenses/unlicense",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "apache-2.0",
+					Name:           "Apache License 2.0",
+					SPDXID:         "Apache-2.0",
+					URL:            "https://api.github.com/licenses/apache-2.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+				{
+					Key:            "gpl-3.0",
+					Name:           "GNU General Public License v3.0",
+					SPDXID:         "GPL-3.0",
+					URL:            "https://api.github.com/licenses/gpl-3.0",
+					NodeID:         "MDc6TGljZW5zZW1pdA==",
+					HTMLURL:        "",
+					Description:    "",
+					Implementation: "",
+					Permissions:    nil,
+					Conditions:     nil,
+					Limitations:    nil,
+					Body:           "",
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotLicenses, err := ListLicenseTemplates(client, tt.hostname)
+			if !tt.wantErr {
+				assert.NoError(t, err, "Expected no error while fetching /licenses")
+			}
+			if tt.wantErr {
+				assert.Error(t, err, "Expected error while fetching /licenses")
+			}
+			assert.Equal(t, tt.wantLicenses, gotLicenses, "Licenses fetched is not as expected")
+		})
+	}
+}
+
+func TestLicenseTemplate(t *testing.T) {
+	tests := []struct {
+		name                string
+		httpStubs           func(t *testing.T, reg *httpmock.Registry)
+		licenseTemplateName string
+		wantLicenseTemplate License
+		wantErr             bool
+		wantErrMsg          string
+		httpClient          func() (*http.Client, error)
+	}{
+		{
+			name:                "happy path",
+			licenseTemplateName: "mit",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses/mit"),
+					httpmock.StringResponse(`{
+						"key": "mit",
+						"name": "MIT License",
+						"spdx_id": "MIT",
+						"url": "https://api.github.com/licenses/mit",
+						"node_id": "MDc6TGljZW5zZTEz",
+						"html_url": "http://choosealicense.com/licenses/mit/",
+						"description": "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+						"implementation": "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+						"permissions": [
+							"commercial-use",
+							"modifications",
+							"distribution",
+							"private-use"
+						],
+						"conditions": [
+							"include-copyright"
+						],
+						"limitations": [
+							"liability",
+							"warranty"
+						],
+						"body": "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+						"featured": true
+						}`,
+					))
+			},
+			wantLicenseTemplate: License{
+				Key:            "mit",
+				Name:           "MIT License",
+				SPDXID:         "MIT",
+				URL:            "https://api.github.com/licenses/mit",
+				NodeID:         "MDc6TGljZW5zZTEz",
+				HTMLURL:        "http://choosealicense.com/licenses/mit/",
+				Description:    "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+				Implementation: "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+				Permissions: []string{
+					"commercial-use",
+					"modifications",
+					"distribution",
+					"private-use",
+				},
+				Conditions: []string{
+					"include-copyright",
+				},
+				Limitations: []string{
+					"liability",
+					"warranty",
+				},
+				Body:     "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+				Featured: true,
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotLicenseTemplate, err := LicenseTemplate(client, "api.github.com", tt.licenseTemplateName)
+			if !tt.wantErr {
+				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.licenseTemplateName))
+			}
+			if tt.wantErr {
+				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.licenseTemplateName))
+			}
+			assert.Equal(t, tt.wantLicenseTemplate, gotLicenseTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.licenseTemplateName))
+		})
+	}
+}
+
+func TestListGitIgnoreTemplates(t *testing.T) {
+	tests := []struct {
+		name                   string
+		httpStubs              func(t *testing.T, reg *httpmock.Registry)
+		wantGitIgnoreTemplates []string
+		wantErr                bool
+		wantErrMsg             string
+		httpClient             func() (*http.Client, error)
+	}{
+		{
+			name: "happy path",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates"),
+					httpmock.StringResponse(`[
+						"AL",
+						"Actionscript",
+						"Ada",
+						"Agda",
+						"Android",
+						"AppEngine",
+						"AppceleratorTitanium",
+						"ArchLinuxPackages",
+						"Autotools",
+						"Ballerina",
+						"C",
+						"C++",
+						"CFWheels",
+						"CMake",
+						"CUDA",
+						"CakePHP",
+						"ChefCookbook",
+						"Clojure",
+						"CodeIgniter",
+						"CommonLisp",
+						"Composer",
+						"Concrete5",
+						"Coq",
+						"CraftCMS",
+						"D"
+						]`,
+					))
+			},
+			wantGitIgnoreTemplates: []string{
+				"AL",
+				"Actionscript",
+				"Ada",
+				"Agda",
+				"Android",
+				"AppEngine",
+				"AppceleratorTitanium",
+				"ArchLinuxPackages",
+				"Autotools",
+				"Ballerina",
+				"C",
+				"C++",
+				"CFWheels",
+				"CMake",
+				"CUDA",
+				"CakePHP",
+				"ChefCookbook",
+				"Clojure",
+				"CodeIgniter",
+				"CommonLisp",
+				"Composer",
+				"Concrete5",
+				"Coq",
+				"CraftCMS",
+				"D",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, "api.github.com")
+			if !tt.wantErr {
+				assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
+			}
+			if tt.wantErr {
+				assert.Error(t, err, "Expected error while fetching /gitignore/templates")
+			}
+			assert.Equal(t, tt.wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
+		})
+	}
+}
+
+func TestGitIgnoreTemplate(t *testing.T) {
+	tests := []struct {
+		name                  string
+		httpStubs             func(t *testing.T, reg *httpmock.Registry)
+		gitIgnoreTemplateName string
+		wantGitIgnoreTemplate GitIgnore
+		wantErr               bool
+		wantErrMsg            string
+		httpClient            func() (*http.Client, error)
+	}{
+		{
+			name:                  "happy path",
+			gitIgnoreTemplateName: "Go",
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "gitignore/templates/Go"),
+					httpmock.StringResponse(`{
+						"name": "Go",
+						"source": "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n"
+						}`,
+					))
+			},
+			wantGitIgnoreTemplate: GitIgnore{
+				Name:   "Go",
+				Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		if tt.httpStubs != nil {
+			tt.httpStubs(t, reg)
+		}
+		tt.httpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+		client, _ := tt.httpClient()
+		t.Run(tt.name, func(t *testing.T) {
+			defer reg.Verify(t)
+			gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", tt.gitIgnoreTemplateName)
+			if !tt.wantErr {
+				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
+			}
+			if tt.wantErr {
+				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
+			}
+			assert.Equal(t, tt.wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.gitIgnoreTemplateName))
+		})
+	}
+}
diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 760757928..46c7189da 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -20,7 +20,6 @@ import (
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/ghrepo"
 	"github.com/cli/cli/v2/pkg/cmd/repo/shared/format"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -228,7 +227,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		results, err := queries.ListGitIgnoreTemplates(httpClient, hostname)
+		results, err := api.ListGitIgnoreTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -245,7 +244,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		licenses, err := queries.ListLicenseTemplates(httpClient, hostname)
+		licenses, err := api.ListLicenseTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -812,7 +811,7 @@ func interactiveGitIgnore(client *http.Client, hostname string, prompter iprompt
 		return "", nil
 	}
 
-	templates, err := queries.ListGitIgnoreTemplates(client, hostname)
+	templates, err := api.ListGitIgnoreTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
@@ -831,7 +830,7 @@ func interactiveLicense(client *http.Client, hostname string, prompter iprompter
 		return "", nil
 	}
 
-	licenses, err := queries.ListLicenseTemplates(client, hostname)
+	licenses, err := api.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index cddaeea83..028f0fb29 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/tableprinter"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -59,7 +59,7 @@ func listRun(opts *ListOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	gitIgnoreTemplates, err := queries.ListGitIgnoreTemplates(client, hostname)
+	gitIgnoreTemplates, err := api.ListGitIgnoreTemplates(client, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index edd1f073a..bb28e9f0c 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -9,7 +9,6 @@ import (
 	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -72,7 +71,7 @@ func viewRun(opts *ViewOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	gitIgnore, err := queries.GitIgnoreTemplate(client, hostname, opts.Template)
+	gitIgnore, err := api.GitIgnoreTemplate(client, hostname, opts.Template)
 	if err != nil {
 		if strings.Contains(err.Error(), "HTTP 404") {
 			return fmt.Errorf("'%s' is not a valid gitignore template. Run `gh repo gitignore list` for options", opts.Template)
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index ebb23bffb..dc7951232 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -7,7 +7,6 @@ import (
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/tableprinter"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -60,7 +59,7 @@ func listRun(opts *ListOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	licenseTemplates, err := queries.ListLicenseTemplates(client, hostname)
+	licenseTemplates, err := api.ListLicenseTemplates(client, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index a805e7117..77cd7ce89 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -9,7 +9,6 @@ import (
 	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/queries"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -72,7 +71,7 @@ func viewRun(opts *ViewOptions) error {
 	}
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	license, err := queries.LicenseTemplate(client, hostname, opts.License)
+	license, err := api.LicenseTemplate(client, hostname, opts.License)
 	if err != nil {
 		if strings.Contains(err.Error(), "HTTP 404") {
 			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID. Run `gh repo license list` for options", opts.License)
diff --git a/pkg/cmd/repo/shared/queries/queries.go b/pkg/cmd/repo/shared/queries/queries.go
deleted file mode 100644
index d017173ab..000000000
--- a/pkg/cmd/repo/shared/queries/queries.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package queries
-
-import (
-	"fmt"
-	"net/http"
-
-	"github.com/cli/cli/v2/api"
-)
-
-// ListLicenseTemplates fetches available repository license templates.
-// It uses API v3 because license template isn't supported by GraphQL.
-func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]api.License, error) {
-	var licenseTemplates []api.License
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
-	if err != nil {
-		return nil, err
-	}
-	return licenseTemplates, nil
-}
-
-// LicenseTemplate fetches an available repository license template.
-// It uses API v3 because license template isn't supported by GraphQL.
-func LicenseTemplate(httpClient *http.Client, hostname string, licenseTemplateName string) (api.License, error) {
-	var licenseTemplates api.License
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", fmt.Sprintf("licenses/%v", licenseTemplateName), nil, &licenseTemplates)
-	if err != nil {
-		return api.License{}, err
-	}
-	return licenseTemplates, nil
-}
-
-// ListGitIgnoreTemplates fetches available repository gitignore templates.
-// It uses API v3 here because gitignore template isn't supported by GraphQL.
-func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
-	var gitIgnoreTemplates []string
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
-	if err != nil {
-		return []string{}, err
-	}
-	return gitIgnoreTemplates, nil
-}
-
-// ViewGitIgnoreTemplate fetches available repository gitignore templates.
-// It uses API v3 here because gitignore template isn't supported by GraphQL.
-func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (api.GitIgnore, error) {
-	var gitIgnoreTemplateResponse api.GitIgnore
-	client := api.NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName), nil, &gitIgnoreTemplateResponse)
-	if err != nil {
-		return api.GitIgnore{}, err
-	}
-	return gitIgnoreTemplateResponse, nil
-}
diff --git a/pkg/cmd/repo/shared/queries/queries_test.go b/pkg/cmd/repo/shared/queries/queries_test.go
deleted file mode 100644
index bb4d716a7..000000000
--- a/pkg/cmd/repo/shared/queries/queries_test.go
+++ /dev/null
@@ -1,357 +0,0 @@
-package queries
-
-import (
-	"fmt"
-	"net/http"
-	"testing"
-
-	"github.com/cli/cli/v2/api"
-	"github.com/cli/cli/v2/pkg/httpmock"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestListLicenseTemplates(t *testing.T) {
-	tests := []struct {
-		name         string
-		httpStubs    func(t *testing.T, reg *httpmock.Registry)
-		hostname     string
-		wantLicenses []api.License
-		wantErr      bool
-		wantErrMsg   string
-		httpClient   func() (*http.Client, error)
-	}{
-		{
-			name: "happy path",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "licenses"),
-					httpmock.StringResponse(`[
-						{
-							"key": "mit",
-							"name": "MIT License",
-							"spdx_id": "MIT",
-							"url": "https://api.github.com/licenses/mit",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "lgpl-3.0",
-							"name": "GNU Lesser General Public License v3.0",
-							"spdx_id": "LGPL-3.0",
-							"url": "https://api.github.com/licenses/lgpl-3.0",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "mpl-2.0",
-							"name": "Mozilla Public License 2.0",
-							"spdx_id": "MPL-2.0",
-							"url": "https://api.github.com/licenses/mpl-2.0",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "agpl-3.0",
-							"name": "GNU Affero General Public License v3.0",
-							"spdx_id": "AGPL-3.0",
-							"url": "https://api.github.com/licenses/agpl-3.0",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "unlicense",
-							"name": "The Unlicense",
-							"spdx_id": "Unlicense",
-							"url": "https://api.github.com/licenses/unlicense",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "apache-2.0",
-							"name": "Apache License 2.0",
-							"spdx_id": "Apache-2.0",
-							"url": "https://api.github.com/licenses/apache-2.0",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						},
-						{
-							"key": "gpl-3.0",
-							"name": "GNU General Public License v3.0",
-							"spdx_id": "GPL-3.0",
-							"url": "https://api.github.com/licenses/gpl-3.0",
-							"node_id": "MDc6TGljZW5zZW1pdA=="
-						}
-						]`,
-					))
-			},
-			hostname: "api.github.com",
-			wantLicenses: []api.License{
-				{
-					Key:            "mit",
-					Name:           "MIT License",
-					SPDXID:         "MIT",
-					URL:            "https://api.github.com/licenses/mit",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "lgpl-3.0",
-					Name:           "GNU Lesser General Public License v3.0",
-					SPDXID:         "LGPL-3.0",
-					URL:            "https://api.github.com/licenses/lgpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "mpl-2.0",
-					Name:           "Mozilla Public License 2.0",
-					SPDXID:         "MPL-2.0",
-					URL:            "https://api.github.com/licenses/mpl-2.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "agpl-3.0",
-					Name:           "GNU Affero General Public License v3.0",
-					SPDXID:         "AGPL-3.0",
-					URL:            "https://api.github.com/licenses/agpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "unlicense",
-					Name:           "The Unlicense",
-					SPDXID:         "Unlicense",
-					URL:            "https://api.github.com/licenses/unlicense",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "apache-2.0",
-					Name:           "Apache License 2.0",
-					SPDXID:         "Apache-2.0",
-					URL:            "https://api.github.com/licenses/apache-2.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "gpl-3.0",
-					Name:           "GNU General Public License v3.0",
-					SPDXID:         "GPL-3.0",
-					URL:            "https://api.github.com/licenses/gpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotLicenses, err := ListLicenseTemplates(client, tt.hostname)
-			if !tt.wantErr {
-				assert.NoError(t, err, "Expected no error while fetching /licenses")
-			}
-			if tt.wantErr {
-				assert.Error(t, err, "Expected error while fetching /licenses")
-			}
-			assert.Equal(t, tt.wantLicenses, gotLicenses, "Licenses fetched is not as expected")
-		})
-	}
-}
-
-func TestListGitIgnoreTemplates(t *testing.T) {
-	tests := []struct {
-		name                   string
-		httpStubs              func(t *testing.T, reg *httpmock.Registry)
-		wantGitIgnoreTemplates []string
-		wantErr                bool
-		wantErrMsg             string
-		httpClient             func() (*http.Client, error)
-	}{
-		{
-			name: "happy path",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "gitignore/templates"),
-					httpmock.StringResponse(`[
-						"AL",
-						"Actionscript",
-						"Ada",
-						"Agda",
-						"Android",
-						"AppEngine",
-						"AppceleratorTitanium",
-						"ArchLinuxPackages",
-						"Autotools",
-						"Ballerina",
-						"C",
-						"C++",
-						"CFWheels",
-						"CMake",
-						"CUDA",
-						"CakePHP",
-						"ChefCookbook",
-						"Clojure",
-						"CodeIgniter",
-						"CommonLisp",
-						"Composer",
-						"Concrete5",
-						"Coq",
-						"CraftCMS",
-						"D"
-						]`,
-					))
-			},
-			wantGitIgnoreTemplates: []string{
-				"AL",
-				"Actionscript",
-				"Ada",
-				"Agda",
-				"Android",
-				"AppEngine",
-				"AppceleratorTitanium",
-				"ArchLinuxPackages",
-				"Autotools",
-				"Ballerina",
-				"C",
-				"C++",
-				"CFWheels",
-				"CMake",
-				"CUDA",
-				"CakePHP",
-				"ChefCookbook",
-				"Clojure",
-				"CodeIgniter",
-				"CommonLisp",
-				"Composer",
-				"Concrete5",
-				"Coq",
-				"CraftCMS",
-				"D",
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, "api.github.com")
-			if !tt.wantErr {
-				assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
-			}
-			if tt.wantErr {
-				assert.Error(t, err, "Expected error while fetching /gitignore/templates")
-			}
-			assert.Equal(t, tt.wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
-		})
-	}
-}
-
-func TestGitIgnoreTemplate(t *testing.T) {
-	tests := []struct {
-		name                  string
-		httpStubs             func(t *testing.T, reg *httpmock.Registry)
-		gitIgnoreTemplateName string
-		wantGitIgnoreTemplate api.GitIgnore
-		wantErr               bool
-		wantErrMsg            string
-		httpClient            func() (*http.Client, error)
-	}{
-		{
-			name:                  "happy path",
-			gitIgnoreTemplateName: "Go",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "gitignore/templates/Go"),
-					httpmock.StringResponse(`{
-						"name": "Go",
-						"source": "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n"
-						}`,
-					))
-			},
-			wantGitIgnoreTemplate: api.GitIgnore{
-				Name:   "Go",
-				Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", tt.gitIgnoreTemplateName)
-			if !tt.wantErr {
-				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
-			}
-			if tt.wantErr {
-				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
-			}
-			assert.Equal(t, tt.wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.gitIgnoreTemplateName))
-		})
-	}
-}

From 0f1320a0a0e524b4be637b6021cb3723e18be17b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 6 Oct 2024 13:24:21 -0600
Subject: [PATCH 107/301] Refactor tests and add new tests

---
 api/queries_repo_test.go | 605 +++++++++++++++++++--------------------
 1 file changed, 289 insertions(+), 316 deletions(-)

diff --git a/api/queries_repo_test.go b/api/queries_repo_test.go
index c01731a23..40707d630 100644
--- a/api/queries_repo_test.go
+++ b/api/queries_repo_test.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/internal/ghrepo"
 	"github.com/cli/cli/v2/pkg/httpmock"
 	"github.com/stretchr/testify/assert"
@@ -567,22 +568,12 @@ func TestForkRepoReturnsErrorWhenForkIsNotPossible(t *testing.T) {
 	require.Equal(t, fmt.Errorf("%s/%s cannot be forked. A single user account cannot own both a parent and fork.", ownerLogin, repoName), err)
 }
 
-func TestListLicenseTemplates(t *testing.T) {
-	tests := []struct {
-		name         string
-		httpStubs    func(t *testing.T, reg *httpmock.Registry)
-		hostname     string
-		wantLicenses []License
-		wantErr      bool
-		wantErrMsg   string
-		httpClient   func() (*http.Client, error)
-	}{
-		{
-			name: "happy path",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "licenses"),
-					httpmock.StringResponse(`[
+func TestListLicenseTemplatesReturnsLicenses(t *testing.T) {
+	hostname := "api.github.com"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", "licenses"),
+			httpmock.StringResponse(`[
 						{
 							"key": "mit",
 							"name": "MIT License",
@@ -633,153 +624,131 @@ func TestListLicenseTemplates(t *testing.T) {
 							"node_id": "MDc6TGljZW5zZW1pdA=="
 						}
 						]`,
-					))
-			},
-			hostname: "api.github.com",
-			wantLicenses: []License{
-				{
-					Key:            "mit",
-					Name:           "MIT License",
-					SPDXID:         "MIT",
-					URL:            "https://api.github.com/licenses/mit",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "lgpl-3.0",
-					Name:           "GNU Lesser General Public License v3.0",
-					SPDXID:         "LGPL-3.0",
-					URL:            "https://api.github.com/licenses/lgpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "mpl-2.0",
-					Name:           "Mozilla Public License 2.0",
-					SPDXID:         "MPL-2.0",
-					URL:            "https://api.github.com/licenses/mpl-2.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "agpl-3.0",
-					Name:           "GNU Affero General Public License v3.0",
-					SPDXID:         "AGPL-3.0",
-					URL:            "https://api.github.com/licenses/agpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "unlicense",
-					Name:           "The Unlicense",
-					SPDXID:         "Unlicense",
-					URL:            "https://api.github.com/licenses/unlicense",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "apache-2.0",
-					Name:           "Apache License 2.0",
-					SPDXID:         "Apache-2.0",
-					URL:            "https://api.github.com/licenses/apache-2.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-				{
-					Key:            "gpl-3.0",
-					Name:           "GNU General Public License v3.0",
-					SPDXID:         "GPL-3.0",
-					URL:            "https://api.github.com/licenses/gpl-3.0",
-					NodeID:         "MDc6TGljZW5zZW1pdA==",
-					HTMLURL:        "",
-					Description:    "",
-					Implementation: "",
-					Permissions:    nil,
-					Conditions:     nil,
-					Limitations:    nil,
-					Body:           "",
-				},
-			},
-			wantErr: false,
+			))
+	}
+	wantLicenses := []License{
+		{
+			Key:            "mit",
+			Name:           "MIT License",
+			SPDXID:         "MIT",
+			URL:            "https://api.github.com/licenses/mit",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "lgpl-3.0",
+			Name:           "GNU Lesser General Public License v3.0",
+			SPDXID:         "LGPL-3.0",
+			URL:            "https://api.github.com/licenses/lgpl-3.0",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "mpl-2.0",
+			Name:           "Mozilla Public License 2.0",
+			SPDXID:         "MPL-2.0",
+			URL:            "https://api.github.com/licenses/mpl-2.0",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "agpl-3.0",
+			Name:           "GNU Affero General Public License v3.0",
+			SPDXID:         "AGPL-3.0",
+			URL:            "https://api.github.com/licenses/agpl-3.0",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "unlicense",
+			Name:           "The Unlicense",
+			SPDXID:         "Unlicense",
+			URL:            "https://api.github.com/licenses/unlicense",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "apache-2.0",
+			Name:           "Apache License 2.0",
+			SPDXID:         "Apache-2.0",
+			URL:            "https://api.github.com/licenses/apache-2.0",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
+		},
+		{
+			Key:            "gpl-3.0",
+			Name:           "GNU General Public License v3.0",
+			SPDXID:         "GPL-3.0",
+			URL:            "https://api.github.com/licenses/gpl-3.0",
+			NodeID:         "MDc6TGljZW5zZW1pdA==",
+			HTMLURL:        "",
+			Description:    "",
+			Implementation: "",
+			Permissions:    nil,
+			Conditions:     nil,
+			Limitations:    nil,
+			Body:           "",
 		},
 	}
 
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotLicenses, err := ListLicenseTemplates(client, tt.hostname)
-			if !tt.wantErr {
-				assert.NoError(t, err, "Expected no error while fetching /licenses")
-			}
-			if tt.wantErr {
-				assert.Error(t, err, "Expected error while fetching /licenses")
-			}
-			assert.Equal(t, tt.wantLicenses, gotLicenses, "Licenses fetched is not as expected")
-		})
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
 	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	gotLicenses, err := ListLicenseTemplates(client, hostname)
+
+	assert.NoError(t, err, "Expected no error while fetching /licenses")
+	assert.Equal(t, wantLicenses, gotLicenses, "Licenses fetched is not as expected")
 }
 
-func TestLicenseTemplate(t *testing.T) {
-	tests := []struct {
-		name                string
-		httpStubs           func(t *testing.T, reg *httpmock.Registry)
-		licenseTemplateName string
-		wantLicenseTemplate License
-		wantErr             bool
-		wantErrMsg          string
-		httpClient          func() (*http.Client, error)
-	}{
-		{
-			name:                "happy path",
-			licenseTemplateName: "mit",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "licenses/mit"),
-					httpmock.StringResponse(`{
+func TestLicenseTemplateReturnsLicense(t *testing.T) {
+	licenseTemplateName := "mit"
+	hostname := "api.github.com"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", fmt.Sprintf("licenses/%v", licenseTemplateName)),
+			httpmock.StringResponse(`{
 						"key": "mit",
 						"name": "MIT License",
 						"spdx_id": "MIT",
@@ -804,75 +773,84 @@ func TestLicenseTemplate(t *testing.T) {
 						"body": "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
 						"featured": true
 						}`,
-					))
-			},
-			wantLicenseTemplate: License{
-				Key:            "mit",
-				Name:           "MIT License",
-				SPDXID:         "MIT",
-				URL:            "https://api.github.com/licenses/mit",
-				NodeID:         "MDc6TGljZW5zZTEz",
-				HTMLURL:        "http://choosealicense.com/licenses/mit/",
-				Description:    "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
-				Implementation: "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
-				Permissions: []string{
-					"commercial-use",
-					"modifications",
-					"distribution",
-					"private-use",
-				},
-				Conditions: []string{
-					"include-copyright",
-				},
-				Limitations: []string{
-					"liability",
-					"warranty",
-				},
-				Body:     "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
-				Featured: true,
-			},
-			wantErr: false,
+			))
+	}
+	wantLicenseTemplate := License{
+		Key:            "mit",
+		Name:           "MIT License",
+		SPDXID:         "MIT",
+		URL:            "https://api.github.com/licenses/mit",
+		NodeID:         "MDc6TGljZW5zZTEz",
+		HTMLURL:        "http://choosealicense.com/licenses/mit/",
+		Description:    "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+		Implementation: "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+		Permissions: []string{
+			"commercial-use",
+			"modifications",
+			"distribution",
+			"private-use",
 		},
+		Conditions: []string{
+			"include-copyright",
+		},
+		Limitations: []string{
+			"liability",
+			"warranty",
+		},
+		Body:     "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+		Featured: true,
 	}
 
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotLicenseTemplate, err := LicenseTemplate(client, "api.github.com", tt.licenseTemplateName)
-			if !tt.wantErr {
-				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.licenseTemplateName))
-			}
-			if tt.wantErr {
-				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.licenseTemplateName))
-			}
-			assert.Equal(t, tt.wantLicenseTemplate, gotLicenseTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.licenseTemplateName))
-		})
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
 	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	gotLicenseTemplate, err := LicenseTemplate(client, hostname, licenseTemplateName)
+
+	assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /licenses/%v", licenseTemplateName))
+	assert.Equal(t, wantLicenseTemplate, gotLicenseTemplate, fmt.Sprintf("License \"%v\" fetched is not as expected", licenseTemplateName))
 }
 
-func TestListGitIgnoreTemplates(t *testing.T) {
-	tests := []struct {
-		name                   string
-		httpStubs              func(t *testing.T, reg *httpmock.Registry)
-		wantGitIgnoreTemplates []string
-		wantErr                bool
-		wantErrMsg             string
-		httpClient             func() (*http.Client, error)
-	}{
-		{
-			name: "happy path",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "gitignore/templates"),
-					httpmock.StringResponse(`[
+func TestLicenseTemplateReturnsErrorWhenLicenseTemplateNotFound(t *testing.T) {
+	licenseTemplateName := "invalid-license"
+	hostname := "api.github.com"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", fmt.Sprintf("licenses/%v", licenseTemplateName)),
+			httpmock.StatusStringResponse(404, heredoc.Doc(`
+			{
+				"message": "Not Found",
+				"documentation_url": "https://docs.github.com/rest/licenses/licenses#get-a-license",
+				"status": "404"
+			}`)),
+		)
+	}
+
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
+	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	_, err := LicenseTemplate(client, hostname, licenseTemplateName)
+
+	assert.Error(t, err, fmt.Sprintf("Expected error while fetching /licenses/%v", licenseTemplateName))
+}
+
+func TestListGitIgnoreTemplatesReturnsGitIgnoreTemplates(t *testing.T) {
+	hostname := "api.github.com"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", "gitignore/templates"),
+			httpmock.StringResponse(`[
 						"AL",
 						"Actionscript",
 						"Ada",
@@ -899,111 +877,106 @@ func TestListGitIgnoreTemplates(t *testing.T) {
 						"CraftCMS",
 						"D"
 						]`,
-					))
-			},
-			wantGitIgnoreTemplates: []string{
-				"AL",
-				"Actionscript",
-				"Ada",
-				"Agda",
-				"Android",
-				"AppEngine",
-				"AppceleratorTitanium",
-				"ArchLinuxPackages",
-				"Autotools",
-				"Ballerina",
-				"C",
-				"C++",
-				"CFWheels",
-				"CMake",
-				"CUDA",
-				"CakePHP",
-				"ChefCookbook",
-				"Clojure",
-				"CodeIgniter",
-				"CommonLisp",
-				"Composer",
-				"Concrete5",
-				"Coq",
-				"CraftCMS",
-				"D",
-			},
-			wantErr: false,
-		},
+			))
+	}
+	wantGitIgnoreTemplates := []string{
+		"AL",
+		"Actionscript",
+		"Ada",
+		"Agda",
+		"Android",
+		"AppEngine",
+		"AppceleratorTitanium",
+		"ArchLinuxPackages",
+		"Autotools",
+		"Ballerina",
+		"C",
+		"C++",
+		"CFWheels",
+		"CMake",
+		"CUDA",
+		"CakePHP",
+		"ChefCookbook",
+		"Clojure",
+		"CodeIgniter",
+		"CommonLisp",
+		"Composer",
+		"Concrete5",
+		"Coq",
+		"CraftCMS",
+		"D",
 	}
 
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, "api.github.com")
-			if !tt.wantErr {
-				assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
-			}
-			if tt.wantErr {
-				assert.Error(t, err, "Expected error while fetching /gitignore/templates")
-			}
-			assert.Equal(t, tt.wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
-		})
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
 	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, hostname)
+
+	assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
+	assert.Equal(t, wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
 }
 
-func TestGitIgnoreTemplate(t *testing.T) {
-	tests := []struct {
-		name                  string
-		httpStubs             func(t *testing.T, reg *httpmock.Registry)
-		gitIgnoreTemplateName string
-		wantGitIgnoreTemplate GitIgnore
-		wantErr               bool
-		wantErrMsg            string
-		httpClient            func() (*http.Client, error)
-	}{
-		{
-			name:                  "happy path",
-			gitIgnoreTemplateName: "Go",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.REST("GET", "gitignore/templates/Go"),
-					httpmock.StringResponse(`{
+func TestGitIgnoreTemplateReturnsGitIgnoreTemplate(t *testing.T) {
+	gitIgnoreTemplateName := "Go"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName)),
+			httpmock.StringResponse(`{
 						"name": "Go",
 						"source": "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n"
 						}`,
-					))
-			},
-			wantGitIgnoreTemplate: GitIgnore{
-				Name:   "Go",
-				Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
-			},
-			wantErr: false,
-		},
+			))
+	}
+	wantGitIgnoreTemplate := GitIgnore{
+		Name:   "Go",
+		Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
 	}
 
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
-		}
-		tt.httpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-		client, _ := tt.httpClient()
-		t.Run(tt.name, func(t *testing.T) {
-			defer reg.Verify(t)
-			gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", tt.gitIgnoreTemplateName)
-			if !tt.wantErr {
-				assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
-			}
-			if tt.wantErr {
-				assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", tt.gitIgnoreTemplateName))
-			}
-			assert.Equal(t, tt.wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", tt.gitIgnoreTemplateName))
-		})
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
 	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
+
+	assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", gitIgnoreTemplateName))
+	assert.Equal(t, wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", gitIgnoreTemplateName))
+}
+
+func TestGitIgnoreTemplateReturnsErrorWhenGitIgnoreTemplateNotFound(t *testing.T) {
+	gitIgnoreTemplateName := "invalid-gitignore"
+	httpStubs := func(reg *httpmock.Registry) {
+		reg.Register(
+			httpmock.REST("GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName)),
+			httpmock.StatusStringResponse(404, heredoc.Doc(`
+			{
+				"message": "Not Found",
+				"documentation_url": "https://docs.github.com/v3/gitignore",
+				"status": "404"
+			}`)),
+		)
+	}
+
+	reg := &httpmock.Registry{}
+	httpStubs(reg)
+
+	httpClient := func() (*http.Client, error) {
+		return &http.Client{Transport: reg}, nil
+	}
+	client, _ := httpClient()
+	defer reg.Verify(t)
+
+	_, err := GitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
+
+	assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", gitIgnoreTemplateName))
 }

From 8a1e6ac9f0374d8434c9bf10a28334e474eb85fe Mon Sep 17 00:00:00 2001
From: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Date: Tue, 8 Oct 2024 14:00:30 -0600
Subject: [PATCH 108/301] Apply suggestions from code review

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 api/queries_repo.go                    | 6 ++++--
 pkg/cmd/repo/gitignore/list/list.go    | 9 ++++-----
 pkg/cmd/repo/gitignore/view/view.go    | 7 +++----
 pkg/cmd/repo/license/list/list.go      | 7 +++----
 pkg/cmd/repo/license/view/view.go      | 8 +++-----
 pkg/cmd/repo/license/view/view_test.go | 6 +++---
 6 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/api/queries_repo.go b/api/queries_repo.go
index efa0c7152..cf4d62f33 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -1425,7 +1425,8 @@ func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]License,
 func LicenseTemplate(httpClient *http.Client, hostname string, licenseTemplateName string) (License, error) {
 	var licenseTemplates License
 	client := NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", fmt.Sprintf("licenses/%v", licenseTemplateName), nil, &licenseTemplates)
+	path := fmt.Sprintf("licenses/%s", licenseTemplateName)
+	err := client.REST(hostname, "GET", path, nil, &licenseTemplates)
 	if err != nil {
 		return License{}, err
 	}
@@ -1449,7 +1450,8 @@ func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (GitIgnore, error) {
 	var gitIgnoreTemplateResponse GitIgnore
 	client := NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", fmt.Sprintf("gitignore/templates/%v", gitIgnoreTemplateName), nil, &gitIgnoreTemplateResponse)
+	path := fmt.Sprintf("gitignore/templates/%s", gitIgnoreTemplateName)
+	err := client.REST(hostname, "GET", path, nil, &gitIgnoreTemplateResponse)
 	if err != nil {
 		return GitIgnore{}, err
 	}
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index 028f0fb29..78e402447 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -27,7 +27,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:     "list",
-		Short:   "List available repository gitignore templates",
+		Short:   "List gitignore templates used in creating repositories",
 		Aliases: []string{"ls"},
 		Args:    cmdutil.ExactArgs(0, "gh repo gitignore list takes no arguments"),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -52,11 +52,10 @@ func listRun(opts *ListOptions) error {
 		return err
 	}
 
-	if err := opts.IO.StartPager(); err == nil {
-		defer opts.IO.StopPager()
-	} else {
-		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	if err := opts.IO.StartPager(); err != nil {
+		fmt.Fprintf(opts.IO.ErrOut, "starting pager failed: %v\n", err)
 	}
+	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
 	gitIgnoreTemplates, err := api.ListGitIgnoreTemplates(client, hostname)
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index bb28e9f0c..0614f0c46 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -64,11 +64,10 @@ func viewRun(opts *ViewOptions) error {
 		return err
 	}
 
-	if err := opts.IO.StartPager(); err == nil {
-		defer opts.IO.StopPager()
-	} else {
-		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	if err := opts.IO.StartPager(); err != nil {
+		fmt.Fprintf(opts.IO.ErrOut, "starting pager failed: %v\n", err)
 	}
+	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
 	gitIgnore, err := api.GitIgnoreTemplate(client, hostname, opts.Template)
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index dc7951232..7d3bdadba 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -52,11 +52,10 @@ func listRun(opts *ListOptions) error {
 		return err
 	}
 
-	if err := opts.IO.StartPager(); err == nil {
-		defer opts.IO.StopPager()
-	} else {
-		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	if err := opts.IO.StartPager(); err != nil {
+		fmt.Fprintf(opts.IO.ErrOut, "starting pager failed: %v\n", err)
 	}
+	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
 	licenseTemplates, err := api.ListLicenseTemplates(client, hostname)
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 77cd7ce89..8af3731bd 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -26,7 +26,6 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		IO:         f.IOStreams,
 		HTTPClient: f.HttpClient,
 		Config:     f.Config,
-		License:    "",
 	}
 
 	cmd := &cobra.Command{
@@ -64,11 +63,10 @@ func viewRun(opts *ViewOptions) error {
 		return err
 	}
 
-	if err := opts.IO.StartPager(); err == nil {
-		defer opts.IO.StopPager()
-	} else {
-		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	if err := opts.IO.StartPager(); err != nil {
+		fmt.Fprintf(opts.IO.ErrOut, "starting pager failed: %v\n", err)
 	}
+	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
 	license, err := api.LicenseTemplate(client, hostname, opts.License)
diff --git a/pkg/cmd/repo/license/view/view_test.go b/pkg/cmd/repo/license/view/view_test.go
index e83860274..00f109b39 100644
--- a/pkg/cmd/repo/license/view/view_test.go
+++ b/pkg/cmd/repo/license/view/view_test.go
@@ -24,7 +24,7 @@ func TestNewCmdView(t *testing.T) {
 		tty      bool
 	}{
 		{
-			name:    "No license name or SPDX ID provided",
+			name:    "No license key or SPDX ID provided",
 			args:    []string{},
 			wantErr: true,
 			wantOpts: &ViewOptions{
@@ -32,7 +32,7 @@ func TestNewCmdView(t *testing.T) {
 			},
 		},
 		{
-			name:    "Happy path single license name",
+			name:    "Happy path single license key",
 			args:    []string{"mit"},
 			wantErr: false,
 			wantOpts: &ViewOptions{
@@ -40,7 +40,7 @@ func TestNewCmdView(t *testing.T) {
 			},
 		},
 		{
-			name:    "Happy path too many license names",
+			name:    "Happy path too many license keys",
 			args:    []string{"mit", "apache-2.0"},
 			wantErr: true,
 			wantOpts: &ViewOptions{

From ca01bb8f9c88217483359944aed9c13ad6a6ebfc Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 8 Oct 2024 16:12:40 -0600
Subject: [PATCH 109/301] Handle errors from parsing hostname in auth flow

---
 go.mod                    | 4 ++--
 go.sum                    | 8 ++++----
 internal/authflow/flow.go | 7 ++++++-
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/go.mod b/go.mod
index f4ef7989f..c351fc979 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/charmbracelet/glamour v0.7.0
 	github.com/charmbracelet/lipgloss v0.10.1-0.20240413172830-d0be07ea6b9c
 	github.com/cli/go-gh/v2 v2.10.0
-	github.com/cli/oauth v1.0.1
+	github.com/cli/oauth v1.1.0
 	github.com/cli/safeexec v1.0.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.5
 	github.com/creack/pty v1.1.23
@@ -159,7 +159,7 @@ require (
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/sys v0.26.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index 4f5689856..a737fbf3e 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cli/go-gh/v2 v2.10.0 h1:GMflBKoErBXlLvN2euxzL+p7JaM8erlSmw0cT7uZr7M=
 github.com/cli/go-gh/v2 v2.10.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
-github.com/cli/oauth v1.0.1 h1:pXnTFl/qUegXHK531Dv0LNjW4mLx626eS42gnzfXJPA=
-github.com/cli/oauth v1.0.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
+github.com/cli/oauth v1.1.0 h1:BgUFqUe2WOLBxVkrbPwwaQIQkt0enyp8BtQV7uSOkQk=
+github.com/cli/oauth v1.1.0/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
 github.com/cli/safeexec v1.0.1 h1:e/C79PbXF4yYTN/wauC4tviMxEV13BwljGj0N9j+N00=
 github.com/cli/safeexec v1.0.1/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
@@ -515,8 +515,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
+golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
diff --git a/internal/authflow/flow.go b/internal/authflow/flow.go
index 3fc753b44..52b00284b 100644
--- a/internal/authflow/flow.go
+++ b/internal/authflow/flow.go
@@ -48,8 +48,13 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 		callbackURI = "http://localhost/"
 	}
 
+	host, err := oauth.NewGitHubHost(ghinstance.HostPrefix(oauthHost))
+	if err != nil {
+		return "", "", err
+	}
+
 	flow := &oauth.Flow{
-		Host:         oauth.GitHubHost(ghinstance.HostPrefix(oauthHost)),
+		Host:         host,
 		ClientID:     oauthClientID,
 		ClientSecret: oauthClientSecret,
 		CallbackURI:  callbackURI,

From be3b6cbd8dd2fd99315404b909fd958307c42c8f Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 8 Oct 2024 16:03:14 -0700
Subject: [PATCH 110/301] Make the X in the error message red and print with io
 writer

---
 pkg/cmd/issue/create/create.go | 2 +-
 pkg/cmd/pr/create/create.go    | 2 +-
 pkg/cmd/pr/shared/survey.go    | 7 +++++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/issue/create/create.go b/pkg/cmd/issue/create/create.go
index 82d4ab133..f51cde4c9 100644
--- a/pkg/cmd/issue/create/create.go
+++ b/pkg/cmd/issue/create/create.go
@@ -222,7 +222,7 @@ func createRun(opts *CreateOptions) (err error) {
 		defer prShared.PreserveInput(opts.IO, &tb, &err)()
 
 		if opts.Title == "" {
-			err = prShared.TitleSurvey(opts.Prompter, &tb)
+			err = prShared.TitleSurvey(opts.Prompter, opts.IO, &tb)
 			if err != nil {
 				return
 			}
diff --git a/pkg/cmd/pr/create/create.go b/pkg/cmd/pr/create/create.go
index 7e893395c..1242af2c5 100644
--- a/pkg/cmd/pr/create/create.go
+++ b/pkg/cmd/pr/create/create.go
@@ -379,7 +379,7 @@ func createRun(opts *CreateOptions) (err error) {
 	} else {
 
 		if !opts.TitleProvided {
-			err = shared.TitleSurvey(opts.Prompter, state)
+			err = shared.TitleSurvey(opts.Prompter, opts.IO, state)
 			if err != nil {
 				return
 			}
diff --git a/pkg/cmd/pr/shared/survey.go b/pkg/cmd/pr/shared/survey.go
index a059b288c..2ee343bfb 100644
--- a/pkg/cmd/pr/shared/survey.go
+++ b/pkg/cmd/pr/shared/survey.go
@@ -110,7 +110,7 @@ func BodySurvey(p Prompt, state *IssueMetadataState, templateContent string) err
 	return nil
 }
 
-func TitleSurvey(p Prompt, state *IssueMetadataState) error {
+func TitleSurvey(p Prompt, io *iostreams.IOStreams, state *IssueMetadataState) error {
 	var err error
 	result := ""
 	for result == "" {
@@ -119,7 +119,10 @@ func TitleSurvey(p Prompt, state *IssueMetadataState) error {
 			return err
 		}
 		if result == "" {
-			fmt.Println("X Title cannot be blank.")
+			colorizeRed := io.ColorScheme().ColorFromString("red")
+			msg := fmt.Sprintf("%s Title cannot be blank.", colorizeRed("X"))
+			// For some reason, only Fprintln and Println work here. I can't use Fprintf or Printf to eliminate the line above
+			fmt.Fprintln(io.ErrOut, msg)
 		}
 	}
 

From da945314fd3179e3eb4cfab3d1681a210969f90a Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 8 Oct 2024 16:11:05 -0700
Subject: [PATCH 111/301] Fix failing test for pr and issue create

---
 pkg/cmd/issue/create/create_test.go | 4 ++--
 pkg/cmd/pr/create/create_test.go    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/issue/create/create_test.go b/pkg/cmd/issue/create/create_test.go
index b95b5ef66..8e49700a0 100644
--- a/pkg/cmd/issue/create/create_test.go
+++ b/pkg/cmd/issue/create/create_test.go
@@ -611,7 +611,7 @@ func TestIssueCreate_recover(t *testing.T) {
 
 	pm := &prompter.PrompterMock{}
 	pm.InputFunc = func(p, d string) (string, error) {
-		if p == "Title" {
+		if p == "Title (required)" {
 			return d, nil
 		} else {
 			return "", prompter.NoSuchPromptErr(p)
@@ -736,7 +736,7 @@ func TestIssueCreate_continueInBrowser(t *testing.T) {
 
 	pm := &prompter.PrompterMock{}
 	pm.InputFunc = func(p, d string) (string, error) {
-		if p == "Title" {
+		if p == "Title (required)" {
 			return "hello", nil
 		} else {
 			return "", prompter.NoSuchPromptErr(p)
diff --git a/pkg/cmd/pr/create/create_test.go b/pkg/cmd/pr/create/create_test.go
index cba552101..81684ff00 100644
--- a/pkg/cmd/pr/create/create_test.go
+++ b/pkg/cmd/pr/create/create_test.go
@@ -1210,7 +1210,7 @@ func Test_createRun(t *testing.T) {
 			},
 			promptStubs: func(pm *prompter.PrompterMock) {
 				pm.InputFunc = func(p, d string) (string, error) {
-					if p == "Title" {
+					if p == "Title (required)" {
 						return d, nil
 					} else {
 						return "", prompter.NoSuchPromptErr(p)
@@ -1316,7 +1316,7 @@ func Test_createRun(t *testing.T) {
 				}
 
 				pm.InputFunc = func(p, d string) (string, error) {
-					if p == "Title" {
+					if p == "Title (required)" {
 						return d, nil
 					} else if p == "Body" {
 						return d, nil

From dcbd1b728cd87523768807262b44f7cc94bbb582 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 8 Oct 2024 16:32:50 -0700
Subject: [PATCH 112/301] Add test coverage for TitleSurvey change

---
 pkg/cmd/pr/shared/survey_test.go | 41 ++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/pkg/cmd/pr/shared/survey_test.go b/pkg/cmd/pr/shared/survey_test.go
index 8df492785..0e62e0e5a 100644
--- a/pkg/cmd/pr/shared/survey_test.go
+++ b/pkg/cmd/pr/shared/survey_test.go
@@ -158,3 +158,44 @@ type testEditor struct {
 func (e testEditor) Edit(filename, text string) (string, error) {
 	return e.edit(text)
 }
+
+func TestTitleSurvey(t *testing.T) {
+	tests := []struct {
+		name               string
+		prompterMockInputs []string
+		expectedTitle      string
+		expectStderr       bool
+	}{
+		{
+			name:               "title provided",
+			prompterMockInputs: []string{"title"},
+			expectedTitle:      "title",
+		},
+		{
+			name:               "first input empty",
+			prompterMockInputs: []string{"", "title"},
+			expectedTitle:      "title",
+			expectStderr:       true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			io, _, _, stderr := iostreams.Test()
+			pm := prompter.NewMockPrompter(t)
+			for _, input := range tt.prompterMockInputs {
+				pm.RegisterInput("Title (required)", func(string, string) (string, error) {
+					return input, nil
+				})
+			}
+
+			state := &IssueMetadataState{}
+			err := TitleSurvey(pm, io, state)
+
+			assert.NoError(t, err)
+			assert.Equal(t, tt.expectedTitle, state.Title)
+			if tt.expectStderr {
+				assert.Equal(t, "X Title cannot be blank.\n", stderr.String())
+			}
+		})
+	}
+}

From f47af31c465769324eb6091d5eba9cf3fb1b8386 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Wed, 9 Oct 2024 13:30:37 +0200
Subject: [PATCH 113/301] Bump cli/oauth to 1.1.1

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index c351fc979..e638459fa 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/charmbracelet/glamour v0.7.0
 	github.com/charmbracelet/lipgloss v0.10.1-0.20240413172830-d0be07ea6b9c
 	github.com/cli/go-gh/v2 v2.10.0
-	github.com/cli/oauth v1.1.0
+	github.com/cli/oauth v1.1.1
 	github.com/cli/safeexec v1.0.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.5
 	github.com/creack/pty v1.1.23
diff --git a/go.sum b/go.sum
index a737fbf3e..d1a85b60e 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cli/go-gh/v2 v2.10.0 h1:GMflBKoErBXlLvN2euxzL+p7JaM8erlSmw0cT7uZr7M=
 github.com/cli/go-gh/v2 v2.10.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
-github.com/cli/oauth v1.1.0 h1:BgUFqUe2WOLBxVkrbPwwaQIQkt0enyp8BtQV7uSOkQk=
-github.com/cli/oauth v1.1.0/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
+github.com/cli/oauth v1.1.1 h1:459gD3hSjlKX9B1uXBuiAMdpXBUQ9QGf/NDcCpoQxPs=
+github.com/cli/oauth v1.1.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
 github.com/cli/safeexec v1.0.1 h1:e/C79PbXF4yYTN/wauC4tviMxEV13BwljGj0N9j+N00=
 github.com/cli/safeexec v1.0.1/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=

From aaea0166e2824f12454c8f7d785bd7481eddebe1 Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Wed, 9 Oct 2024 16:51:00 -0400
Subject: [PATCH 114/301] If provided with zero attestations to verify, the
 LiveSigstoreVerifier.Verify func should return an error.

---
 pkg/cmd/attestation/verification/sigstore.go  | 22 ++++++++++++++-----
 .../verification/sigstore_integration_test.go | 15 +++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index ca4015db2..e237a3eb9 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"os"
 
@@ -48,6 +49,8 @@ type LiveSigstoreVerifier struct {
 	config SigstoreConfig
 }
 
+var ErrNoAttestationsVerified = errors.New("no attestations were verified")
+
 // NewLiveSigstoreVerifier creates a new LiveSigstoreVerifier struct
 // that is used to verify artifacts and attestations against the
 // Public Good, GitHub, or a custom trusted root.
@@ -170,18 +173,20 @@ func getLowestCertInChain(ca *root.CertificateAuthority) (*x509.Certificate, err
 }
 
 func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy verify.PolicyBuilder) *SigstoreResults {
-	// initialize the processing results before attempting to verify
+	// initialize the processing apResults before attempting to verify
 	// with multiple verifiers
-	results := make([]*AttestationProcessingResult, len(attestations))
+	apResults := make([]*AttestationProcessingResult, len(attestations))
 	for i, att := range attestations {
 		apr := &AttestationProcessingResult{
 			Attestation: att,
 		}
-		results[i] = apr
+		apResults[i] = apr
 	}
 
+	var atLeastOneVerified bool
+
 	totalAttestations := len(attestations)
-	for i, apr := range results {
+	for i, apr := range apResults {
 		v.config.Logger.VerbosePrintf("Verifying attestation %d/%d against the configured Sigstore trust roots\n", i+1, totalAttestations)
 
 		// determine which verifier should attempt verification against the bundle
@@ -212,10 +217,15 @@ func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy ve
 			"SUCCESS - attestation signature verified with \"%s\"\n", issuer,
 		))
 		apr.VerificationResult = result
+		atLeastOneVerified = true
 	}
 
-	return &SigstoreResults{
-		VerifyResults: results,
+	if atLeastOneVerified {
+		return &SigstoreResults{
+			VerifyResults: apResults,
+		}
+	} else {
+		return &SigstoreResults{Error: ErrNoAttestationsVerified}
 	}
 }
 
diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go
index 97b44581e..1d3ec2d75 100644
--- a/pkg/cmd/attestation/verification/sigstore_integration_test.go
+++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go
@@ -85,6 +85,21 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 		require.Len(t, res.VerifyResults, 0)
 		require.ErrorContains(t, res.Error, "unsupported bundle version")
 	})
+
+	t.Run("with no attestations", func(t *testing.T) {
+		attestations := []*api.Attestation{}
+		require.Len(t, attestations, 0)
+
+		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
+			Logger:      io.NewTestHandler(),
+			TrustedRoot: test.NormalizeRelativePath("../test/data/trusted_root.json"),
+		})
+
+		res := verifier.Verify(attestations, publicGoodPolicy(t))
+		require.Len(t, res.VerifyResults, 0)
+		require.NotNil(t, res.Error)
+	})
+
 }
 
 func publicGoodPolicy(t *testing.T) verify.PolicyBuilder {

From c2a7756c01fb9ae0e534f912bfe6200c8b999fe9 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 20:46:42 -0600
Subject: [PATCH 115/301] Reverse repo/shared package name change

---
 pkg/cmd/repo/create/create.go                          | 10 +++++-----
 pkg/cmd/repo/fork/fork.go                              |  4 ++--
 pkg/cmd/repo/shared/{format/format.go => repo.go}      |  2 +-
 .../shared/{format/format_test.go => repo_test.go}     |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)
 rename pkg/cmd/repo/shared/{format/format.go => repo.go} (96%)
 rename pkg/cmd/repo/shared/{format/format_test.go => repo_test.go} (98%)

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 46c7189da..3b3cac499 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -19,7 +19,7 @@ import (
 	"github.com/cli/cli/v2/git"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/ghrepo"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/format"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -317,9 +317,9 @@ func createFromScratch(opts *CreateOptions) error {
 			return err
 		}
 
-		targetRepo := format.NormalizeRepoName(opts.Name)
+		targetRepo := shared.NormalizeRepoName(opts.Name)
 		if idx := strings.IndexRune(opts.Name, '/'); idx > 0 {
-			targetRepo = opts.Name[0:idx+1] + format.NormalizeRepoName(opts.Name[idx+1:])
+			targetRepo = opts.Name[0:idx+1] + shared.NormalizeRepoName(opts.Name[idx+1:])
 		}
 		confirmed, err := opts.Prompter.Confirm(fmt.Sprintf(`This will create "%s" as a %s repository on GitHub. Continue?`, targetRepo, strings.ToLower(opts.Visibility)), true)
 		if err != nil {
@@ -476,9 +476,9 @@ func createFromTemplate(opts *CreateOptions) error {
 	}
 	templateRepoMainBranch := templateRepo.DefaultBranchRef.Name
 
-	targetRepo := format.NormalizeRepoName(opts.Name)
+	targetRepo := shared.NormalizeRepoName(opts.Name)
 	if idx := strings.IndexRune(opts.Name, '/'); idx > 0 {
-		targetRepo = opts.Name[0:idx+1] + format.NormalizeRepoName(opts.Name[idx+1:])
+		targetRepo = opts.Name[0:idx+1] + shared.NormalizeRepoName(opts.Name[idx+1:])
 	}
 	confirmed, err := opts.Prompter.Confirm(fmt.Sprintf(`This will create "%s" as a %s repository on GitHub. Continue?`, targetRepo, strings.ToLower(opts.Visibility)), true)
 	if err != nil {
diff --git a/pkg/cmd/repo/fork/fork.go b/pkg/cmd/repo/fork/fork.go
index 274af3083..a49f5d567 100644
--- a/pkg/cmd/repo/fork/fork.go
+++ b/pkg/cmd/repo/fork/fork.go
@@ -16,7 +16,7 @@ import (
 	"github.com/cli/cli/v2/git"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/ghrepo"
-	"github.com/cli/cli/v2/pkg/cmd/repo/shared/format"
+	"github.com/cli/cli/v2/pkg/cmd/repo/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -225,7 +225,7 @@ func forkRun(opts *ForkOptions) error {
 	}
 
 	// Rename the new repo if necessary
-	if opts.ForkName != "" && !strings.EqualFold(forkedRepo.RepoName(), format.NormalizeRepoName(opts.ForkName)) {
+	if opts.ForkName != "" && !strings.EqualFold(forkedRepo.RepoName(), shared.NormalizeRepoName(opts.ForkName)) {
 		forkedRepo, err = api.RenameRepo(apiClient, forkedRepo, opts.ForkName)
 		if err != nil {
 			return fmt.Errorf("could not rename fork: %w", err)
diff --git a/pkg/cmd/repo/shared/format/format.go b/pkg/cmd/repo/shared/repo.go
similarity index 96%
rename from pkg/cmd/repo/shared/format/format.go
rename to pkg/cmd/repo/shared/repo.go
index 5d29201ec..b980098b8 100644
--- a/pkg/cmd/repo/shared/format/format.go
+++ b/pkg/cmd/repo/shared/repo.go
@@ -1,4 +1,4 @@
-package format
+package shared
 
 import (
 	"regexp"
diff --git a/pkg/cmd/repo/shared/format/format_test.go b/pkg/cmd/repo/shared/repo_test.go
similarity index 98%
rename from pkg/cmd/repo/shared/format/format_test.go
rename to pkg/cmd/repo/shared/repo_test.go
index 6a781ac02..2e9251840 100644
--- a/pkg/cmd/repo/shared/format/format_test.go
+++ b/pkg/cmd/repo/shared/repo_test.go
@@ -1,4 +1,4 @@
-package format
+package shared
 
 import (
 	"testing"

From 4ecb125c7c4c88986901e853adcc4ed71cac9258 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:00:43 -0600
Subject: [PATCH 116/301] Update function names

Licenses are no longer referred to as templates. Prefix the new license and gitignore functions with "Repo" as a more descriptive name.
---
 api/queries_repo.go                 | 40 ++++++++++++++---------------
 api/queries_repo_test.go            | 12 ++++-----
 pkg/cmd/repo/create/create.go       |  8 +++---
 pkg/cmd/repo/gitignore/list/list.go |  2 +-
 pkg/cmd/repo/gitignore/view/view.go |  2 +-
 pkg/cmd/repo/license/list/list.go   |  2 +-
 pkg/cmd/repo/license/view/view.go   |  2 +-
 7 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/api/queries_repo.go b/api/queries_repo.go
index cf4d62f33..0fb168575 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -1408,34 +1408,34 @@ func RepoExists(client *Client, repo ghrepo.Interface) (bool, error) {
 	}
 }
 
-// ListLicenseTemplates fetches available repository license templates.
-// It uses API v3 because license template isn't supported by GraphQL.
-func ListLicenseTemplates(httpClient *http.Client, hostname string) ([]License, error) {
-	var licenseTemplates []License
+// RepoLicenses fetches available repository licenses.
+// It uses API v3 because licenses are not supported by GraphQL.
+func RepoLicenses(httpClient *http.Client, hostname string) ([]License, error) {
+	var licenses []License
 	client := NewClientFromHTTP(httpClient)
-	err := client.REST(hostname, "GET", "licenses", nil, &licenseTemplates)
+	err := client.REST(hostname, "GET", "licenses", nil, &licenses)
 	if err != nil {
 		return nil, err
 	}
-	return licenseTemplates, nil
+	return licenses, nil
 }
 
-// LicenseTemplate fetches an available repository license template.
-// It uses API v3 because license template isn't supported by GraphQL.
-func LicenseTemplate(httpClient *http.Client, hostname string, licenseTemplateName string) (License, error) {
-	var licenseTemplates License
+// RepoLicense fetches an available repository license.
+// It uses API v3 because licenses are not supported by GraphQL.
+func RepoLicense(httpClient *http.Client, hostname string, licenseName string) (License, error) {
+	var license License
 	client := NewClientFromHTTP(httpClient)
-	path := fmt.Sprintf("licenses/%s", licenseTemplateName)
-	err := client.REST(hostname, "GET", path, nil, &licenseTemplates)
+	path := fmt.Sprintf("licenses/%s", licenseName)
+	err := client.REST(hostname, "GET", path, nil, &license)
 	if err != nil {
 		return License{}, err
 	}
-	return licenseTemplates, nil
+	return license, nil
 }
 
-// ListGitIgnoreTemplates fetches available repository gitignore templates.
+// RepoGitIgnoreTemplates fetches available repository gitignore templates.
 // It uses API v3 here because gitignore template isn't supported by GraphQL.
-func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
+func RepoGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string, error) {
 	var gitIgnoreTemplates []string
 	client := NewClientFromHTTP(httpClient)
 	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
@@ -1445,15 +1445,15 @@ func ListGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 	return gitIgnoreTemplates, nil
 }
 
-// ViewGitIgnoreTemplate fetches available repository gitignore templates.
+// RepoGitIgnoreTemplate fetches an available repository gitignore template.
 // It uses API v3 here because gitignore template isn't supported by GraphQL.
-func GitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (GitIgnore, error) {
-	var gitIgnoreTemplateResponse GitIgnore
+func RepoGitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (GitIgnore, error) {
+	var gitIgnoreTemplate GitIgnore
 	client := NewClientFromHTTP(httpClient)
 	path := fmt.Sprintf("gitignore/templates/%s", gitIgnoreTemplateName)
-	err := client.REST(hostname, "GET", path, nil, &gitIgnoreTemplateResponse)
+	err := client.REST(hostname, "GET", path, nil, &gitIgnoreTemplate)
 	if err != nil {
 		return GitIgnore{}, err
 	}
-	return gitIgnoreTemplateResponse, nil
+	return gitIgnoreTemplate, nil
 }
diff --git a/api/queries_repo_test.go b/api/queries_repo_test.go
index 40707d630..0f9d58c8b 100644
--- a/api/queries_repo_test.go
+++ b/api/queries_repo_test.go
@@ -736,7 +736,7 @@ func TestListLicenseTemplatesReturnsLicenses(t *testing.T) {
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	gotLicenses, err := ListLicenseTemplates(client, hostname)
+	gotLicenses, err := RepoLicenses(client, hostname)
 
 	assert.NoError(t, err, "Expected no error while fetching /licenses")
 	assert.Equal(t, wantLicenses, gotLicenses, "Licenses fetched is not as expected")
@@ -810,7 +810,7 @@ func TestLicenseTemplateReturnsLicense(t *testing.T) {
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	gotLicenseTemplate, err := LicenseTemplate(client, hostname, licenseTemplateName)
+	gotLicenseTemplate, err := RepoLicense(client, hostname, licenseTemplateName)
 
 	assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /licenses/%v", licenseTemplateName))
 	assert.Equal(t, wantLicenseTemplate, gotLicenseTemplate, fmt.Sprintf("License \"%v\" fetched is not as expected", licenseTemplateName))
@@ -840,7 +840,7 @@ func TestLicenseTemplateReturnsErrorWhenLicenseTemplateNotFound(t *testing.T) {
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	_, err := LicenseTemplate(client, hostname, licenseTemplateName)
+	_, err := RepoLicense(client, hostname, licenseTemplateName)
 
 	assert.Error(t, err, fmt.Sprintf("Expected error while fetching /licenses/%v", licenseTemplateName))
 }
@@ -916,7 +916,7 @@ func TestListGitIgnoreTemplatesReturnsGitIgnoreTemplates(t *testing.T) {
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	gotGitIgnoreTemplates, err := ListGitIgnoreTemplates(client, hostname)
+	gotGitIgnoreTemplates, err := RepoGitIgnoreTemplates(client, hostname)
 
 	assert.NoError(t, err, "Expected no error while fetching /gitignore/templates")
 	assert.Equal(t, wantGitIgnoreTemplates, gotGitIgnoreTemplates, "GitIgnore templates fetched is not as expected")
@@ -947,7 +947,7 @@ func TestGitIgnoreTemplateReturnsGitIgnoreTemplate(t *testing.T) {
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	gotGitIgnoreTemplate, err := GitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
+	gotGitIgnoreTemplate, err := RepoGitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
 
 	assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /gitignore/templates/%v", gitIgnoreTemplateName))
 	assert.Equal(t, wantGitIgnoreTemplate, gotGitIgnoreTemplate, fmt.Sprintf("GitIgnore template \"%v\" fetched is not as expected", gitIgnoreTemplateName))
@@ -976,7 +976,7 @@ func TestGitIgnoreTemplateReturnsErrorWhenGitIgnoreTemplateNotFound(t *testing.T
 	client, _ := httpClient()
 	defer reg.Verify(t)
 
-	_, err := GitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
+	_, err := RepoGitIgnoreTemplate(client, "api.github.com", gitIgnoreTemplateName)
 
 	assert.Error(t, err, fmt.Sprintf("Expected error while fetching /gitignore/templates/%v", gitIgnoreTemplateName))
 }
diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 3b3cac499..8ac7453e6 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -227,7 +227,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		results, err := api.ListGitIgnoreTemplates(httpClient, hostname)
+		results, err := api.RepoGitIgnoreTemplates(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -244,7 +244,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			return nil, cobra.ShellCompDirectiveError
 		}
 		hostname, _ := cfg.Authentication().DefaultHost()
-		licenses, err := api.ListLicenseTemplates(httpClient, hostname)
+		licenses, err := api.RepoLicenses(httpClient, hostname)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
@@ -811,7 +811,7 @@ func interactiveGitIgnore(client *http.Client, hostname string, prompter iprompt
 		return "", nil
 	}
 
-	templates, err := api.ListGitIgnoreTemplates(client, hostname)
+	templates, err := api.RepoGitIgnoreTemplates(client, hostname)
 	if err != nil {
 		return "", err
 	}
@@ -830,7 +830,7 @@ func interactiveLicense(client *http.Client, hostname string, prompter iprompter
 		return "", nil
 	}
 
-	licenses, err := api.ListLicenseTemplates(client, hostname)
+	licenses, err := api.RepoLicenses(client, hostname)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index 78e402447..06072eb25 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -58,7 +58,7 @@ func listRun(opts *ListOptions) error {
 	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	gitIgnoreTemplates, err := api.ListGitIgnoreTemplates(client, hostname)
+	gitIgnoreTemplates, err := api.RepoGitIgnoreTemplates(client, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index 0614f0c46..1f543a9e5 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -70,7 +70,7 @@ func viewRun(opts *ViewOptions) error {
 	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	gitIgnore, err := api.GitIgnoreTemplate(client, hostname, opts.Template)
+	gitIgnore, err := api.RepoGitIgnoreTemplate(client, hostname, opts.Template)
 	if err != nil {
 		if strings.Contains(err.Error(), "HTTP 404") {
 			return fmt.Errorf("'%s' is not a valid gitignore template. Run `gh repo gitignore list` for options", opts.Template)
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 7d3bdadba..6fc7f40d6 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -58,7 +58,7 @@ func listRun(opts *ListOptions) error {
 	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	licenseTemplates, err := api.ListLicenseTemplates(client, hostname)
+	licenseTemplates, err := api.RepoLicenses(client, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 8af3731bd..3b8f586f9 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -69,7 +69,7 @@ func viewRun(opts *ViewOptions) error {
 	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	license, err := api.LicenseTemplate(client, hostname, opts.License)
+	license, err := api.RepoLicense(client, hostname, opts.License)
 	if err != nil {
 		if strings.Contains(err.Error(), "HTTP 404") {
 			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID. Run `gh repo license list` for options", opts.License)

From f064bda5eac0730407165e214f9fbf02376913aa Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:10:35 -0600
Subject: [PATCH 117/301] Add `Long` for license list indicating limitations

---
 pkg/cmd/repo/license/list/list.go | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 6fc7f40d6..74048c109 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/tableprinter"
@@ -26,8 +27,13 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 	}
 
 	cmd := &cobra.Command{
-		Use:     "list",
-		Short:   "List available repository license templates",
+		Use:   "list",
+		Short: "List available repository license templates",
+		Long: heredoc.Doc(`
+		List available repository license templates.
+		
+		Only the most commonly used licenses templates are returned. For even more licenses, visit <https://choosealicense.com/appendix>
+		`),
 		Aliases: []string{"ls"},
 		Args:    cmdutil.ExactArgs(0, "gh repo license list takes no arguments"),
 		RunE: func(cmd *cobra.Command, args []string) error {

From d6c6c6b40ce3b4474b16c14382a37511806c6374 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:12:02 -0600
Subject: [PATCH 118/301] Fix ExactArgs invocation

---
 pkg/cmd/repo/gitignore/list/list.go | 2 +-
 pkg/cmd/repo/gitignore/view/view.go | 2 +-
 pkg/cmd/repo/license/list/list.go   | 2 +-
 pkg/cmd/repo/license/view/view.go   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index 06072eb25..1e5fe034b 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -29,7 +29,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 		Use:     "list",
 		Short:   "List gitignore templates used in creating repositories",
 		Aliases: []string{"ls"},
-		Args:    cmdutil.ExactArgs(0, "gh repo gitignore list takes no arguments"),
+		Args:    cobra.ExactArgs(0),
 		RunE: func(cmd *cobra.Command, args []string) error {
 
 			if runF != nil {
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index 1f543a9e5..216e786f2 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -37,7 +37,7 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		
 		%[1]s<template>%[1]s is a case-sensitive %[1]s.gitignore%[1]s template name.
 		`, "`"),
-		Args: cmdutil.ExactArgs(1, "gh repo gitignore view only takes a single template argument"),
+		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Template = args[0]
 			if runF != nil {
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 74048c109..d02c8c6d1 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -35,7 +35,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 		Only the most commonly used licenses templates are returned. For even more licenses, visit <https://choosealicense.com/appendix>
 		`),
 		Aliases: []string{"ls"},
-		Args:    cmdutil.ExactArgs(0, "gh repo license list takes no arguments"),
+		Args:    cobra.ExactArgs(0),
 		RunE: func(cmd *cobra.Command, args []string) error {
 
 			if runF != nil {
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 3b8f586f9..863e6fb8c 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -36,7 +36,7 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		
 		%[1]s<license>%[1]s is a license name or SPDX ID.
 		`, "`"),
-		Args: cmdutil.ExactArgs(1, "gh repo licese view only takes a single license argument"),
+		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.License = args[0]
 			if runF != nil {

From 282b3293c5443c4ed278fc155085e771ac20c8fe Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:21:13 -0600
Subject: [PATCH 119/301] Add SPDX ID to license list output

---
 pkg/cmd/repo/license/list/list.go      |  3 ++-
 pkg/cmd/repo/license/list/list_test.go | 18 +++++++++---------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index d02c8c6d1..485a92df0 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -77,9 +77,10 @@ func listRun(opts *ListOptions) error {
 }
 
 func renderLicenseTemplatesTable(licenseTemplates []api.License, opts *ListOptions) error {
-	t := tableprinter.New(opts.IO, tableprinter.WithHeader("LICENSE KEY", "LICENSE NAME"))
+	t := tableprinter.New(opts.IO, tableprinter.WithHeader("LICENSE KEY", "SPDX ID", "LICENSE NAME"))
 	for _, l := range licenseTemplates {
 		t.AddField(l.Key)
+		t.AddField(l.SPDXID)
 		t.AddField(l.Name)
 		t.EndRow()
 	}
diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index b01d64d9a..b626a25d8 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -133,15 +133,15 @@ func TestListRun(t *testing.T) {
 					))
 			},
 			wantStdout: heredoc.Doc(`
-				LICENSE KEY  LICENSE NAME
-				mit          MIT License
-				lgpl-3.0     GNU Lesser General Public License v3.0
-				mpl-2.0      Mozilla Public License 2.0
-				agpl-3.0     GNU Affero General Public License v3.0
-				unlicense    The Unlicense
-				apache-2.0   Apache License 2.0
-				gpl-3.0      GNU General Public License v3.0
-				`),
+				LICENSE KEY  SPDX ID     LICENSE NAME
+				mit          MIT         MIT License
+				lgpl-3.0     LGPL-3.0    GNU Lesser General Public License v3.0
+				mpl-2.0      MPL-2.0     Mozilla Public License 2.0
+				agpl-3.0     AGPL-3.0    GNU Affero General Public License v3.0
+				unlicense    Unlicense   The Unlicense
+				apache-2.0   Apache-2.0  Apache License 2.0
+				gpl-3.0      GPL-3.0     GNU General Public License v3.0
+			`),
 			wantStderr: "",
 			opts:       &ListOptions{},
 		},

From f07f49810afdf6f65a14615296d320e568ef8a0f Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:41:54 -0600
Subject: [PATCH 120/301] Update help and fix heredoc indentation

---
 pkg/cmd/repo/create/create.go       |  2 +-
 pkg/cmd/repo/gitignore/list/list.go |  2 +-
 pkg/cmd/repo/gitignore/view/view.go | 15 ++++++++++++---
 pkg/cmd/repo/license/list/list.go   |  6 +++---
 pkg/cmd/repo/license/view/view.go   | 18 +++++++++++++++---
 5 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/pkg/cmd/repo/create/create.go b/pkg/cmd/repo/create/create.go
index 8ac7453e6..2fc127aba 100644
--- a/pkg/cmd/repo/create/create.go
+++ b/pkg/cmd/repo/create/create.go
@@ -98,7 +98,7 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 
 			For language or platform .gitignore templates to use with %[1]s--gitignore%[1]s, <https://github.com/github/gitignore>.
 
-			For license keywords to use with %[1]s--license%[1]s, <https://choosealicense.com/>.
+			For license keywords to use with %[1]s--license%[1]s, run %[1]sgh repo license list%[1]s or visit <https://choosealicense.com>.
 		`, "`"),
 		Example: heredoc.Doc(`
 			# create a repository interactively
diff --git a/pkg/cmd/repo/gitignore/list/list.go b/pkg/cmd/repo/gitignore/list/list.go
index 1e5fe034b..89dbefaf3 100644
--- a/pkg/cmd/repo/gitignore/list/list.go
+++ b/pkg/cmd/repo/gitignore/list/list.go
@@ -27,7 +27,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:     "list",
-		Short:   "List gitignore templates used in creating repositories",
+		Short:   "List available repository gitignore templates",
 		Aliases: []string{"ls"},
 		Args:    cobra.ExactArgs(0),
 		RunE: func(cmd *cobra.Command, args []string) error {
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index 216e786f2..82009820c 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -33,10 +33,19 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		Use:   "view <template>",
 		Short: "View an available repository gitignore template",
 		Long: heredoc.Docf(`
-		View an available repository %[1]s.gitignore%[1]s template.
-		
-		%[1]s<template>%[1]s is a case-sensitive %[1]s.gitignore%[1]s template name.
+			View an available repository %[1]s.gitignore%[1]s template.
+			
+			%[1]s<template>%[1]s is a case-sensitive %[1]s.gitignore%[1]s template name.
+
+			For a list of available templates, run %[1]sgh repo gitignore list%[1]s.
 		`, "`"),
+		Example: heredoc.Doc(`
+			# View the Go gitignore template
+			gh repo gitignore view Go
+
+			# View the Python gitignore template
+			gh repo gitignore view Python
+		`),
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Template = args[0]
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index 485a92df0..e3a6788aa 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -30,9 +30,9 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 		Use:   "list",
 		Short: "List available repository license templates",
 		Long: heredoc.Doc(`
-		List available repository license templates.
-		
-		Only the most commonly used licenses templates are returned. For even more licenses, visit <https://choosealicense.com/appendix>
+			List available repository license templates.
+			
+			Only the most commonly used licenses templates are returned. For even more licenses, visit <https://choosealicense.com/appendix>
 		`),
 		Aliases: []string{"ls"},
 		Args:    cobra.ExactArgs(0),
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 863e6fb8c..8cbf5b05b 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -32,10 +32,22 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		Use:   "view <license>",
 		Short: "View an available repository license template",
 		Long: heredoc.Docf(`
-		View an available repository license template.
-		
-		%[1]s<license>%[1]s is a license name or SPDX ID.
+			View an available repository license template.
+			
+			%[1]s<license>%[1]s can be a case-insensitive license name or SPDX ID.
+
+			Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit <https://choosealicense.com/appendix>.
 		`, "`"),
+		Example: heredoc.Doc(`
+			# View the MIT license template
+			gh repo license view MIT
+
+			# View the GNU AGPL-3.0 license template
+			gh repo license view AGPL-3.0
+
+			# View the Apache-2.0 license template
+			gh repo license view Apache-2.0
+		`),
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.License = args[0]

From a42d3e2f79efdc8487221728468c4554848ffc33 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 21:46:41 -0600
Subject: [PATCH 121/301] Fix license view help doc, add LICENSE.md example

---
 pkg/cmd/repo/license/view/view.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 8cbf5b05b..16f3b27a1 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -39,14 +39,17 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 			Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit <https://choosealicense.com/appendix>.
 		`, "`"),
 		Example: heredoc.Doc(`
-			# View the MIT license template
+			# View the MIT license
 			gh repo license view MIT
 
-			# View the GNU AGPL-3.0 license template
+			# View the GNU AGPL-3.0 license
 			gh repo license view AGPL-3.0
 
-			# View the Apache-2.0 license template
+			# View the Apache-2.0 license
 			gh repo license view Apache-2.0
+
+			# Create a LICENSE.md with the MIT license
+			gh repo license view MIT > LICENSE.md
 		`),
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {

From 8abed17a00cc9f959730bd6c6165de793ef67a82 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 22:21:26 -0600
Subject: [PATCH 122/301] implement `--web` flag for license view

---
 pkg/cmd/repo/license/view/view.go      | 18 ++++++-
 pkg/cmd/repo/license/view/view_test.go | 75 +++++++++++++++++++++-----
 2 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 16f3b27a1..c21086fbc 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -8,7 +8,9 @@ import (
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/browser"
 	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
@@ -19,6 +21,8 @@ type ViewOptions struct {
 	HTTPClient func() (*http.Client, error)
 	Config     func() (gh.Config, error)
 	License    string
+	Web        bool
+	Browser    browser.Browser
 }
 
 func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Command {
@@ -26,6 +30,7 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 		IO:         f.IOStreams,
 		HTTPClient: f.HttpClient,
 		Config:     f.Config,
+		Browser:    f.Browser,
 	}
 
 	cmd := &cobra.Command{
@@ -60,6 +65,9 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 			return viewRun(opts)
 		},
 	}
+
+	cmd.Flags().BoolVarP(&opts.Web, "web", "w", false, "Open https://choosealicense.com/ in the browser")
+
 	return cmd
 }
 
@@ -87,11 +95,19 @@ func viewRun(opts *ViewOptions) error {
 	license, err := api.RepoLicense(client, hostname, opts.License)
 	if err != nil {
 		if strings.Contains(err.Error(), "HTTP 404") {
-			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID. Run `gh repo license list` for options", opts.License)
+			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID.\n\nRun `gh repo license list` to see available commonly used licenses. For even more licenses, visit %s", opts.License, text.DisplayURL("https://choosealicense.com/appendix"))
 		}
 		return err
 	}
 
+	if opts.Web {
+		url := fmt.Sprintf("https://choosealicense.com/licenses/%s", license.Key)
+		if opts.IO.IsStdoutTTY() {
+			fmt.Fprintf(opts.IO.Out, "Opening %s in your browser.\n", text.DisplayURL(url))
+		}
+		return opts.Browser.Browse(url)
+	}
+
 	return renderLicense(license, opts)
 }
 
diff --git a/pkg/cmd/repo/license/view/view_test.go b/pkg/cmd/repo/license/view/view_test.go
index 00f109b39..009ff4135 100644
--- a/pkg/cmd/repo/license/view/view_test.go
+++ b/pkg/cmd/repo/license/view/view_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/browser"
 	"github.com/cli/cli/v2/internal/config"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/pkg/cmdutil"
@@ -80,21 +81,22 @@ func TestNewCmdView(t *testing.T) {
 
 func TestViewRun(t *testing.T) {
 	tests := []struct {
-		name       string
-		opts       *ViewOptions
-		isTTY      bool
-		httpStubs  func(t *testing.T, reg *httpmock.Registry)
-		wantStdout string
-		wantStderr string
-		wantErr    bool
-		errMsg     string
+		name           string
+		opts           *ViewOptions
+		isTTY          bool
+		httpStubs      func(reg *httpmock.Registry)
+		wantStdout     string
+		wantStderr     string
+		wantErr        bool
+		errMsg         string
+		wantBrowsedURL string
 	}{
 		{
 			name:    "happy path with license no tty",
 			opts:    &ViewOptions{License: "mit"},
 			wantErr: false,
 			isTTY:   false,
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+			httpStubs: func(reg *httpmock.Registry) {
 				reg.Register(
 					httpmock.REST("GET", "licenses/mit"),
 					httpmock.StringResponse(`{
@@ -152,7 +154,7 @@ func TestViewRun(t *testing.T) {
 			opts:    &ViewOptions{License: "mit"},
 			wantErr: false,
 			isTTY:   true,
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+			httpStubs: func(reg *httpmock.Registry) {
 				reg.Register(
 					httpmock.REST("GET", "licenses/mit"),
 					httpmock.StringResponse(`{
@@ -216,8 +218,11 @@ func TestViewRun(t *testing.T) {
 			name:    "License not found",
 			opts:    &ViewOptions{License: "404"},
 			wantErr: true,
-			errMsg:  "'404' is not a valid license template name or SPDX ID. Run `gh repo license list` for options",
-			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+			errMsg: heredoc.Docf(`
+				'404' is not a valid license template name or SPDX ID.
+				
+				Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit https://choosealicense.com/appendix`, "`"),
+			httpStubs: func(reg *httpmock.Registry) {
 				reg.Register(
 					httpmock.REST("GET", "licenses/404"),
 					httpmock.StatusStringResponse(404, `{
@@ -228,11 +233,51 @@ func TestViewRun(t *testing.T) {
 					))
 			},
 		},
+		{
+			name: "web flag happy path",
+			opts: &ViewOptions{
+				License: "mit",
+				Web:     true,
+			},
+			wantErr: false,
+			isTTY:   true,
+			httpStubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.REST("GET", "licenses/mit"),
+					httpmock.StringResponse(`{
+						"key": "mit",
+						"name": "MIT License",
+						"spdx_id": "MIT",
+						"url": "https://api.github.com/licenses/mit",
+						"node_id": "MDc6TGljZW5zZTEz",
+						"html_url": "http://choosealicense.com/licenses/mit/",
+						"description": "A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.",
+						"implementation": "Create a text file (typically named LICENSE or LICENSE.txt) in the root of your source code and copy the text of the license into the file. Replace [year] with the current year and [fullname] with the name (or names) of the copyright holders.",
+						"permissions": [
+							"commercial-use",
+							"modifications",
+							"distribution",
+							"private-use"
+						],
+						"conditions": [
+							"include-copyright"
+						],
+						"limitations": [
+							"liability",
+							"warranty"
+						],
+						"body": "MIT License\n\nCopyright (c) [year] [fullname]\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+						"featured": true
+						}`))
+			},
+			wantBrowsedURL: "https://choosealicense.com/licenses/mit",
+			wantStdout:     "Opening https://choosealicense.com/licenses/mit in your browser.\n",
+		},
 	}
 	for _, tt := range tests {
 		reg := &httpmock.Registry{}
 		if tt.httpStubs != nil {
-			tt.httpStubs(t, reg)
+			tt.httpStubs(reg)
 		}
 		tt.opts.Config = func() (gh.Config, error) {
 			return config.NewBlankConfig(), nil
@@ -246,6 +291,9 @@ func TestViewRun(t *testing.T) {
 		ios.SetStderrTTY(tt.isTTY)
 		tt.opts.IO = ios
 
+		browser := &browser.Stub{}
+		tt.opts.Browser = browser
+
 		t.Run(tt.name, func(t *testing.T) {
 			defer reg.Verify(t)
 			err := viewRun(tt.opts)
@@ -258,6 +306,7 @@ func TestViewRun(t *testing.T) {
 
 			assert.Equal(t, tt.wantStdout, stdout.String())
 			assert.Equal(t, tt.wantStderr, stderr.String())
+			assert.Equal(t, tt.wantBrowsedURL, browser.BrowsedURL())
 		})
 	}
 }

From 9b94bee895a47dae1c14529b991e9df09ee348ff Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 22:26:03 -0600
Subject: [PATCH 123/301] Refactor http error handling

---
 pkg/cmd/repo/gitignore/view/view.go | 7 +++++--
 pkg/cmd/repo/license/view/view.go   | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index 82009820c..a679ef946 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -81,8 +81,11 @@ func viewRun(opts *ViewOptions) error {
 	hostname, _ := cfg.Authentication().DefaultHost()
 	gitIgnore, err := api.RepoGitIgnoreTemplate(client, hostname, opts.Template)
 	if err != nil {
-		if strings.Contains(err.Error(), "HTTP 404") {
-			return fmt.Errorf("'%s' is not a valid gitignore template. Run `gh repo gitignore list` for options", opts.Template)
+		var httpErr api.HTTPError
+		if errors.As(err, &httpErr) {
+			if httpErr.StatusCode == 404 {
+				return fmt.Errorf("'%s' is not a valid gitignore template. Run `gh repo gitignore list` for options", opts.Template)
+			}
 		}
 		return err
 	}
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index c21086fbc..02100efa3 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -94,8 +94,11 @@ func viewRun(opts *ViewOptions) error {
 	hostname, _ := cfg.Authentication().DefaultHost()
 	license, err := api.RepoLicense(client, hostname, opts.License)
 	if err != nil {
-		if strings.Contains(err.Error(), "HTTP 404") {
-			return fmt.Errorf("'%s' is not a valid license template name or SPDX ID.\n\nRun `gh repo license list` to see available commonly used licenses. For even more licenses, visit %s", opts.License, text.DisplayURL("https://choosealicense.com/appendix"))
+		var httpErr api.HTTPError
+		if errors.As(err, &httpErr) {
+			if httpErr.StatusCode == 404 {
+				return fmt.Errorf("'%s' is not a valid license template name or SPDX ID.\n\nRun `gh repo license list` to see available commonly used licenses. For even more licenses, visit %s", opts.License, text.DisplayURL("https://choosealicense.com/appendix"))
+			}
 		}
 		return err
 	}

From 922a157206f5dc1685988f09fd94b88c5669ff09 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 22:34:06 -0600
Subject: [PATCH 124/301] Update help for license view

Updated `Use` to indicate that args can be an SPDX ID or license key.
Improved the examples docs to show the use of both.
---
 pkg/cmd/repo/license/view/view.go | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 02100efa3..76b334936 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -34,24 +34,27 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 	}
 
 	cmd := &cobra.Command{
-		Use:   "view <license>",
+		Use:   "view {<license-key> | <SPDX-ID>}",
 		Short: "View an available repository license template",
 		Long: heredoc.Docf(`
 			View an available repository license template.
 			
-			%[1]s<license>%[1]s can be a case-insensitive license name or SPDX ID.
+			Argument can be a case-insensitive license key or SPDX ID.
 
 			Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit <https://choosealicense.com/appendix>.
 		`, "`"),
 		Example: heredoc.Doc(`
-			# View the MIT license
+			# View the MIT license from SPDX ID
 			gh repo license view MIT
 
-			# View the GNU AGPL-3.0 license
+			# View the MIT license from license key
+			gh repo license view mit
+
+			# View the GNU AGPL-3.0 license from SPDX ID
 			gh repo license view AGPL-3.0
 
-			# View the Apache-2.0 license
-			gh repo license view Apache-2.0
+			# View the GNU AGPL-3.0 license from license key
+			gh repo license view agpl-3.0
 
 			# Create a LICENSE.md with the MIT license
 			gh repo license view MIT > LICENSE.md

From 95ca152fea6ef6ce6dbe25ed23879cb24bc7e71c Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 9 Oct 2024 22:51:24 -0600
Subject: [PATCH 125/301] Add examples for creating `.gitignore` files

---
 pkg/cmd/repo/gitignore/view/view.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index a679ef946..a3e0125b8 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -45,6 +45,12 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 
 			# View the Python gitignore template
 			gh repo gitignore view Python
+
+			# Create a new .gitignore file using the Go template
+			gh repo gitignore view Go > .gitignore
+
+			# Create a new .gitignore file using the Python template
+			gh repo gitignore view Python > .gitignore
 		`),
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {

From 28c2308458261f3961d25bde6bd7091062c41825 Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Thu, 10 Oct 2024 11:22:22 -0400
Subject: [PATCH 126/301] While we're at it, let's ensure VerifyCertExtensions
 can't be tricked the same way.

---
 pkg/cmd/attestation/verification/extensions.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verification/extensions.go b/pkg/cmd/attestation/verification/extensions.go
index 2ffb11a9d..94ba88208 100644
--- a/pkg/cmd/attestation/verification/extensions.go
+++ b/pkg/cmd/attestation/verification/extensions.go
@@ -16,12 +16,19 @@ func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner,
 		return errors.New("no attestations proccessing results")
 	}
 
+	var atLeastOneVerified bool
 	for _, attestation := range results {
 		if err := verifyCertExtensions(attestation, tenant, owner, repo, issuer); err != nil {
 			return err
 		}
+		atLeastOneVerified = true
+	}
+
+	if atLeastOneVerified {
+		return nil
+	} else {
+		return ErrNoAttestationsVerified
 	}
-	return nil
 }
 
 func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owner, repo, issuer string) error {

From d7465bdf3cb88a506a41c270cf4bcf3b51a4e8ff Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 8 Oct 2024 13:51:54 +0200
Subject: [PATCH 127/301] Initial testscript introduction

---
 acceptance/pr_test.go                         |  85 ++++++
 acceptance/testdata/pr/pr-create-basic.txt    |  24 ++
 cmd/gh/main.go                                | 268 +----------------
 go.mod                                        |   2 +
 go.sum                                        |   8 +-
 internal/ghcmd/cmd.go                         | 271 ++++++++++++++++++
 .../ghcmd/cmd_test.go                         |   2 +-
 7 files changed, 389 insertions(+), 271 deletions(-)
 create mode 100644 acceptance/pr_test.go
 create mode 100644 acceptance/testdata/pr/pr-create-basic.txt
 create mode 100644 internal/ghcmd/cmd.go
 rename cmd/gh/main_test.go => internal/ghcmd/cmd_test.go (99%)

diff --git a/acceptance/pr_test.go b/acceptance/pr_test.go
new file mode 100644
index 000000000..38f3e1f79
--- /dev/null
+++ b/acceptance/pr_test.go
@@ -0,0 +1,85 @@
+package acceptance_test
+
+import (
+	"os"
+	"path"
+	"strings"
+	"testing"
+
+	"math/rand"
+
+	"github.com/cli/cli/v2/internal/ghcmd"
+	"github.com/rogpeppe/go-internal/testscript"
+)
+
+func ghMain() int {
+	return int(ghcmd.Main())
+}
+
+func TestMain(m *testing.M) {
+	os.Exit(testscript.RunMain(m, map[string]func() int{
+		"gh": ghMain,
+	}))
+}
+
+func TestPullRequests(t *testing.T) {
+	testscript.Run(t, params("pr"))
+}
+
+func params(dir string) testscript.Params {
+	return testscript.Params{
+		Dir:                 path.Join("testdata", dir),
+		Files:               []string{},
+		Setup:               sharedSetup,
+		Cmds:                sharedCmds,
+		RequireExplicitExec: true,
+		RequireUniqueNames:  true,
+	}
+}
+
+var sharedSetup = func(ts *testscript.Env) error {
+	scriptName, ok := extractScriptName(ts.Vars)
+	if !ok {
+		ts.T().Fatal("script name not found")
+	}
+	ts.Setenv("SCRIPT_NAME", scriptName)
+
+	ts.Setenv("HOME", ts.Cd)
+	ts.Setenv("GH_CONFIG_DIR", ts.Cd)
+
+	ts.Setenv("GH_TOKEN", os.Getenv("GH_TOKEN"))
+
+	ts.Setenv("ORG", os.Getenv("GH_ACCEPTANCE_ORG"))
+
+	ts.Setenv("RANDOM_STRING", randomString(10))
+	return nil
+}
+
+var sharedCmds = map[string]func(ts *testscript.TestScript, neg bool, args []string){
+	"defer": func(ts *testscript.TestScript, neg bool, args []string) {
+		ts.Defer(func() {
+			if err := ts.Exec(args[0], args[1:]...); err != nil {
+				ts.Fatalf("deferred command failed: %v", err)
+			}
+		})
+	}}
+
+var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+
+func randomString(n int) string {
+	b := make([]rune, n)
+	for i := range b {
+		b[i] = letters[rand.Intn(len(letters))]
+	}
+	return string(b)
+}
+
+func extractScriptName(vars []string) (string, bool) {
+	for _, kv := range vars {
+		if strings.HasPrefix(kv, "WORK=") {
+			v := strings.Split(kv, "=")[1]
+			return strings.CutPrefix(path.Base(v), "script-")
+		}
+	}
+	return "", false
+}
diff --git a/acceptance/testdata/pr/pr-create-basic.txt b/acceptance/testdata/pr/pr-create-basic.txt
new file mode 100644
index 000000000..46d1de990
--- /dev/null
+++ b/acceptance/testdata/pr/pr-create-basic.txt
@@ -0,0 +1,24 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty Commit'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+
+# Check the PR is indeed created
+exec gh pr list
+stdout 'Feature Title'
diff --git a/cmd/gh/main.go b/cmd/gh/main.go
index 0b9af0215..e167bc6f4 100644
--- a/cmd/gh/main.go
+++ b/cmd/gh/main.go
@@ -1,276 +1,12 @@
 package main
 
 import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
 	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
 
-	surveyCore "github.com/AlecAivazis/survey/v2/core"
-	"github.com/AlecAivazis/survey/v2/terminal"
-	"github.com/cli/cli/v2/api"
-	"github.com/cli/cli/v2/internal/build"
-	"github.com/cli/cli/v2/internal/config"
-	"github.com/cli/cli/v2/internal/config/migration"
-	"github.com/cli/cli/v2/internal/update"
-	"github.com/cli/cli/v2/pkg/cmd/factory"
-	"github.com/cli/cli/v2/pkg/cmd/root"
-	"github.com/cli/cli/v2/pkg/cmdutil"
-	"github.com/cli/cli/v2/pkg/iostreams"
-	"github.com/cli/cli/v2/utils"
-	"github.com/cli/safeexec"
-	"github.com/mattn/go-isatty"
-	"github.com/mgutz/ansi"
-	"github.com/spf13/cobra"
-)
-
-var updaterEnabled = ""
-
-type exitCode int
-
-const (
-	exitOK      exitCode = 0
-	exitError   exitCode = 1
-	exitCancel  exitCode = 2
-	exitAuth    exitCode = 4
-	exitPending exitCode = 8
+	"github.com/cli/cli/v2/internal/ghcmd"
 )
 
 func main() {
-	code := mainRun()
+	code := ghcmd.Main()
 	os.Exit(int(code))
 }
-
-func mainRun() exitCode {
-	buildDate := build.Date
-	buildVersion := build.Version
-	hasDebug, _ := utils.IsDebugEnabled()
-
-	cmdFactory := factory.New(buildVersion)
-	stderr := cmdFactory.IOStreams.ErrOut
-
-	ctx := context.Background()
-
-	if cfg, err := cmdFactory.Config(); err == nil {
-		var m migration.MultiAccount
-		if err := cfg.Migrate(m); err != nil {
-			fmt.Fprintln(stderr, err)
-			return exitError
-		}
-	}
-
-	updateCtx, updateCancel := context.WithCancel(ctx)
-	defer updateCancel()
-	updateMessageChan := make(chan *update.ReleaseInfo)
-	go func() {
-		rel, err := checkForUpdate(updateCtx, cmdFactory, buildVersion)
-		if err != nil && hasDebug {
-			fmt.Fprintf(stderr, "warning: checking for update failed: %v", err)
-		}
-		updateMessageChan <- rel
-	}()
-
-	if !cmdFactory.IOStreams.ColorEnabled() {
-		surveyCore.DisableColor = true
-		ansi.DisableColors(true)
-	} else {
-		// override survey's poor choice of color
-		surveyCore.TemplateFuncsWithColor["color"] = func(style string) string {
-			switch style {
-			case "white":
-				return ansi.ColorCode("default")
-			default:
-				return ansi.ColorCode(style)
-			}
-		}
-	}
-
-	// Enable running gh from Windows File Explorer's address bar. Without this, the user is told to stop and run from a
-	// terminal. With this, a user can clone a repo (or take other actions) directly from explorer.
-	if len(os.Args) > 1 && os.Args[1] != "" {
-		cobra.MousetrapHelpText = ""
-	}
-
-	rootCmd, err := root.NewCmdRoot(cmdFactory, buildVersion, buildDate)
-	if err != nil {
-		fmt.Fprintf(stderr, "failed to create root command: %s\n", err)
-		return exitError
-	}
-
-	expandedArgs := []string{}
-	if len(os.Args) > 0 {
-		expandedArgs = os.Args[1:]
-	}
-
-	// translate `gh help <command>` to `gh <command> --help` for extensions.
-	if len(expandedArgs) >= 2 && expandedArgs[0] == "help" && isExtensionCommand(rootCmd, expandedArgs[1:]) {
-		expandedArgs = expandedArgs[1:]
-		expandedArgs = append(expandedArgs, "--help")
-	}
-
-	rootCmd.SetArgs(expandedArgs)
-
-	if cmd, err := rootCmd.ExecuteContextC(ctx); err != nil {
-		var pagerPipeError *iostreams.ErrClosedPagerPipe
-		var noResultsError cmdutil.NoResultsError
-		var extError *root.ExternalCommandExitError
-		var authError *root.AuthError
-		if err == cmdutil.SilentError {
-			return exitError
-		} else if err == cmdutil.PendingError {
-			return exitPending
-		} else if cmdutil.IsUserCancellation(err) {
-			if errors.Is(err, terminal.InterruptErr) {
-				// ensure the next shell prompt will start on its own line
-				fmt.Fprint(stderr, "\n")
-			}
-			return exitCancel
-		} else if errors.As(err, &authError) {
-			return exitAuth
-		} else if errors.As(err, &pagerPipeError) {
-			// ignore the error raised when piping to a closed pager
-			return exitOK
-		} else if errors.As(err, &noResultsError) {
-			if cmdFactory.IOStreams.IsStdoutTTY() {
-				fmt.Fprintln(stderr, noResultsError.Error())
-			}
-			// no results is not a command failure
-			return exitOK
-		} else if errors.As(err, &extError) {
-			// pass on exit codes from extensions and shell aliases
-			return exitCode(extError.ExitCode())
-		}
-
-		printError(stderr, err, cmd, hasDebug)
-
-		if strings.Contains(err.Error(), "Incorrect function") {
-			fmt.Fprintln(stderr, "You appear to be running in MinTTY without pseudo terminal support.")
-			fmt.Fprintln(stderr, "To learn about workarounds for this error, run:  gh help mintty")
-			return exitError
-		}
-
-		var httpErr api.HTTPError
-		if errors.As(err, &httpErr) && httpErr.StatusCode == 401 {
-			fmt.Fprintln(stderr, "Try authenticating with:  gh auth login")
-		} else if u := factory.SSOURL(); u != "" {
-			// handles organization SAML enforcement error
-			fmt.Fprintf(stderr, "Authorize in your web browser:  %s\n", u)
-		} else if msg := httpErr.ScopesSuggestion(); msg != "" {
-			fmt.Fprintln(stderr, msg)
-		}
-
-		return exitError
-	}
-	if root.HasFailed() {
-		return exitError
-	}
-
-	updateCancel() // if the update checker hasn't completed by now, abort it
-	newRelease := <-updateMessageChan
-	if newRelease != nil {
-		isHomebrew := isUnderHomebrew(cmdFactory.Executable())
-		if isHomebrew && isRecentRelease(newRelease.PublishedAt) {
-			// do not notify Homebrew users before the version bump had a chance to get merged into homebrew-core
-			return exitOK
-		}
-		fmt.Fprintf(stderr, "\n\n%s %s → %s\n",
-			ansi.Color("A new release of gh is available:", "yellow"),
-			ansi.Color(strings.TrimPrefix(buildVersion, "v"), "cyan"),
-			ansi.Color(strings.TrimPrefix(newRelease.Version, "v"), "cyan"))
-		if isHomebrew {
-			fmt.Fprintf(stderr, "To upgrade, run: %s\n", "brew upgrade gh")
-		}
-		fmt.Fprintf(stderr, "%s\n\n",
-			ansi.Color(newRelease.URL, "yellow"))
-	}
-
-	return exitOK
-}
-
-// isExtensionCommand returns true if args resolve to an extension command.
-func isExtensionCommand(rootCmd *cobra.Command, args []string) bool {
-	c, _, err := rootCmd.Find(args)
-	return err == nil && c != nil && c.GroupID == "extension"
-}
-
-func printError(out io.Writer, err error, cmd *cobra.Command, debug bool) {
-	var dnsError *net.DNSError
-	if errors.As(err, &dnsError) {
-		fmt.Fprintf(out, "error connecting to %s\n", dnsError.Name)
-		if debug {
-			fmt.Fprintln(out, dnsError)
-		}
-		fmt.Fprintln(out, "check your internet connection or https://githubstatus.com")
-		return
-	}
-
-	fmt.Fprintln(out, err)
-
-	var flagError *cmdutil.FlagError
-	if errors.As(err, &flagError) || strings.HasPrefix(err.Error(), "unknown command ") {
-		if !strings.HasSuffix(err.Error(), "\n") {
-			fmt.Fprintln(out)
-		}
-		fmt.Fprintln(out, cmd.UsageString())
-	}
-}
-
-func shouldCheckForUpdate() bool {
-	if os.Getenv("GH_NO_UPDATE_NOTIFIER") != "" {
-		return false
-	}
-	if os.Getenv("CODESPACES") != "" {
-		return false
-	}
-	return updaterEnabled != "" && !isCI() && isTerminal(os.Stdout) && isTerminal(os.Stderr)
-}
-
-func isTerminal(f *os.File) bool {
-	return isatty.IsTerminal(f.Fd()) || isatty.IsCygwinTerminal(f.Fd())
-}
-
-// based on https://github.com/watson/ci-info/blob/HEAD/index.js
-func isCI() bool {
-	return os.Getenv("CI") != "" || // GitHub Actions, Travis CI, CircleCI, Cirrus CI, GitLab CI, AppVeyor, CodeShip, dsari
-		os.Getenv("BUILD_NUMBER") != "" || // Jenkins, TeamCity
-		os.Getenv("RUN_ID") != "" // TaskCluster, dsari
-}
-
-func checkForUpdate(ctx context.Context, f *cmdutil.Factory, currentVersion string) (*update.ReleaseInfo, error) {
-	if !shouldCheckForUpdate() {
-		return nil, nil
-	}
-	httpClient, err := f.HttpClient()
-	if err != nil {
-		return nil, err
-	}
-	repo := updaterEnabled
-	stateFilePath := filepath.Join(config.StateDir(), "state.yml")
-	return update.CheckForUpdate(ctx, httpClient, stateFilePath, repo, currentVersion)
-}
-
-func isRecentRelease(publishedAt time.Time) bool {
-	return !publishedAt.IsZero() && time.Since(publishedAt) < time.Hour*24
-}
-
-// Check whether the gh binary was found under the Homebrew prefix
-func isUnderHomebrew(ghBinary string) bool {
-	brewExe, err := safeexec.LookPath("brew")
-	if err != nil {
-		return false
-	}
-
-	brewPrefixBytes, err := exec.Command(brewExe, "--prefix").Output()
-	if err != nil {
-		return false
-	}
-
-	brewBinPrefix := filepath.Join(strings.TrimSpace(string(brewPrefixBytes)), "bin") + string(filepath.Separator)
-	return strings.HasPrefix(ghBinary, brewBinPrefix)
-}
diff --git a/go.mod b/go.mod
index e638459fa..42e3c84e6 100644
--- a/go.mod
+++ b/go.mod
@@ -125,6 +125,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rodaine/table v1.0.1 // indirect
+	github.com/rogpeppe/go-internal v1.13.1
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
@@ -160,6 +161,7 @@ require (
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
 	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index d1a85b60e..9a1fc23ee 100644
--- a/go.sum
+++ b/go.sum
@@ -366,8 +366,8 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rodaine/table v1.0.1 h1:U/VwCnUxlVYxw8+NJiLIuCxA/xa6jL38MY3FYysVWWQ=
 github.com/rodaine/table v1.0.1/go.mod h1:UVEtfBsflpeEcD56nF4F5AocNFta0ZuolpSVdPtlmP4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
@@ -533,8 +533,8 @@ golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
+golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.172.0 h1:/1OcMZGPmW1rX2LCu2CmGUD1KXK1+pfzxotxyRUCCdk=
 google.golang.org/api v0.172.0/go.mod h1:+fJZq6QXWfa9pXhnIzsjx4yI22d4aI9ZpLb58gvXjis=
diff --git a/internal/ghcmd/cmd.go b/internal/ghcmd/cmd.go
new file mode 100644
index 000000000..d5a674184
--- /dev/null
+++ b/internal/ghcmd/cmd.go
@@ -0,0 +1,271 @@
+package ghcmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	surveyCore "github.com/AlecAivazis/survey/v2/core"
+	"github.com/AlecAivazis/survey/v2/terminal"
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/internal/build"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/config/migration"
+	"github.com/cli/cli/v2/internal/update"
+	"github.com/cli/cli/v2/pkg/cmd/factory"
+	"github.com/cli/cli/v2/pkg/cmd/root"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/cli/cli/v2/utils"
+	"github.com/cli/safeexec"
+	"github.com/mattn/go-isatty"
+	"github.com/mgutz/ansi"
+	"github.com/spf13/cobra"
+)
+
+var updaterEnabled = ""
+
+type exitCode int
+
+const (
+	exitOK      exitCode = 0
+	exitError   exitCode = 1
+	exitCancel  exitCode = 2
+	exitAuth    exitCode = 4
+	exitPending exitCode = 8
+)
+
+func Main() exitCode {
+	buildDate := build.Date
+	buildVersion := build.Version
+	hasDebug, _ := utils.IsDebugEnabled()
+
+	cmdFactory := factory.New(buildVersion)
+	stderr := cmdFactory.IOStreams.ErrOut
+
+	ctx := context.Background()
+
+	if cfg, err := cmdFactory.Config(); err == nil {
+		var m migration.MultiAccount
+		if err := cfg.Migrate(m); err != nil {
+			fmt.Fprintln(stderr, err)
+			return exitError
+		}
+	}
+
+	updateCtx, updateCancel := context.WithCancel(ctx)
+	defer updateCancel()
+	updateMessageChan := make(chan *update.ReleaseInfo)
+	go func() {
+		rel, err := checkForUpdate(updateCtx, cmdFactory, buildVersion)
+		if err != nil && hasDebug {
+			fmt.Fprintf(stderr, "warning: checking for update failed: %v", err)
+		}
+		updateMessageChan <- rel
+	}()
+
+	if !cmdFactory.IOStreams.ColorEnabled() {
+		surveyCore.DisableColor = true
+		ansi.DisableColors(true)
+	} else {
+		// override survey's poor choice of color
+		surveyCore.TemplateFuncsWithColor["color"] = func(style string) string {
+			switch style {
+			case "white":
+				return ansi.ColorCode("default")
+			default:
+				return ansi.ColorCode(style)
+			}
+		}
+	}
+
+	// Enable running gh from Windows File Explorer's address bar. Without this, the user is told to stop and run from a
+	// terminal. With this, a user can clone a repo (or take other actions) directly from explorer.
+	if len(os.Args) > 1 && os.Args[1] != "" {
+		cobra.MousetrapHelpText = ""
+	}
+
+	rootCmd, err := root.NewCmdRoot(cmdFactory, buildVersion, buildDate)
+	if err != nil {
+		fmt.Fprintf(stderr, "failed to create root command: %s\n", err)
+		return exitError
+	}
+
+	expandedArgs := []string{}
+	if len(os.Args) > 0 {
+		expandedArgs = os.Args[1:]
+	}
+
+	// translate `gh help <command>` to `gh <command> --help` for extensions.
+	if len(expandedArgs) >= 2 && expandedArgs[0] == "help" && isExtensionCommand(rootCmd, expandedArgs[1:]) {
+		expandedArgs = expandedArgs[1:]
+		expandedArgs = append(expandedArgs, "--help")
+	}
+
+	rootCmd.SetArgs(expandedArgs)
+
+	if cmd, err := rootCmd.ExecuteContextC(ctx); err != nil {
+		var pagerPipeError *iostreams.ErrClosedPagerPipe
+		var noResultsError cmdutil.NoResultsError
+		var extError *root.ExternalCommandExitError
+		var authError *root.AuthError
+		if err == cmdutil.SilentError {
+			return exitError
+		} else if err == cmdutil.PendingError {
+			return exitPending
+		} else if cmdutil.IsUserCancellation(err) {
+			if errors.Is(err, terminal.InterruptErr) {
+				// ensure the next shell prompt will start on its own line
+				fmt.Fprint(stderr, "\n")
+			}
+			return exitCancel
+		} else if errors.As(err, &authError) {
+			return exitAuth
+		} else if errors.As(err, &pagerPipeError) {
+			// ignore the error raised when piping to a closed pager
+			return exitOK
+		} else if errors.As(err, &noResultsError) {
+			if cmdFactory.IOStreams.IsStdoutTTY() {
+				fmt.Fprintln(stderr, noResultsError.Error())
+			}
+			// no results is not a command failure
+			return exitOK
+		} else if errors.As(err, &extError) {
+			// pass on exit codes from extensions and shell aliases
+			return exitCode(extError.ExitCode())
+		}
+
+		printError(stderr, err, cmd, hasDebug)
+
+		if strings.Contains(err.Error(), "Incorrect function") {
+			fmt.Fprintln(stderr, "You appear to be running in MinTTY without pseudo terminal support.")
+			fmt.Fprintln(stderr, "To learn about workarounds for this error, run:  gh help mintty")
+			return exitError
+		}
+
+		var httpErr api.HTTPError
+		if errors.As(err, &httpErr) && httpErr.StatusCode == 401 {
+			fmt.Fprintln(stderr, "Try authenticating with:  gh auth login")
+		} else if u := factory.SSOURL(); u != "" {
+			// handles organization SAML enforcement error
+			fmt.Fprintf(stderr, "Authorize in your web browser:  %s\n", u)
+		} else if msg := httpErr.ScopesSuggestion(); msg != "" {
+			fmt.Fprintln(stderr, msg)
+		}
+
+		return exitError
+	}
+	if root.HasFailed() {
+		return exitError
+	}
+
+	updateCancel() // if the update checker hasn't completed by now, abort it
+	newRelease := <-updateMessageChan
+	if newRelease != nil {
+		isHomebrew := isUnderHomebrew(cmdFactory.Executable())
+		if isHomebrew && isRecentRelease(newRelease.PublishedAt) {
+			// do not notify Homebrew users before the version bump had a chance to get merged into homebrew-core
+			return exitOK
+		}
+		fmt.Fprintf(stderr, "\n\n%s %s → %s\n",
+			ansi.Color("A new release of gh is available:", "yellow"),
+			ansi.Color(strings.TrimPrefix(buildVersion, "v"), "cyan"),
+			ansi.Color(strings.TrimPrefix(newRelease.Version, "v"), "cyan"))
+		if isHomebrew {
+			fmt.Fprintf(stderr, "To upgrade, run: %s\n", "brew upgrade gh")
+		}
+		fmt.Fprintf(stderr, "%s\n\n",
+			ansi.Color(newRelease.URL, "yellow"))
+	}
+
+	return exitOK
+}
+
+// isExtensionCommand returns true if args resolve to an extension command.
+func isExtensionCommand(rootCmd *cobra.Command, args []string) bool {
+	c, _, err := rootCmd.Find(args)
+	return err == nil && c != nil && c.GroupID == "extension"
+}
+
+func printError(out io.Writer, err error, cmd *cobra.Command, debug bool) {
+	var dnsError *net.DNSError
+	if errors.As(err, &dnsError) {
+		fmt.Fprintf(out, "error connecting to %s\n", dnsError.Name)
+		if debug {
+			fmt.Fprintln(out, dnsError)
+		}
+		fmt.Fprintln(out, "check your internet connection or https://githubstatus.com")
+		return
+	}
+
+	fmt.Fprintln(out, err)
+
+	var flagError *cmdutil.FlagError
+	if errors.As(err, &flagError) || strings.HasPrefix(err.Error(), "unknown command ") {
+		if !strings.HasSuffix(err.Error(), "\n") {
+			fmt.Fprintln(out)
+		}
+		fmt.Fprintln(out, cmd.UsageString())
+	}
+}
+
+func shouldCheckForUpdate() bool {
+	if os.Getenv("GH_NO_UPDATE_NOTIFIER") != "" {
+		return false
+	}
+	if os.Getenv("CODESPACES") != "" {
+		return false
+	}
+	return updaterEnabled != "" && !isCI() && isTerminal(os.Stdout) && isTerminal(os.Stderr)
+}
+
+func isTerminal(f *os.File) bool {
+	return isatty.IsTerminal(f.Fd()) || isatty.IsCygwinTerminal(f.Fd())
+}
+
+// based on https://github.com/watson/ci-info/blob/HEAD/index.js
+func isCI() bool {
+	return os.Getenv("CI") != "" || // GitHub Actions, Travis CI, CircleCI, Cirrus CI, GitLab CI, AppVeyor, CodeShip, dsari
+		os.Getenv("BUILD_NUMBER") != "" || // Jenkins, TeamCity
+		os.Getenv("RUN_ID") != "" // TaskCluster, dsari
+}
+
+func checkForUpdate(ctx context.Context, f *cmdutil.Factory, currentVersion string) (*update.ReleaseInfo, error) {
+	if !shouldCheckForUpdate() {
+		return nil, nil
+	}
+	httpClient, err := f.HttpClient()
+	if err != nil {
+		return nil, err
+	}
+	repo := updaterEnabled
+	stateFilePath := filepath.Join(config.StateDir(), "state.yml")
+	return update.CheckForUpdate(ctx, httpClient, stateFilePath, repo, currentVersion)
+}
+
+func isRecentRelease(publishedAt time.Time) bool {
+	return !publishedAt.IsZero() && time.Since(publishedAt) < time.Hour*24
+}
+
+// Check whether the gh binary was found under the Homebrew prefix
+func isUnderHomebrew(ghBinary string) bool {
+	brewExe, err := safeexec.LookPath("brew")
+	if err != nil {
+		return false
+	}
+
+	brewPrefixBytes, err := exec.Command(brewExe, "--prefix").Output()
+	if err != nil {
+		return false
+	}
+
+	brewBinPrefix := filepath.Join(strings.TrimSpace(string(brewPrefixBytes)), "bin") + string(filepath.Separator)
+	return strings.HasPrefix(ghBinary, brewBinPrefix)
+}
diff --git a/cmd/gh/main_test.go b/internal/ghcmd/cmd_test.go
similarity index 99%
rename from cmd/gh/main_test.go
rename to internal/ghcmd/cmd_test.go
index 01552b2bd..08bbceb85 100644
--- a/cmd/gh/main_test.go
+++ b/internal/ghcmd/cmd_test.go
@@ -1,4 +1,4 @@
-package main
+package ghcmd
 
 import (
 	"bytes"

From 5ed237c65a9ca79afa8660447a18e653a518de4b Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 8 Oct 2024 14:14:31 +0200
Subject: [PATCH 128/301] Add pr view test script

---
 acceptance/testdata/pr/pr-view.txt | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 acceptance/testdata/pr/pr-view.txt

diff --git a/acceptance/testdata/pr/pr-view.txt b/acceptance/testdata/pr/pr-view.txt
new file mode 100644
index 000000000..01566edb8
--- /dev/null
+++ b/acceptance/testdata/pr/pr-view.txt
@@ -0,0 +1,24 @@
+# Setup git
+exec gh auth setup-git
+
+# Create a repo
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --private --add-readme
+
+# Defer cleanup
+defer gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch for PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty commit'
+exec git push -u origin feature-branch
+
+# Create a PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+
+# View the PR (TODO: can we somehow get the stdout of the last command)
+exec gh pr view
+stdout 'Feature Title'

From 37171628c6e7017442d9125270f74c5f9e24223c Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 8 Oct 2024 14:33:17 +0200
Subject: [PATCH 129/301] Acceptance test PR checkout

---
 acceptance/testdata/pr/pr-checkout.txt | 29 ++++++++++++++++++++++++++
 acceptance/testdata/pr/pr-view.txt     | 20 +++++++++---------
 2 files changed, 39 insertions(+), 10 deletions(-)
 create mode 100644 acceptance/testdata/pr/pr-checkout.txt

diff --git a/acceptance/testdata/pr/pr-checkout.txt b/acceptance/testdata/pr/pr-checkout.txt
new file mode 100644
index 000000000..d02c42076
--- /dev/null
+++ b/acceptance/testdata/pr/pr-checkout.txt
@@ -0,0 +1,29 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty Commit'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+
+# Remove the local branch
+exec git checkout main
+exec git branch -D feature-branch
+stdout 'Deleted branch feature-branch'
+
+# Checkout the PR
+exec gh pr checkout 1
+stderr 'Switched to a new branch ''feature-branch'''
diff --git a/acceptance/testdata/pr/pr-view.txt b/acceptance/testdata/pr/pr-view.txt
index 01566edb8..c9dfcd3a6 100644
--- a/acceptance/testdata/pr/pr-view.txt
+++ b/acceptance/testdata/pr/pr-view.txt
@@ -1,24 +1,24 @@
-# Setup git
+# Use gh as a credential helper
 exec gh auth setup-git
 
-# Create a repo
-exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --private --add-readme
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
-# Defer cleanup
-defer gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Clone the repo
 exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
-# Prepare a branch for PR
+# Prepare a branch to PR
 cd $SCRIPT_NAME-$RANDOM_STRING
 exec git checkout -b feature-branch
-exec git commit --allow-empty -m 'Empty commit'
+exec git commit --allow-empty -m 'Empty Commit'
 exec git push -u origin feature-branch
 
-# Create a PR
+# Create the PR
 exec gh pr create --title 'Feature Title' --body 'Feature Body'
 
-# View the PR (TODO: can we somehow get the stdout of the last command)
-exec gh pr view
+# View the PR
+exec gh pr view 1
 stdout 'Feature Title'

From 464a69ae87f8b36c40b429de0e9e283a74bf2897 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 8 Oct 2024 15:12:13 +0200
Subject: [PATCH 130/301] Use stdout2env in PR acceptance tests

---
 acceptance/pr_test.go                  | 17 +++++++++++++----
 acceptance/testdata/pr/pr-checkout.txt |  3 ++-
 acceptance/testdata/pr/pr-view.txt     |  3 ++-
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/acceptance/pr_test.go b/acceptance/pr_test.go
index 38f3e1f79..563526f6f 100644
--- a/acceptance/pr_test.go
+++ b/acceptance/pr_test.go
@@ -58,11 +58,20 @@ var sharedSetup = func(ts *testscript.Env) error {
 var sharedCmds = map[string]func(ts *testscript.TestScript, neg bool, args []string){
 	"defer": func(ts *testscript.TestScript, neg bool, args []string) {
 		ts.Defer(func() {
-			if err := ts.Exec(args[0], args[1:]...); err != nil {
-				ts.Fatalf("deferred command failed: %v", err)
-			}
+			ts.Check(ts.Exec(args[0], args[1:]...))
 		})
-	}}
+	},
+	"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
+		if neg {
+			ts.Fatalf("unsupported: ! stdout2env")
+		}
+		if len(args) != 1 {
+			ts.Fatalf("usage: stdout2env name")
+		}
+
+		ts.Setenv(args[0], strings.TrimRight(ts.ReadFile("stdout"), "\n"))
+	},
+}
 
 var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
 
diff --git a/acceptance/testdata/pr/pr-checkout.txt b/acceptance/testdata/pr/pr-checkout.txt
index d02c42076..4cfe96c1a 100644
--- a/acceptance/testdata/pr/pr-checkout.txt
+++ b/acceptance/testdata/pr/pr-checkout.txt
@@ -18,6 +18,7 @@ exec git push -u origin feature-branch
 
 # Create the PR
 exec gh pr create --title 'Feature Title' --body 'Feature Body'
+stdout2env PR_URL
 
 # Remove the local branch
 exec git checkout main
@@ -25,5 +26,5 @@ exec git branch -D feature-branch
 stdout 'Deleted branch feature-branch'
 
 # Checkout the PR
-exec gh pr checkout 1
+exec gh pr checkout $PR_URL
 stderr 'Switched to a new branch ''feature-branch'''
diff --git a/acceptance/testdata/pr/pr-view.txt b/acceptance/testdata/pr/pr-view.txt
index c9dfcd3a6..6166d15ad 100644
--- a/acceptance/testdata/pr/pr-view.txt
+++ b/acceptance/testdata/pr/pr-view.txt
@@ -18,7 +18,8 @@ exec git push -u origin feature-branch
 
 # Create the PR
 exec gh pr create --title 'Feature Title' --body 'Feature Body'
+stdout2env PR_URL
 
 # View the PR
-exec gh pr view 1
+exec gh pr view $PR_URL
 stdout 'Feature Title'

From 99f7e048f9b1d3642afbd01946e81dfecb5a6ace Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 8 Oct 2024 18:37:09 +0200
Subject: [PATCH 131/301] Support targeting other hosts in acceptance tests

---
 acceptance/{pr_test.go => acceptance_test.go} | 2 ++
 1 file changed, 2 insertions(+)
 rename acceptance/{pr_test.go => acceptance_test.go} (97%)

diff --git a/acceptance/pr_test.go b/acceptance/acceptance_test.go
similarity index 97%
rename from acceptance/pr_test.go
rename to acceptance/acceptance_test.go
index 563526f6f..364d073b8 100644
--- a/acceptance/pr_test.go
+++ b/acceptance/acceptance_test.go
@@ -49,6 +49,8 @@ var sharedSetup = func(ts *testscript.Env) error {
 
 	ts.Setenv("GH_TOKEN", os.Getenv("GH_TOKEN"))
 
+	ts.Setenv("GH_HOST", os.Getenv("GH_HOST"))
+
 	ts.Setenv("ORG", os.Getenv("GH_ACCEPTANCE_ORG"))
 
 	ts.Setenv("RANDOM_STRING", randomString(10))

From eb9eeb10e13a824a108c7be30c631c307ed64800 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 13:28:46 +0200
Subject: [PATCH 132/301] Use txtar extension for testscripts

---
 acceptance/testdata/pr/{pr-checkout.txt => pr-checkout.txtar}     | 0
 .../testdata/pr/{pr-create-basic.txt => pr-create-basic.txtar}    | 0
 acceptance/testdata/pr/{pr-view.txt => pr-view.txtar}             | 0
 3 files changed, 0 insertions(+), 0 deletions(-)
 rename acceptance/testdata/pr/{pr-checkout.txt => pr-checkout.txtar} (100%)
 rename acceptance/testdata/pr/{pr-create-basic.txt => pr-create-basic.txtar} (100%)
 rename acceptance/testdata/pr/{pr-view.txt => pr-view.txtar} (100%)

diff --git a/acceptance/testdata/pr/pr-checkout.txt b/acceptance/testdata/pr/pr-checkout.txtar
similarity index 100%
rename from acceptance/testdata/pr/pr-checkout.txt
rename to acceptance/testdata/pr/pr-checkout.txtar
diff --git a/acceptance/testdata/pr/pr-create-basic.txt b/acceptance/testdata/pr/pr-create-basic.txtar
similarity index 100%
rename from acceptance/testdata/pr/pr-create-basic.txt
rename to acceptance/testdata/pr/pr-create-basic.txtar
diff --git a/acceptance/testdata/pr/pr-view.txt b/acceptance/testdata/pr/pr-view.txtar
similarity index 100%
rename from acceptance/testdata/pr/pr-view.txt
rename to acceptance/testdata/pr/pr-view.txtar

From 5745eb1c1c4acf4e21d380c0fa7d297f0490eddf Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 13:49:28 +0200
Subject: [PATCH 133/301] Add initial acceptance test README

---
 acceptance/README.md          | 46 +++++++++++++++++++++++++++++++++++
 acceptance/acceptance_test.go |  2 ++
 2 files changed, 48 insertions(+)
 create mode 100644 acceptance/README.md

diff --git a/acceptance/README.md b/acceptance/README.md
new file mode 100644
index 000000000..132336d00
--- /dev/null
+++ b/acceptance/README.md
@@ -0,0 +1,46 @@
+## Acceptance Tests
+
+The acceptance tests are blackbox* tests that are expected to interact with resources on a real GitHub instance.
+
+*Note: they aren't strictly blackbox because `exec gh` commands delegate to a binary set up by `testscript` that calls into `ghcmd.Main`. However, since our real `func main` is an extremely thin adapter over `ghcmd.Main`, this is reasonable. This tradeoff avoids us building the binary ourselves for the tests, and allows us to get code coverage metrics.
+
+### Running the Acceptance Tests
+
+The acceptance tests currently require three environment variables to be set:
+ * `GH_HOST`
+ * `GH_ACCEPTANCE_ORG`
+ * `GH_TOKEN`
+
+While `GH_HOST` may not strictly be necessary because `gh` can choose a host, it is required to avoid ambiguity and unexpected results depending on the state of `gh`.
+
+The `GH_ACCEPTANCE_ORG` is an organization that the tests can manage resources in.
+
+The `GH_TOKEN` must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
+
+The acceptance tests have a build constraint of `//go:build acceptance`, this means that `go test ./...` will continue to work without any modifications. The `acceptance` tag must therefore be provided when running `go test`.
+
+A full example invocation can be found below:
+
+```
+GH_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_TOKEN=<token> test -tags=acceptance ./acceptance
+```
+
+### Effective Test Authoring
+
+This section will likely extend over time.
+
+#### Test Isolation
+
+#### Scope Validation
+
+#### Limit Custom Commands
+
+...
+
+### Further Reading
+
+https://bitfieldconsulting.com/posts/test-scripts
+
+https://atlasgo.io/blog/2024/09/09/how-go-tests-go-test
+
+https://encore.dev/blog/testscript-hidden-testing-gem
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 364d073b8..ade3517af 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -1,3 +1,5 @@
+//go:build acceptance
+
 package acceptance_test
 
 import (

From 502daff2a1e0a0144697e799dbbfef10b182c3b5 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 15:07:32 +0200
Subject: [PATCH 134/301] Refactor acceptance test environment handling

---
 acceptance/README.md          | 12 +++++++++
 acceptance/acceptance_test.go | 50 +++++++++++++++++++++++++++++++++--
 2 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 132336d00..b8dacadfd 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -25,6 +25,18 @@ A full example invocation can be found below:
 GH_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_TOKEN=<token> test -tags=acceptance ./acceptance
 ```
 
+### Acceptance Test VS Code Support
+
+Due to the `//go:build acceptance` build constraint, some functionality is limited because `gopls` isn't being informed about the tag. To resolve this, set the following in your `settings.json`:
+
+```json
+  "gopls": {
+    "buildFlags": [
+        "-tags=acceptance"
+    ]
+  },
+```
+
 ### Effective Test Authoring
 
 This section will likely extend over time.
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index ade3517af..ab6432304 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -3,6 +3,7 @@
 package acceptance_test
 
 import (
+	"fmt"
 	"os"
 	"path"
 	"strings"
@@ -25,10 +26,16 @@ func TestMain(m *testing.M) {
 }
 
 func TestPullRequests(t *testing.T) {
-	testscript.Run(t, params("pr"))
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
+	testscript.Run(t, testScriptParamsFor("pr"))
 }
 
-func params(dir string) testscript.Params {
+func testScriptParamsFor(dir string) testscript.Params {
 	return testscript.Params{
 		Dir:                 path.Join("testdata", dir),
 		Files:               []string{},
@@ -96,3 +103,42 @@ func extractScriptName(vars []string) (string, bool) {
 	}
 	return "", false
 }
+
+type missingEnvError struct {
+	missingEnvs []string
+}
+
+func (e missingEnvError) Error() string {
+	return fmt.Sprintf("missing environment variables: %s", strings.Join(e.missingEnvs, ", "))
+}
+
+type testScriptEnv struct {
+	host  string
+	org   string
+	token string
+}
+
+func (e *testScriptEnv) fromEnv() error {
+	envMap := map[string]string{}
+
+	var missingEnvs []string
+	for _, key := range []string{"GH_HOST", "GH_ACCEPTANCE_ORG", "GH_TOKEN"} {
+		val, ok := os.LookupEnv(key)
+		if !ok {
+			missingEnvs = append(missingEnvs, key)
+			continue
+		}
+
+		envMap[key] = val
+	}
+
+	if len(missingEnvs) > 0 {
+		return missingEnvError{missingEnvs: missingEnvs}
+	}
+
+	e.host = envMap["GH_HOST"]
+	e.org = envMap["GH_ACCEPTANCE_ORG"]
+	e.token = envMap["GH_TOKEN"]
+
+	return nil
+}

From 320c5aba4a783799d87d6101ce602851922dae0f Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 15:27:31 +0200
Subject: [PATCH 135/301] Note syntax highlighting support for txtar files

---
 acceptance/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/acceptance/README.md b/acceptance/README.md
index b8dacadfd..dada532ff 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -37,6 +37,8 @@ Due to the `//go:build acceptance` build constraint, some functionality is limit
   },
 ```
 
+You can install the `txtar` or `vscode-testscript` extensions to get syntax highlighting.
+
 ### Effective Test Authoring
 
 This section will likely extend over time.

From 99a9b35410d28bd3f47cbd5ef98756c458227abd Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 15:27:49 +0200
Subject: [PATCH 136/301] Acceptance test PR merge and rebase

---
 .../testdata/pr/pr-merge-merge-strategy.txtar | 45 +++++++++++++++++++
 .../pr/pr-merge-rebase-strategy.txtar         | 45 +++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 acceptance/testdata/pr/pr-merge-merge-strategy.txtar
 create mode 100644 acceptance/testdata/pr/pr-merge-rebase-strategy.txtar

diff --git a/acceptance/testdata/pr/pr-merge-merge-strategy.txtar b/acceptance/testdata/pr/pr-merge-merge-strategy.txtar
new file mode 100644
index 000000000..7acf6da2b
--- /dev/null
+++ b/acceptance/testdata/pr/pr-merge-merge-strategy.txtar
@@ -0,0 +1,45 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR with a single file
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+mv ../file.txt file.txt
+exec git add .
+exec git commit -m 'Add file.txt'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+stdout2env PR_URL
+
+# Check that the file doesn't exist on the main branch
+exec git checkout main
+! exists file.txt
+
+# Merge the PR
+exec gh pr merge $PR_URL --merge
+
+# Check that the state of the PR is now merged
+exec gh pr view $PR_URL
+stdout 'state:\tMERGED'
+
+# Pull and check the file exists on the main branch
+exec git pull -r
+exists file.txt
+
+# And check we had a merge commit
+exec git show HEAD
+stdout 'Merge pull request #1'
+
+-- file.txt --
+Unimportant contents
diff --git a/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar b/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar
new file mode 100644
index 000000000..73acd238c
--- /dev/null
+++ b/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar
@@ -0,0 +1,45 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR with a single file
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+mv ../file.txt file.txt
+exec git add .
+exec git commit -m 'Add file.txt'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+stdout2env PR_URL
+
+# Check that the file doesn't exist on the main branch
+exec git checkout main
+! exists file.txt
+
+# Merge the PR
+exec gh pr merge $PR_URL --rebase
+
+# Check that the state of the PR is now merged
+exec gh pr view $PR_URL
+stdout 'state:\tMERGED'
+
+# Pull and check the file exists on the main branch
+exec git pull -r
+exists file.txt
+
+# And check our commit was rebased
+exec git show HEAD
+stdout 'Add file.txt'
+
+-- file.txt --
+Unimportant contents

From ee5709a4b6fa9b80acf52ec216151826a6ca3326 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 15:35:31 +0200
Subject: [PATCH 137/301] Acceptance test PR comment

---
 acceptance/testdata/pr/pr-comment.txtar | 28 +++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 acceptance/testdata/pr/pr-comment.txtar

diff --git a/acceptance/testdata/pr/pr-comment.txtar b/acceptance/testdata/pr/pr-comment.txtar
new file mode 100644
index 000000000..2c4d488b5
--- /dev/null
+++ b/acceptance/testdata/pr/pr-comment.txtar
@@ -0,0 +1,28 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty Commit'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+stdout2env PR_URL
+
+# Comment on the PR
+exec gh pr comment $PR_URL --body 'Looks like a great feature!'
+
+# View the PR
+exec gh pr view $PR_URL --comments
+stdout 'Looks like a great feature!'

From 64f5b3c2060223c07e6314d24717ce47ca875943 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 15:57:21 +0200
Subject: [PATCH 138/301] Add Debug and Authoring sections to Acceptance README

---
 acceptance/README.md | 65 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 61 insertions(+), 4 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index dada532ff..0105c8891 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -39,17 +39,74 @@ Due to the `//go:build acceptance` build constraint, some functionality is limit
 
 You can install the `txtar` or `vscode-testscript` extensions to get syntax highlighting.
 
+### Debugging Tests
+
+When tests fail they fail like this:
+
+```
+➜ go test -tags=acceptance ./acceptance
+--- FAIL: TestPullRequests (0.00s)
+    --- FAIL: TestPullRequests/pr-merge (11.07s)
+        testscript.go:584: WORK=/private/var/folders/45/sdnm1hp10nj1s9q57dp3bc5h0000gn/T/go-test-script2778137936/script-pr-merge
+            # Use gh as a credential helper (0.693s)
+            # Create a repository with a file so it has a default branch (1.155s)
+            # Defer repo cleanup (0.000s)
+            # Clone the repo (1.551s)
+            # Prepare a branch to PR with a single file (1.168s)
+            # Create the PR (1.903s)
+            # Check that the file doesn't exist on the main branch (0.059s)
+            # Merge the PR (2.426s)
+            # Check that the state of the PR is now merged (0.571s)
+            # Pull and check the file exists on the main branch (1.074s)
+            # And check we had a merge commit (0.462s)
+            > exec git show HEAD
+            [stdout]
+            commit 85d32c1a83ace270f6754c61f3f7e14956be0a47
+            Author: William Martin <williammartin@william-github-laptop.kpn>
+            Date:   Fri Oct 11 15:23:56 2024 +0200
+
+                Add file.txt
+
+            diff --git a/file.txt b/file.txt
+            new file mode 100644
+            index 0000000..7449899
+            --- /dev/null
+            +++ b/file.txt
+            @@ -0,0 +1 @@
+            +Unimportant contents
+            > stdout 'Merge pull request #1'
+            FAIL: testdata/pr/pr-merge.txtar:42: no match for `Merge pull request #1` found in stdout
+```
+
+This is generally enough information to understand why a test has failed. However, we can get more information by providing the `-v` flag to `go test`, which turns on verbose mode and shows each command and any associated `stdio`.
+
+> [!WARNING]
+> Verbose mode dumps the `testscript` environment variables, including the `GH_TOKEN`, so be careful.
+
+Finally, the `testscript.Params` struct has a `TestWork` field; when `TestWork` is set to true, the `WORK` directory will not be cleaned up, allowing for manual investigation of state in the shell. However, `defer` statements will still be run.
+
+TODO: Probably we want to add a `NO_CLEANUP` flag so `defer` is not run. Maybe this implies we want `defer` to be called `cleanup`? It might not be so clear in its intent though. Maybe `NO_CLEANUP_WORK` and `NO_DEFER`?
+
 ### Effective Test Authoring
 
-This section will likely extend over time.
+This section is to be expanded over time as we write more tests and learn more.
 
 #### Test Isolation
 
+The `testscript` library creates a somewhat isolated environment for each script. Each script gets a directory with limited environment variables by default. As far as reasonable, we should look to write scripts that depend on nothing more than themselves, the GitHub resources they manage, and limited additional environmental injection from our own `testscript` setup.
+
+Here are some guidelines around test isolation:
+ * Favour duplication in test setup over abstracting a new `testscript` command
+ * Favour a `testscript` owning an entire resource lifecycle over shared resource until we see a performance or rate limiting issue
+ * Use the `RANDOM_STRING` env var for globally visible resources to avoid conflicts
+
+### Debris
+
+Since these scripts are creating resources on a GitHub instance, we should try our best to cleanup after them. Use the `defer` keyword to ensure a command runs at the end of a test even in the case of failure.
+
 #### Scope Validation
 
-#### Limit Custom Commands
-
-...
+TODO: I believe tests should early exit if the correct scopes aren't in place to execute the entire lifecycle. It's extremely annoying if a `defer` fails to clean up resources because there's no `delete_repo` scope for example. However, I'm not sure yet whether this scope checking should be in the Go tests or in the scripts themselves. It seems very cool to understand required scopes for a script just by looking at the script itself.
 
 ### Further Reading
 

From dc7c66c1420bd7482f9d87d18f4e4266443ef3ec Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 16:01:02 +0200
Subject: [PATCH 139/301] Add Writing Tests section to Acceptance README

---
 acceptance/README.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/acceptance/README.md b/acceptance/README.md
index 0105c8891..1f43bdc6a 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -25,6 +25,20 @@ A full example invocation can be found below:
 GH_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_TOKEN=<token> test -tags=acceptance ./acceptance
 ```
 
+### Writing Tests
+
+This section is to be expanded over time as we write more tests and learn more.
+
+#### Environment Variables
+
+The following custom environment variables are made available to the scripts:
+ * `GH_TOKEN`: Set to the value of the `GH_TOKEN` env var provided to `go test`
+ * `ORG`: Set to the value of the `GH_ACCEPTANCE_ORG` env var provided to `go test`
+ * `RANDOM_STRING`: Set to a length 10 random string of letters to help isolate globally visible resources
+ * `SCRIPT_NAME`: Set to the name of the `testscript` currently running, without extension e.g. `pr-view`
+ * `HOME`: Set to the initial working directory. Required for `git` operations
+ * `GH_CONFIG_DIR`: Set to the initial working directory. Required for `gh` operations
+
 ### Acceptance Test VS Code Support
 
 Due to the `//go:build acceptance` build constraint, some functionality is limited because `gopls` isn't being informed about the tag. To resolve this, set the following in your `settings.json`:

From 9d569b3c118c7569e114c04727b0a4bd07fed6fc Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 16:25:36 +0200
Subject: [PATCH 140/301] Isolate acceptance env vars

---
 acceptance/README.md          | 32 +++++++++++++---------
 acceptance/acceptance_test.go | 51 +++++++++++++++++++----------------
 2 files changed, 47 insertions(+), 36 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 1f43bdc6a..7d39cebba 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -6,23 +6,28 @@ The acceptance tests are blackbox* tests that are expected to interact with reso
 
 ### Running the Acceptance Tests
 
-The acceptance tests currently require three environment variables to be set:
- * `GH_HOST`
- * `GH_ACCEPTANCE_ORG`
- * `GH_TOKEN`
-
-While `GH_HOST` may not strictly be necessary because `gh` can choose a host, it is required to avoid ambiguity and unexpected results depending on the state of `gh`.
-
-The `GH_ACCEPTANCE_ORG` is an organization that the tests can manage resources in.
-
-The `GH_TOKEN` must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
-
 The acceptance tests have a build constraint of `//go:build acceptance`, this means that `go test ./...` will continue to work without any modifications. The `acceptance` tag must therefore be provided when running `go test`.
 
+The following environment variables are required:
+
+#### `GH_ACCEPTANCE_HOST`
+
+The GitHub host to target e.g. `github.com`
+
+#### `GH_ACCEPTANCE_ORG`
+
+The organization in which the acceptance tests can manage resources in.
+
+#### `GH_ACCEPTANCE_TOKEN`
+
+The token to use for authenticatin with the `GH_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
+
+---
+
 A full example invocation can be found below:
 
 ```
-GH_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_TOKEN=<token> test -tags=acceptance ./acceptance
+GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> test -tags=acceptance ./acceptance
 ```
 
 ### Writing Tests
@@ -32,8 +37,9 @@ This section is to be expanded over time as we write more tests and learn more.
 #### Environment Variables
 
 The following custom environment variables are made available to the scripts:
- * `GH_TOKEN`: Set to the value of the `GH_TOKEN` env var provided to `go test`
+ * `GH_HOST`: Set to value of the `GH_ACCEPTANCE_ORG` env var provided to `go test`
  * `ORG`: Set to the value of the `GH_ACCEPTANCE_ORG` env var provided to `go test`
+ * `GH_TOKEN`: Set to the value of the `GH_ACCEPTANCE_TOKEN` env var provided to `go test`
  * `RANDOM_STRING`: Set to a length 10 random string of letters to help isolate globally visible resources
  * `SCRIPT_NAME`: Set to the name of the `testscript` currently running, without extension e.g. `pr-view`
  * `HOME`: Set to the initial working directory. Required for `git` operations
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index ab6432304..fdad1e576 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -32,38 +32,37 @@ func TestPullRequests(t *testing.T) {
 		os.Exit(1)
 	}
 
-	testscript.Run(t, testScriptParamsFor("pr"))
+	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
 }
 
-func testScriptParamsFor(dir string) testscript.Params {
+func testScriptParamsFor(tsEnv testScriptEnv, dir string) testscript.Params {
 	return testscript.Params{
 		Dir:                 path.Join("testdata", dir),
 		Files:               []string{},
-		Setup:               sharedSetup,
+		Setup:               sharedSetup(tsEnv),
 		Cmds:                sharedCmds,
 		RequireExplicitExec: true,
 		RequireUniqueNames:  true,
 	}
 }
 
-var sharedSetup = func(ts *testscript.Env) error {
-	scriptName, ok := extractScriptName(ts.Vars)
-	if !ok {
-		ts.T().Fatal("script name not found")
+func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
+	return func(ts *testscript.Env) error {
+		scriptName, ok := extractScriptName(ts.Vars)
+		if !ok {
+			ts.T().Fatal("script name not found")
+		}
+		ts.Setenv("SCRIPT_NAME", scriptName)
+		ts.Setenv("HOME", ts.Cd)
+		ts.Setenv("GH_CONFIG_DIR", ts.Cd)
+
+		ts.Setenv("GH_HOST", tsEnv.host)
+		ts.Setenv("ORG", tsEnv.org)
+		ts.Setenv("GH_TOKEN", tsEnv.token)
+
+		ts.Setenv("RANDOM_STRING", randomString(10))
+		return nil
 	}
-	ts.Setenv("SCRIPT_NAME", scriptName)
-
-	ts.Setenv("HOME", ts.Cd)
-	ts.Setenv("GH_CONFIG_DIR", ts.Cd)
-
-	ts.Setenv("GH_TOKEN", os.Getenv("GH_TOKEN"))
-
-	ts.Setenv("GH_HOST", os.Getenv("GH_HOST"))
-
-	ts.Setenv("ORG", os.Getenv("GH_ACCEPTANCE_ORG"))
-
-	ts.Setenv("RANDOM_STRING", randomString(10))
-	return nil
 }
 
 var sharedCmds = map[string]func(ts *testscript.TestScript, neg bool, args []string){
@@ -121,8 +120,14 @@ type testScriptEnv struct {
 func (e *testScriptEnv) fromEnv() error {
 	envMap := map[string]string{}
 
+	requiredEnvVars := []string{
+		"GH_ACCEPTANCE_HOST",
+		"GH_ACCEPTANCE_ORG",
+		"GH_ACCEPTANCE_TOKEN",
+	}
+
 	var missingEnvs []string
-	for _, key := range []string{"GH_HOST", "GH_ACCEPTANCE_ORG", "GH_TOKEN"} {
+	for _, key := range requiredEnvVars {
 		val, ok := os.LookupEnv(key)
 		if !ok {
 			missingEnvs = append(missingEnvs, key)
@@ -136,9 +141,9 @@ func (e *testScriptEnv) fromEnv() error {
 		return missingEnvError{missingEnvs: missingEnvs}
 	}
 
-	e.host = envMap["GH_HOST"]
+	e.host = envMap["GH_ACCEPTANCE_HOST"]
 	e.org = envMap["GH_ACCEPTANCE_ORG"]
-	e.token = envMap["GH_TOKEN"]
+	e.token = envMap["GH_ACCEPTANCE_TOKEN"]
 
 	return nil
 }

From f9b24990d6a91f71cd89f5c14ed530692be64864 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 16:27:40 +0200
Subject: [PATCH 141/301] Add codecoverage to Acceptance README

---
 acceptance/README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/acceptance/README.md b/acceptance/README.md
index 7d39cebba..13cbfe86e 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -30,6 +30,14 @@ A full example invocation can be found below:
 GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> test -tags=acceptance ./acceptance
 ```
 
+#### Code Coverage
+
+To get code coverage, `go test` can be invoked with `coverpkg` and `coverprofile` like so:
+
+```
+GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> test -tags=acceptance -coverprofile=coverage.out -coverpkg=./... ./acceptance
+```
+
 ### Writing Tests
 
 This section is to be expanded over time as we write more tests and learn more.

From fd665555109c457ba932a72095c1089ce41c688e Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 17:51:17 +0200
Subject: [PATCH 142/301] Error if acceptance tests are targeting github or cli
 orgs

---
 acceptance/acceptance_test.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index fdad1e576..7b249aaca 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -141,6 +141,10 @@ func (e *testScriptEnv) fromEnv() error {
 		return missingEnvError{missingEnvs: missingEnvs}
 	}
 
+	if envMap["GH_ACCEPTANCE_ORG"] == "github" || envMap["GH_ACCEPTANCE_ORG"] == "cli" {
+		return fmt.Errorf("GH_ACCEPTANCE_ORG cannot be 'github' or 'cli'")
+	}
+
 	e.host = envMap["GH_ACCEPTANCE_HOST"]
 	e.org = envMap["GH_ACCEPTANCE_ORG"]
 	e.token = envMap["GH_ACCEPTANCE_TOKEN"]

From c6c938fafe7b231ad4b11f7f7bf9a8bf643a8579 Mon Sep 17 00:00:00 2001
From: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Date: Fri, 11 Oct 2024 09:53:33 -0600
Subject: [PATCH 143/301] Apply suggestions from code review

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 pkg/cmd/repo/license/license.go   |  2 +-
 pkg/cmd/repo/license/list/list.go | 18 +++++++++---------
 pkg/cmd/repo/license/view/view.go | 18 ++++++++----------
 3 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/pkg/cmd/repo/license/license.go b/pkg/cmd/repo/license/license.go
index a768d0ce7..7d8db35b7 100644
--- a/pkg/cmd/repo/license/license.go
+++ b/pkg/cmd/repo/license/license.go
@@ -10,7 +10,7 @@ import (
 func NewCmdLicense(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "license <command>",
-		Short: "View available repository license templates",
+		Short: "Explore repository licenses",
 	}
 
 	cmd.AddCommand(cmdList.NewCmdList(f, nil))
diff --git a/pkg/cmd/repo/license/list/list.go b/pkg/cmd/repo/license/list/list.go
index e3a6788aa..6431f58c0 100644
--- a/pkg/cmd/repo/license/list/list.go
+++ b/pkg/cmd/repo/license/list/list.go
@@ -28,11 +28,11 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:   "list",
-		Short: "List available repository license templates",
+		Short: "List common repository licenses",
 		Long: heredoc.Doc(`
-			List available repository license templates.
+			List common repository licenses.
 			
-			Only the most commonly used licenses templates are returned. For even more licenses, visit <https://choosealicense.com/appendix>
+			For even more licenses, visit <https://choosealicense.com/appendix>
 		`),
 		Aliases: []string{"ls"},
 		Args:    cobra.ExactArgs(0),
@@ -64,21 +64,21 @@ func listRun(opts *ListOptions) error {
 	defer opts.IO.StopPager()
 
 	hostname, _ := cfg.Authentication().DefaultHost()
-	licenseTemplates, err := api.RepoLicenses(client, hostname)
+	licenses, err := api.RepoLicenses(client, hostname)
 	if err != nil {
 		return err
 	}
 
-	if len(licenseTemplates) == 0 {
-		return cmdutil.NewNoResultsError("No repository license templates found")
+	if len(licenses) == 0 {
+		return cmdutil.NewNoResultsError("No repository licenses found")
 	}
 
-	return renderLicenseTemplatesTable(licenseTemplates, opts)
+	return renderLicensesTable(licenses, opts)
 }
 
-func renderLicenseTemplatesTable(licenseTemplates []api.License, opts *ListOptions) error {
+func renderLicensesTable(licenses []api.License, opts *ListOptions) error {
 	t := tableprinter.New(opts.IO, tableprinter.WithHeader("LICENSE KEY", "SPDX ID", "LICENSE NAME"))
-	for _, l := range licenseTemplates {
+	for _, l := range licenses {
 		t.AddField(l.Key)
 		t.AddField(l.SPDXID)
 		t.AddField(l.Name)
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 76b334936..2a760fab6 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -35,11 +35,9 @@ func NewCmdView(f *cmdutil.Factory, runF func(*ViewOptions) error) *cobra.Comman
 
 	cmd := &cobra.Command{
 		Use:   "view {<license-key> | <SPDX-ID>}",
-		Short: "View an available repository license template",
+		Short: "View a specific repository license",
 		Long: heredoc.Docf(`
-			View an available repository license template.
-			
-			Argument can be a case-insensitive license key or SPDX ID.
+			View a specific repository license by license key or SPDX ID.
 
 			Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit <https://choosealicense.com/appendix>.
 		`, "`"),
@@ -100,7 +98,7 @@ func viewRun(opts *ViewOptions) error {
 		var httpErr api.HTTPError
 		if errors.As(err, &httpErr) {
 			if httpErr.StatusCode == 404 {
-				return fmt.Errorf("'%s' is not a valid license template name or SPDX ID.\n\nRun `gh repo license list` to see available commonly used licenses. For even more licenses, visit %s", opts.License, text.DisplayURL("https://choosealicense.com/appendix"))
+				return fmt.Errorf("'%s' is not a valid license name or SPDX ID.\n\nRun `gh repo license list` to see available commonly used licenses. For even more licenses, visit %s", opts.License, text.DisplayURL("https://choosealicense.com/appendix"))
 			}
 		}
 		return err
@@ -117,15 +115,15 @@ func viewRun(opts *ViewOptions) error {
 	return renderLicense(license, opts)
 }
 
-func renderLicense(licenseTemplate api.License, opts *ViewOptions) error {
+func renderLicense(license api.License, opts *ViewOptions) error {
 	cs := opts.IO.ColorScheme()
 	var out strings.Builder
 	if opts.IO.IsStdoutTTY() {
-		out.WriteString(fmt.Sprintf("\n%s\n", cs.Gray(licenseTemplate.Description)))
-		out.WriteString(fmt.Sprintf("\n%s\n", cs.Grayf("To implement: %s", licenseTemplate.Implementation)))
-		out.WriteString(fmt.Sprintf("\n%s\n\n", cs.Grayf("For more information, see: %s", licenseTemplate.HTMLURL)))
+		out.WriteString(fmt.Sprintf("\n%s\n", cs.Gray(license.Description)))
+		out.WriteString(fmt.Sprintf("\n%s\n", cs.Grayf("To implement: %s", license.Implementation)))
+		out.WriteString(fmt.Sprintf("\n%s\n\n", cs.Grayf("For more information, see: %s", license.HTMLURL)))
 	}
-	out.WriteString(licenseTemplate.Body)
+	out.WriteString(license.Body)
 	_, err := opts.IO.Out.Write([]byte(out.String()))
 	if err != nil {
 		return err

From 846a39d7be91b709025fee38e03d347a694feb8f Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 17:57:08 +0200
Subject: [PATCH 144/301] Add go to test instructions in Acceptance README

---
 acceptance/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 13cbfe86e..9828bfe74 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -27,7 +27,7 @@ The token to use for authenticatin with the `GH_HOST`. This must already have th
 A full example invocation can be found below:
 
 ```
-GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> test -tags=acceptance ./acceptance
+GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> go test -tags=acceptance ./acceptance
 ```
 
 #### Code Coverage
@@ -35,7 +35,7 @@ GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> te
 To get code coverage, `go test` can be invoked with `coverpkg` and `coverprofile` like so:
 
 ```
-GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> test -tags=acceptance -coverprofile=coverage.out -coverpkg=./... ./acceptance
+GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> go test -tags=acceptance -coverprofile=coverage.out -coverpkg=./... ./acceptance
 ```
 
 ### Writing Tests

From 0d7ec4489593973eda7142319ffe90646dd9ee7b Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 11 Oct 2024 18:08:42 +0200
Subject: [PATCH 145/301] Validate required env vars not-empty for Acceptance
 tests

---
 acceptance/acceptance_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 7b249aaca..6a5e32ff7 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -108,7 +108,7 @@ type missingEnvError struct {
 }
 
 func (e missingEnvError) Error() string {
-	return fmt.Sprintf("missing environment variables: %s", strings.Join(e.missingEnvs, ", "))
+	return fmt.Sprintf("environment variables %s must be set and non-empty", strings.Join(e.missingEnvs, ", "))
 }
 
 type testScriptEnv struct {
@@ -129,7 +129,7 @@ func (e *testScriptEnv) fromEnv() error {
 	var missingEnvs []string
 	for _, key := range requiredEnvVars {
 		val, ok := os.LookupEnv(key)
-		if !ok {
+		if val == "" || !ok {
 			missingEnvs = append(missingEnvs, key)
 			continue
 		}

From b6cdbc9e222032d8105965ab119482f938365785 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Fri, 11 Oct 2024 11:59:06 -0600
Subject: [PATCH 146/301] Fix license list and view tests

---
 pkg/cmd/repo/license/list/list_test.go | 2 +-
 pkg/cmd/repo/license/view/view_test.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/repo/license/list/list_test.go b/pkg/cmd/repo/license/list/list_test.go
index b626a25d8..1fee996c6 100644
--- a/pkg/cmd/repo/license/list/list_test.go
+++ b/pkg/cmd/repo/license/list/list_test.go
@@ -157,7 +157,7 @@ func TestListRun(t *testing.T) {
 			wantStdout: "",
 			wantStderr: "",
 			wantErr:    true,
-			errMsg:     "No repository license templates found",
+			errMsg:     "No repository licenses found",
 			opts:       &ListOptions{},
 		},
 	}
diff --git a/pkg/cmd/repo/license/view/view_test.go b/pkg/cmd/repo/license/view/view_test.go
index 009ff4135..40439d1f0 100644
--- a/pkg/cmd/repo/license/view/view_test.go
+++ b/pkg/cmd/repo/license/view/view_test.go
@@ -219,7 +219,7 @@ func TestViewRun(t *testing.T) {
 			opts:    &ViewOptions{License: "404"},
 			wantErr: true,
 			errMsg: heredoc.Docf(`
-				'404' is not a valid license template name or SPDX ID.
+				'404' is not a valid license name or SPDX ID.
 				
 				Run %[1]sgh repo license list%[1]s to see available commonly used licenses. For even more licenses, visit https://choosealicense.com/appendix`, "`"),
 			httpStubs: func(reg *httpmock.Registry) {

From 291370824b8eb7a780786fbab19c82edc133eaf2 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Fri, 11 Oct 2024 12:08:10 -0600
Subject: [PATCH 147/301] Return nil instead of empty objects when err

---
 api/queries_repo.go                 | 14 +++++++-------
 pkg/cmd/repo/gitignore/view/view.go |  2 +-
 pkg/cmd/repo/license/view/view.go   |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/api/queries_repo.go b/api/queries_repo.go
index 0fb168575..aadf64adc 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -1422,15 +1422,15 @@ func RepoLicenses(httpClient *http.Client, hostname string) ([]License, error) {
 
 // RepoLicense fetches an available repository license.
 // It uses API v3 because licenses are not supported by GraphQL.
-func RepoLicense(httpClient *http.Client, hostname string, licenseName string) (License, error) {
+func RepoLicense(httpClient *http.Client, hostname string, licenseName string) (*License, error) {
 	var license License
 	client := NewClientFromHTTP(httpClient)
 	path := fmt.Sprintf("licenses/%s", licenseName)
 	err := client.REST(hostname, "GET", path, nil, &license)
 	if err != nil {
-		return License{}, err
+		return nil, err
 	}
-	return license, nil
+	return &license, nil
 }
 
 // RepoGitIgnoreTemplates fetches available repository gitignore templates.
@@ -1440,20 +1440,20 @@ func RepoGitIgnoreTemplates(httpClient *http.Client, hostname string) ([]string,
 	client := NewClientFromHTTP(httpClient)
 	err := client.REST(hostname, "GET", "gitignore/templates", nil, &gitIgnoreTemplates)
 	if err != nil {
-		return []string{}, err
+		return nil, err
 	}
 	return gitIgnoreTemplates, nil
 }
 
 // RepoGitIgnoreTemplate fetches an available repository gitignore template.
 // It uses API v3 here because gitignore template isn't supported by GraphQL.
-func RepoGitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (GitIgnore, error) {
+func RepoGitIgnoreTemplate(httpClient *http.Client, hostname string, gitIgnoreTemplateName string) (*GitIgnore, error) {
 	var gitIgnoreTemplate GitIgnore
 	client := NewClientFromHTTP(httpClient)
 	path := fmt.Sprintf("gitignore/templates/%s", gitIgnoreTemplateName)
 	err := client.REST(hostname, "GET", path, nil, &gitIgnoreTemplate)
 	if err != nil {
-		return GitIgnore{}, err
+		return nil, err
 	}
-	return gitIgnoreTemplate, nil
+	return &gitIgnoreTemplate, nil
 }
diff --git a/pkg/cmd/repo/gitignore/view/view.go b/pkg/cmd/repo/gitignore/view/view.go
index a3e0125b8..46e674632 100644
--- a/pkg/cmd/repo/gitignore/view/view.go
+++ b/pkg/cmd/repo/gitignore/view/view.go
@@ -99,7 +99,7 @@ func viewRun(opts *ViewOptions) error {
 	return renderGitIgnore(gitIgnore, opts)
 }
 
-func renderGitIgnore(licenseTemplate api.GitIgnore, opts *ViewOptions) error {
+func renderGitIgnore(licenseTemplate *api.GitIgnore, opts *ViewOptions) error {
 	// I wanted to render this in a markdown code block and benefit
 	// from .gitignore syntax highlighting. But, the upstream syntax highlighter
 	// does not currently support .gitignore.
diff --git a/pkg/cmd/repo/license/view/view.go b/pkg/cmd/repo/license/view/view.go
index 2a760fab6..48601faa9 100644
--- a/pkg/cmd/repo/license/view/view.go
+++ b/pkg/cmd/repo/license/view/view.go
@@ -115,7 +115,7 @@ func viewRun(opts *ViewOptions) error {
 	return renderLicense(license, opts)
 }
 
-func renderLicense(license api.License, opts *ViewOptions) error {
+func renderLicense(license *api.License, opts *ViewOptions) error {
 	cs := opts.IO.ColorScheme()
 	var out strings.Builder
 	if opts.IO.IsStdoutTTY() {

From 41f5209708d4dcc865b969695ec1d8819c741869 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Fri, 11 Oct 2024 12:20:12 -0600
Subject: [PATCH 148/301] Fix api tests after function signature changes

---
 api/queries_repo_test.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/queries_repo_test.go b/api/queries_repo_test.go
index 0f9d58c8b..13aee459a 100644
--- a/api/queries_repo_test.go
+++ b/api/queries_repo_test.go
@@ -775,7 +775,7 @@ func TestLicenseTemplateReturnsLicense(t *testing.T) {
 						}`,
 			))
 	}
-	wantLicenseTemplate := License{
+	wantLicense := &License{
 		Key:            "mit",
 		Name:           "MIT License",
 		SPDXID:         "MIT",
@@ -813,7 +813,7 @@ func TestLicenseTemplateReturnsLicense(t *testing.T) {
 	gotLicenseTemplate, err := RepoLicense(client, hostname, licenseTemplateName)
 
 	assert.NoError(t, err, fmt.Sprintf("Expected no error while fetching /licenses/%v", licenseTemplateName))
-	assert.Equal(t, wantLicenseTemplate, gotLicenseTemplate, fmt.Sprintf("License \"%v\" fetched is not as expected", licenseTemplateName))
+	assert.Equal(t, wantLicense, gotLicenseTemplate, fmt.Sprintf("License \"%v\" fetched is not as expected", licenseTemplateName))
 }
 
 func TestLicenseTemplateReturnsErrorWhenLicenseTemplateNotFound(t *testing.T) {
@@ -933,7 +933,7 @@ func TestGitIgnoreTemplateReturnsGitIgnoreTemplate(t *testing.T) {
 						}`,
 			))
 	}
-	wantGitIgnoreTemplate := GitIgnore{
+	wantGitIgnoreTemplate := &GitIgnore{
 		Name:   "Go",
 		Source: "# If you prefer the allow list template instead of the deny list, see community template:\n# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore\n#\n# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n\n# Test binary, built with go test -c\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n\n# Go workspace file\ngo.work\ngo.work.sum\n\n# env file\n.env\n",
 	}

From 8c6d4c9c52604c9a84d7ae94b9c8442a5b47ea9e Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Tue, 8 Oct 2024 02:12:03 -0700
Subject: [PATCH 149/301] Add `gist search` command

Resolves #9704
---
 pkg/cmd/gist/gist.go               |   2 +
 pkg/cmd/gist/list/list.go          |  49 +---
 pkg/cmd/gist/search/search.go      | 135 +++++++++++
 pkg/cmd/gist/search/search_test.go | 361 +++++++++++++++++++++++++++++
 pkg/cmd/gist/shared/shared.go      |  64 ++++-
 5 files changed, 557 insertions(+), 54 deletions(-)
 create mode 100644 pkg/cmd/gist/search/search.go
 create mode 100644 pkg/cmd/gist/search/search_test.go

diff --git a/pkg/cmd/gist/gist.go b/pkg/cmd/gist/gist.go
index 1f7fc9ea0..bf562bf74 100644
--- a/pkg/cmd/gist/gist.go
+++ b/pkg/cmd/gist/gist.go
@@ -8,6 +8,7 @@ import (
 	gistEditCmd "github.com/cli/cli/v2/pkg/cmd/gist/edit"
 	gistListCmd "github.com/cli/cli/v2/pkg/cmd/gist/list"
 	gistRenameCmd "github.com/cli/cli/v2/pkg/cmd/gist/rename"
+	gistSearchCmd "github.com/cli/cli/v2/pkg/cmd/gist/search"
 	gistViewCmd "github.com/cli/cli/v2/pkg/cmd/gist/view"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/spf13/cobra"
@@ -35,6 +36,7 @@ func NewCmdGist(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(gistEditCmd.NewCmdEdit(f, nil))
 	cmd.AddCommand(gistDeleteCmd.NewCmdDelete(f, nil))
 	cmd.AddCommand(gistRenameCmd.NewCmdRename(f, nil))
+	cmd.AddCommand(gistSearchCmd.NewCmdSearch(f, nil))
 
 	return cmd
 }
diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 5d0e47150..6fb70a3d0 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -1,14 +1,9 @@
 package list
 
 import (
-	"fmt"
 	"net/http"
-	"strings"
-	"time"
 
 	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/internal/tableprinter"
-	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmd/gist/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
@@ -78,7 +73,7 @@ func listRun(opts *ListOptions) error {
 
 	host, _ := cfg.Authentication().DefaultHost()
 
-	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility)
+	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, false)
 	if err != nil {
 		return err
 	}
@@ -87,45 +82,5 @@ func listRun(opts *ListOptions) error {
 		return cmdutil.NewNoResultsError("no gists found")
 	}
 
-	if err := opts.IO.StartPager(); err == nil {
-		defer opts.IO.StopPager()
-	} else {
-		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
-	}
-
-	cs := opts.IO.ColorScheme()
-	tp := tableprinter.New(opts.IO, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
-
-	for _, gist := range gists {
-		fileCount := len(gist.Files)
-
-		visibility := "public"
-		visColor := cs.Green
-		if !gist.Public {
-			visibility = "secret"
-			visColor = cs.Red
-		}
-
-		description := gist.Description
-		if description == "" {
-			for filename := range gist.Files {
-				if !strings.HasPrefix(filename, "gistfile") {
-					description = filename
-					break
-				}
-			}
-		}
-
-		tp.AddField(gist.ID)
-		tp.AddField(
-			text.RemoveExcessiveWhitespace(description),
-			tableprinter.WithColor(cs.Bold),
-		)
-		tp.AddField(text.Pluralize(fileCount, "file"))
-		tp.AddField(visibility, tableprinter.WithColor(visColor))
-		tp.AddTimeField(time.Now(), gist.UpdatedAt, cs.Gray)
-		tp.EndRow()
-	}
-
-	return tp.Render()
+	return shared.PrintGists(opts.IO, gists)
 }
diff --git a/pkg/cmd/gist/search/search.go b/pkg/cmd/gist/search/search.go
new file mode 100644
index 000000000..948a79483
--- /dev/null
+++ b/pkg/cmd/gist/search/search.go
@@ -0,0 +1,135 @@
+package search
+
+import (
+	"net/http"
+	"regexp"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmd/gist/shared"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/spf13/cobra"
+)
+
+type SearchOptions struct {
+	IO         *iostreams.IOStreams
+	Config     func() (gh.Config, error)
+	HttpClient func() (*http.Client, error)
+
+	Pattern    *regexp.Regexp
+	Filename   bool
+	Code       bool
+	Visibility string // all, secret, public
+	Limit      int
+}
+
+func NewCmdSearch(f *cmdutil.Factory, runF func(*SearchOptions) error) *cobra.Command {
+	opts := &SearchOptions{
+		IO:         f.IOStreams,
+		Config:     f.Config,
+		HttpClient: f.HttpClient,
+	}
+
+	var flagPublic bool
+	var flagSecret bool
+
+	cmd := &cobra.Command{
+		Use:   "search <pattern>",
+		Short: "Search your gists",
+		Long: heredoc.Docf(`
+			Search your gists' for the given POSIX regular expression.
+
+			By default, all gists' descriptions are searched. Pass %[1]s--filename%[1]s to search
+			file names, or %[1]s--code%[1]s to search content as well.
+		`, "`"),
+		Example: heredoc.Doc(`
+			# search public gists' descriptions for "octo"
+			$ gh gist search --public octo
+
+			# search all gists' descriptions, file names, and code for "foo|bar"
+			$ gh gist search --filename --code "foo|bar"
+		`),
+		Args: cmdutil.ExactArgs(1, "no search pattern passed"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var err error
+			opts.Pattern, err = regexp.CompilePOSIX(args[0])
+			if err != nil {
+				return err
+			}
+
+			// Replicate precedence of existing `gist` commands instead of mutually exclusive arguments.
+			opts.Visibility = "all"
+			if flagSecret {
+				opts.Visibility = "secret"
+			} else if flagPublic {
+				opts.Visibility = "public"
+			}
+
+			if runF != nil {
+				return runF(opts)
+			}
+			return searchRun(opts)
+		},
+	}
+
+	cmd.Flags().IntVarP(&opts.Limit, "limit", "L", 10, "Maximum number of gists to fetch")
+	cmd.Flags().BoolVar(&flagPublic, "public", false, "Show only public gists")
+	cmd.Flags().BoolVar(&flagSecret, "secret", false, "Show only secret gists")
+	cmd.Flags().BoolVar(&opts.Filename, "filename", false, "Include file names in search")
+	cmd.Flags().BoolVar(&opts.Code, "code", false, "Include code in search")
+
+	return cmd
+}
+
+func searchRun(opts *SearchOptions) error {
+	client, err := opts.HttpClient()
+	if err != nil {
+		return err
+	}
+
+	cfg, err := opts.Config()
+	if err != nil {
+		return err
+	}
+
+	host, _ := cfg.Authentication().DefaultHost()
+
+	// Query as many as possible. Limit will apply to search results.
+	allGists, err := shared.ListGists(client, host, shared.MaxPerPage, opts.Visibility, opts.Code)
+	if err != nil {
+		return err
+	}
+
+	gists := make([]shared.Gist, 0, opts.Limit)
+	for _, gist := range allGists {
+		if len(gists) == opts.Limit {
+			break
+		}
+
+		if opts.Pattern.MatchString(gist.Description) {
+			gists = append(gists, gist)
+			continue
+		}
+
+		if opts.Filename || opts.Code {
+			for _, file := range gist.Files {
+				if opts.Filename && opts.Pattern.MatchString(file.Filename) {
+					gists = append(gists, gist)
+					continue
+				}
+
+				if opts.Code && opts.Pattern.MatchString(file.Content) {
+					gists = append(gists, gist)
+					continue
+				}
+			}
+		}
+	}
+
+	if len(gists) == 0 {
+		return cmdutil.NewNoResultsError("no gists found")
+	}
+
+	return shared.PrintGists(opts.IO, gists)
+}
diff --git a/pkg/cmd/gist/search/search_test.go b/pkg/cmd/gist/search/search_test.go
new file mode 100644
index 000000000..ef1bff1f5
--- /dev/null
+++ b/pkg/cmd/gist/search/search_test.go
@@ -0,0 +1,361 @@
+package search
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/MakeNowJust/heredoc"
+	"github.com/cli/cli/v2/internal/config"
+	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/pkg/cmdutil"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/google/shlex"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewCmdSearch(t *testing.T) {
+	tests := []struct {
+		name  string
+		cli   string
+		wants SearchOptions
+	}{
+		{
+			name: "pattern only",
+			cli:  "octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Limit:      10,
+				Visibility: "all",
+			},
+		},
+		{
+			name: "public",
+			cli:  "--public octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Limit:      10,
+				Visibility: "public",
+			},
+		},
+		{
+			name: "secret",
+			cli:  `"foo|bar" --secret`,
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("foo|bar"),
+				Limit:      10,
+				Visibility: "secret",
+			},
+		},
+		{
+			name: "secret with explicit false value",
+			cli:  "--secret=false octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Limit:      10,
+				Visibility: "all",
+			},
+		},
+		{
+			name: "public and secret",
+			cli:  "--secret --public octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Limit:      10,
+				Visibility: "secret",
+			},
+		},
+		{
+			name: "limit",
+			cli:  "--limit 30 octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Limit:      30,
+				Visibility: "all",
+			},
+		},
+		{
+			name: "all arguments",
+			cli:  "--public --secret --filename --code --limit 30 octo",
+			wants: SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("octo"),
+				Filename:   true,
+				Code:       true,
+				Limit:      30,
+				Visibility: "secret",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := &cmdutil.Factory{}
+
+			argv, err := shlex.Split(tt.cli)
+			assert.NoError(t, err)
+
+			var gotOpts *SearchOptions
+			cmd := NewCmdSearch(f, func(opts *SearchOptions) error {
+				gotOpts = opts
+				return nil
+			})
+			cmd.SetArgs(argv)
+			cmd.SetIn(&bytes.Buffer{})
+			cmd.SetOut(&bytes.Buffer{})
+			cmd.SetErr(&bytes.Buffer{})
+
+			_, err = cmd.ExecuteC()
+			assert.NoError(t, err)
+
+			assert.Equal(t, tt.wants.Pattern.String(), gotOpts.Pattern.String())
+			assert.Equal(t, tt.wants.Filename, gotOpts.Filename)
+			assert.Equal(t, tt.wants.Code, gotOpts.Code)
+			assert.Equal(t, tt.wants.Visibility, gotOpts.Visibility)
+			assert.Equal(t, tt.wants.Limit, gotOpts.Limit)
+		})
+	}
+}
+
+func Test_searchRun(t *testing.T) {
+	const query = `query GistList\b`
+	sixHours, _ := time.ParseDuration("6h")
+	sixHoursAgo := time.Now().Add(-sixHours)
+
+	tests := []struct {
+		name    string
+		opts    *SearchOptions
+		wantErr bool
+		wantOut string
+		stubs   func(*httpmock.Registry)
+		nontty  bool
+	}{
+		{
+			name: "no gists",
+			opts: &SearchOptions{},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(`{ "data": { "viewer": {
+						"gists": { "nodes": [] }
+					} } }`))
+			},
+			wantErr: true,
+		},
+		{
+			name: "description only",
+			opts: &SearchOptions{
+				Pattern: regexp.MustCompilePOSIX("foo"),
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234567890",
+								"files": [{ "name": "cool.txt" }],
+								"description": "foo example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "4567890123",
+								"files": [{ "name": "gistfile0.txt" }],
+								"description": "bar example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Doc(`
+				ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
+				1234567890  foo example  1 file  public      about 6 hours ago
+			`),
+		},
+		{
+			name: "no results with public filter",
+			opts: &SearchOptions{
+				Pattern:    regexp.MustCompilePOSIX("foo"),
+				Visibility: "public",
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "4567890123",
+								"files": [{ "name": "gistfile0.txt" }],
+								"description": "bar example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantErr: true,
+		},
+		{
+			name: "description only",
+			opts: &SearchOptions{
+				Pattern: regexp.MustCompilePOSIX("foo"),
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234567890",
+								"files": [{ "name": "cool.txt" }],
+								"description": "foo example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "4567890123",
+								"files": [{ "name": "gistfile0.txt" }],
+								"description": "bar example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Doc(`
+				ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
+				1234567890  foo example  1 file  public      about 6 hours ago
+			`),
+		},
+		{
+			name: "include filenames",
+			opts: &SearchOptions{
+				Pattern:  regexp.MustCompilePOSIX("gistfile7"),
+				Filename: true,
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "2345678901",
+								"files": [
+									{ "name": "gistfile0.txt" },
+									{ "name": "gistfile1.txt" }
+								],
+								"description": "foo example",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "3456789012",
+								"files": [
+									{ "name": "gistfile0.txt" },
+									{ "name": "gistfile1.txt" },
+									{ "name": "gistfile2.txt" },
+									{ "name": "gistfile3.txt" },
+									{ "name": "gistfile4.txt" },
+									{ "name": "gistfile5.txt" },
+									{ "name": "gistfile6.txt" },
+									{ "name": "gistfile7.txt" },
+									{ "name": "gistfile9.txt" },
+									{ "name": "gistfile10.txt" },
+									{ "name": "gistfile11.txt" }
+								],
+								"description": "bar example",
+								"updatedAt": "%[1]v",
+								"isPublic": false
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Doc(`
+				ID          DESCRIPTION  FILES     VISIBILITY  UPDATED
+				3456789012  bar example  11 files  secret      about 6 hours ago
+			`),
+		},
+		{
+			name: "include code",
+			opts: &SearchOptions{
+				Pattern: regexp.MustCompilePOSIX("octo"),
+				Code:    true,
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+								{
+									"name": "2345678901",
+									"files": [
+										{
+											"name": "gistfile0.txt",
+											"text": "octo"
+										}
+									],
+									"description": "foo example",
+									"updatedAt": "%[1]v",
+									"isPublic": true
+								}
+							] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Doc(`
+					ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
+					2345678901  foo example  1 file  public      about 6 hours ago
+				`),
+		},
+	}
+
+	for _, tt := range tests {
+		reg := &httpmock.Registry{}
+		tt.stubs(reg)
+
+		tt.opts.HttpClient = func() (*http.Client, error) {
+			return &http.Client{Transport: reg}, nil
+		}
+
+		tt.opts.Config = func() (gh.Config, error) {
+			return config.NewBlankConfig(), nil
+		}
+
+		ios, _, stdout, _ := iostreams.Test()
+		ios.SetStdoutTTY(!tt.nontty)
+		tt.opts.IO = ios
+
+		if tt.opts.Limit == 0 {
+			tt.opts.Limit = 10
+		}
+
+		if tt.opts.Visibility == "" {
+			tt.opts.Visibility = "all"
+		}
+		t.Run(tt.name, func(t *testing.T) {
+			err := searchRun(tt.opts)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+
+			assert.Equal(t, tt.wantOut, stdout.String())
+			reg.Verify(t)
+		})
+	}
+}
diff --git a/pkg/cmd/gist/shared/shared.go b/pkg/cmd/gist/shared/shared.go
index 66ba6fe0a..497a8e218 100644
--- a/pkg/cmd/gist/shared/shared.go
+++ b/pkg/cmd/gist/shared/shared.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/prompter"
+	"github.com/cli/cli/v2/internal/tableprinter"
 	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/gabriel-vasile/mimetype"
@@ -74,7 +75,9 @@ func GistIDFromURL(gistURL string) (string, error) {
 	return "", fmt.Errorf("Invalid gist URL %s", u)
 }
 
-func ListGists(client *http.Client, hostname string, limit int, visibility string) ([]Gist, error) {
+const MaxPerPage = 100
+
+func ListGists(client *http.Client, hostname string, limit int, visibility string, includeText bool) ([]Gist, error) {
 	type response struct {
 		Viewer struct {
 			Gists struct {
@@ -82,6 +85,7 @@ func ListGists(client *http.Client, hostname string, limit int, visibility strin
 					Description string
 					Files       []struct {
 						Name string
+						Text string `graphql:"text @include(if: $includeText)"`
 					}
 					IsPublic  bool
 					Name      string
@@ -96,14 +100,15 @@ func ListGists(client *http.Client, hostname string, limit int, visibility strin
 	}
 
 	perPage := limit
-	if perPage > 100 {
-		perPage = 100
+	if perPage > MaxPerPage {
+		perPage = MaxPerPage
 	}
 
 	variables := map[string]interface{}{
-		"per_page":   githubv4.Int(perPage),
-		"endCursor":  (*githubv4.String)(nil),
-		"visibility": githubv4.GistPrivacy(strings.ToUpper(visibility)),
+		"per_page":    githubv4.Int(perPage),
+		"endCursor":   (*githubv4.String)(nil),
+		"visibility":  githubv4.GistPrivacy(strings.ToUpper(visibility)),
+		"includeText": githubv4.Boolean(includeText),
 	}
 
 	gql := api.NewClientFromHTTP(client)
@@ -122,6 +127,7 @@ pagination:
 			for _, file := range gist.Files {
 				files[file.Name] = &GistFile{
 					Filename: file.Name,
+					Content:  file.Text,
 				}
 			}
 
@@ -177,7 +183,7 @@ func IsBinaryContents(contents []byte) bool {
 }
 
 func PromptGists(prompter prompter.Prompter, client *http.Client, host string, cs *iostreams.ColorScheme) (gistID string, err error) {
-	gists, err := ListGists(client, host, 10, "all")
+	gists, err := ListGists(client, host, 10, "all", false)
 	if err != nil {
 		return "", err
 	}
@@ -220,3 +226,47 @@ func PromptGists(prompter prompter.Prompter, client *http.Client, host string, c
 
 	return gistIDs[result], nil
 }
+
+func PrintGists(io *iostreams.IOStreams, gists []Gist) error {
+	if err := io.StartPager(); err == nil {
+		defer io.StopPager()
+	} else {
+		fmt.Fprintf(io.ErrOut, "failed to start pager: %v\n", err)
+	}
+
+	cs := io.ColorScheme()
+	tp := tableprinter.New(io, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
+
+	for _, gist := range gists {
+		fileCount := len(gist.Files)
+
+		visibility := "public"
+		visColor := cs.Green
+		if !gist.Public {
+			visibility = "secret"
+			visColor = cs.Red
+		}
+
+		description := gist.Description
+		if description == "" {
+			for filename := range gist.Files {
+				if !strings.HasPrefix(filename, "gistfile") {
+					description = filename
+					break
+				}
+			}
+		}
+
+		tp.AddField(gist.ID)
+		tp.AddField(
+			text.RemoveExcessiveWhitespace(description),
+			tableprinter.WithColor(cs.Bold),
+		)
+		tp.AddField(text.Pluralize(fileCount, "file"))
+		tp.AddField(visibility, tableprinter.WithColor(visColor))
+		tp.AddTimeField(time.Now(), gist.UpdatedAt, cs.Gray)
+		tp.EndRow()
+	}
+
+	return tp.Render()
+}

From 2fb5687777747b21859084ba77068dddf2a8c6d2 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Tue, 8 Oct 2024 10:53:54 -0700
Subject: [PATCH 150/301] Improve performance

Filter as we get results instead of getting them all. This allows us to more easily terminate pagination when opts.Limit is reached.
---
 pkg/cmd/gist/list/list.go          |  2 +-
 pkg/cmd/gist/search/search.go      | 29 ++++++++++-----------------
 pkg/cmd/gist/search/search_test.go | 16 ++++++++++++---
 pkg/cmd/gist/shared/shared.go      | 32 ++++++++++++++++--------------
 4 files changed, 41 insertions(+), 38 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 6fb70a3d0..43c4473b5 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -73,7 +73,7 @@ func listRun(opts *ListOptions) error {
 
 	host, _ := cfg.Authentication().DefaultHost()
 
-	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, false)
+	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, false, nil)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/gist/search/search.go b/pkg/cmd/gist/search/search.go
index 948a79483..b1c04a2c7 100644
--- a/pkg/cmd/gist/search/search.go
+++ b/pkg/cmd/gist/search/search.go
@@ -38,7 +38,7 @@ func NewCmdSearch(f *cmdutil.Factory, runF func(*SearchOptions) error) *cobra.Co
 		Use:   "search <pattern>",
 		Short: "Search your gists",
 		Long: heredoc.Docf(`
-			Search your gists' for the given POSIX regular expression.
+			Search your gists' for a case-sensitive POSIX regular expression.
 
 			By default, all gists' descriptions are searched. Pass %[1]s--filename%[1]s to search
 			file names, or %[1]s--code%[1]s to search content as well.
@@ -95,36 +95,27 @@ func searchRun(opts *SearchOptions) error {
 
 	host, _ := cfg.Authentication().DefaultHost()
 
-	// Query as many as possible. Limit will apply to search results.
-	allGists, err := shared.ListGists(client, host, shared.MaxPerPage, opts.Visibility, opts.Code)
-	if err != nil {
-		return err
-	}
-
-	gists := make([]shared.Gist, 0, opts.Limit)
-	for _, gist := range allGists {
-		if len(gists) == opts.Limit {
-			break
-		}
-
+	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, opts.Code, func(gist *shared.Gist) bool {
 		if opts.Pattern.MatchString(gist.Description) {
-			gists = append(gists, gist)
-			continue
+			return true
 		}
 
 		if opts.Filename || opts.Code {
 			for _, file := range gist.Files {
 				if opts.Filename && opts.Pattern.MatchString(file.Filename) {
-					gists = append(gists, gist)
-					continue
+					return true
 				}
 
 				if opts.Code && opts.Pattern.MatchString(file.Content) {
-					gists = append(gists, gist)
-					continue
+					return true
 				}
 			}
 		}
+
+		return false
+	})
+	if err != nil {
+		return err
 	}
 
 	if len(gists) == 0 {
diff --git a/pkg/cmd/gist/search/search_test.go b/pkg/cmd/gist/search/search_test.go
index ef1bff1f5..d6f98c1a3 100644
--- a/pkg/cmd/gist/search/search_test.go
+++ b/pkg/cmd/gist/search/search_test.go
@@ -20,9 +20,10 @@ import (
 
 func TestNewCmdSearch(t *testing.T) {
 	tests := []struct {
-		name  string
-		cli   string
-		wants SearchOptions
+		name     string
+		cli      string
+		wants    SearchOptions
+		wantsErr bool
 	}{
 		{
 			name: "pattern only",
@@ -89,6 +90,11 @@ func TestNewCmdSearch(t *testing.T) {
 				Visibility: "secret",
 			},
 		},
+		{
+			name:     "invalid regexp pattern",
+			cli:      `invalid(\\`,
+			wantsErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -109,6 +115,10 @@ func TestNewCmdSearch(t *testing.T) {
 			cmd.SetErr(&bytes.Buffer{})
 
 			_, err = cmd.ExecuteC()
+			if tt.wantsErr {
+				assert.Error(t, err)
+				return
+			}
 			assert.NoError(t, err)
 
 			assert.Equal(t, tt.wants.Pattern.String(), gotOpts.Pattern.String())
diff --git a/pkg/cmd/gist/shared/shared.go b/pkg/cmd/gist/shared/shared.go
index 497a8e218..a616ca9b6 100644
--- a/pkg/cmd/gist/shared/shared.go
+++ b/pkg/cmd/gist/shared/shared.go
@@ -75,9 +75,9 @@ func GistIDFromURL(gistURL string) (string, error) {
 	return "", fmt.Errorf("Invalid gist URL %s", u)
 }
 
-const MaxPerPage = 100
+const maxPerPage = 100
 
-func ListGists(client *http.Client, hostname string, limit int, visibility string, includeText bool) ([]Gist, error) {
+func ListGists(client *http.Client, hostname string, limit int, visibility string, includeText bool, filter func(*Gist) bool) ([]Gist, error) {
 	type response struct {
 		Viewer struct {
 			Gists struct {
@@ -100,8 +100,8 @@ func ListGists(client *http.Client, hostname string, limit int, visibility strin
 	}
 
 	perPage := limit
-	if perPage > MaxPerPage {
-		perPage = MaxPerPage
+	if perPage > maxPerPage {
+		perPage = maxPerPage
 	}
 
 	variables := map[string]interface{}{
@@ -131,16 +131,18 @@ pagination:
 				}
 			}
 
-			gists = append(
-				gists,
-				Gist{
-					ID:          gist.Name,
-					Description: gist.Description,
-					Files:       files,
-					UpdatedAt:   gist.UpdatedAt,
-					Public:      gist.IsPublic,
-				},
-			)
+			gist := Gist{
+				ID:          gist.Name,
+				Description: gist.Description,
+				Files:       files,
+				UpdatedAt:   gist.UpdatedAt,
+				Public:      gist.IsPublic,
+			}
+
+			if filter == nil || filter(&gist) {
+				gists = append(gists, gist)
+			}
+
 			if len(gists) == limit {
 				break pagination
 			}
@@ -183,7 +185,7 @@ func IsBinaryContents(contents []byte) bool {
 }
 
 func PromptGists(prompter prompter.Prompter, client *http.Client, host string, cs *iostreams.ColorScheme) (gistID string, err error) {
-	gists, err := ListGists(client, host, 10, "all", false)
+	gists, err := ListGists(client, host, 10, "all", false, nil)
 	if err != nil {
 		return "", err
 	}

From 34203d7e6cc95fdb782556a6a9bdc915fa3d902f Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Wed, 9 Oct 2024 00:10:17 -0700
Subject: [PATCH 151/301] Refactor filtering into existing `gist list`

Resolves feedback in issue #9704
---
 pkg/cmd/gist/gist.go               |   2 -
 pkg/cmd/gist/list/list.go          |  65 ++++-
 pkg/cmd/gist/list/list_test.go     |  84 ++++++-
 pkg/cmd/gist/search/search.go      | 126 ----------
 pkg/cmd/gist/search/search_test.go | 371 -----------------------------
 pkg/cmd/gist/shared/shared.go      |  80 +++----
 6 files changed, 169 insertions(+), 559 deletions(-)
 delete mode 100644 pkg/cmd/gist/search/search.go
 delete mode 100644 pkg/cmd/gist/search/search_test.go

diff --git a/pkg/cmd/gist/gist.go b/pkg/cmd/gist/gist.go
index bf562bf74..1f7fc9ea0 100644
--- a/pkg/cmd/gist/gist.go
+++ b/pkg/cmd/gist/gist.go
@@ -8,7 +8,6 @@ import (
 	gistEditCmd "github.com/cli/cli/v2/pkg/cmd/gist/edit"
 	gistListCmd "github.com/cli/cli/v2/pkg/cmd/gist/list"
 	gistRenameCmd "github.com/cli/cli/v2/pkg/cmd/gist/rename"
-	gistSearchCmd "github.com/cli/cli/v2/pkg/cmd/gist/search"
 	gistViewCmd "github.com/cli/cli/v2/pkg/cmd/gist/view"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/spf13/cobra"
@@ -36,7 +35,6 @@ func NewCmdGist(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(gistEditCmd.NewCmdEdit(f, nil))
 	cmd.AddCommand(gistDeleteCmd.NewCmdDelete(f, nil))
 	cmd.AddCommand(gistRenameCmd.NewCmdRename(f, nil))
-	cmd.AddCommand(gistSearchCmd.NewCmdSearch(f, nil))
 
 	return cmd
 }
diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 43c4473b5..215fedcce 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -1,9 +1,15 @@
 package list
 
 import (
+	"fmt"
 	"net/http"
+	"regexp"
+	"strings"
+	"time"
 
 	"github.com/cli/cli/v2/internal/gh"
+	"github.com/cli/cli/v2/internal/tableprinter"
+	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmd/gist/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
@@ -15,8 +21,10 @@ type ListOptions struct {
 	Config     func() (gh.Config, error)
 	HttpClient func() (*http.Client, error)
 
-	Limit      int
-	Visibility string // all, secret, public
+	Limit          int
+	Filter         *regexp.Regexp
+	IncludeContent bool
+	Visibility     string // all, secret, public
 }
 
 func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Command {
@@ -28,6 +36,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 
 	var flagPublic bool
 	var flagSecret bool
+	var flagFilter string
 
 	cmd := &cobra.Command{
 		Use:     "list",
@@ -39,6 +48,12 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 				return cmdutil.FlagErrorf("invalid limit: %v", opts.Limit)
 			}
 
+			if filter, err := regexp.CompilePOSIX(flagFilter); err != nil {
+				return err
+			} else {
+				opts.Filter = filter
+			}
+
 			opts.Visibility = "all"
 			if flagSecret {
 				opts.Visibility = "secret"
@@ -56,6 +71,8 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 	cmd.Flags().IntVarP(&opts.Limit, "limit", "L", 10, "Maximum number of gists to fetch")
 	cmd.Flags().BoolVar(&flagPublic, "public", false, "Show only public gists")
 	cmd.Flags().BoolVar(&flagSecret, "secret", false, "Show only secret gists")
+	cmd.Flags().StringVar(&flagFilter, "filter", "", "Filter gists using a regular expression")
+	cmd.Flags().BoolVar(&opts.IncludeContent, "include-content", false, "Include gists' file content when filtering")
 
 	return cmd
 }
@@ -73,7 +90,7 @@ func listRun(opts *ListOptions) error {
 
 	host, _ := cfg.Authentication().DefaultHost()
 
-	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, false, nil)
+	gists, err := shared.ListGists(client, host, opts.Limit, opts.Filter, opts.IncludeContent, opts.Visibility)
 	if err != nil {
 		return err
 	}
@@ -82,5 +99,45 @@ func listRun(opts *ListOptions) error {
 		return cmdutil.NewNoResultsError("no gists found")
 	}
 
-	return shared.PrintGists(opts.IO, gists)
+	if err := opts.IO.StartPager(); err == nil {
+		defer opts.IO.StopPager()
+	} else {
+		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
+	}
+
+	cs := opts.IO.ColorScheme()
+	tp := tableprinter.New(opts.IO, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
+
+	for _, gist := range gists {
+		fileCount := len(gist.Files)
+
+		visibility := "public"
+		visColor := cs.Green
+		if !gist.Public {
+			visibility = "secret"
+			visColor = cs.Red
+		}
+
+		description := gist.Description
+		if description == "" {
+			for filename := range gist.Files {
+				if !strings.HasPrefix(filename, "gistfile") {
+					description = filename
+					break
+				}
+			}
+		}
+
+		tp.AddField(gist.ID)
+		tp.AddField(
+			text.RemoveExcessiveWhitespace(description),
+			tableprinter.WithColor(cs.Bold),
+		)
+		tp.AddField(text.Pluralize(fileCount, "file"))
+		tp.AddField(visibility, tableprinter.WithColor(visColor))
+		tp.AddTimeField(time.Now(), gist.UpdatedAt, cs.Gray)
+		tp.EndRow()
+	}
+
+	return tp.Render()
 }
diff --git a/pkg/cmd/gist/list/list_test.go b/pkg/cmd/gist/list/list_test.go
index a15bae6aa..80e3178ab 100644
--- a/pkg/cmd/gist/list/list_test.go
+++ b/pkg/cmd/gist/list/list_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"net/http"
+	"regexp"
 	"testing"
 	"time"
 
@@ -19,9 +20,10 @@ import (
 
 func TestNewCmdList(t *testing.T) {
 	tests := []struct {
-		name  string
-		cli   string
-		wants ListOptions
+		name     string
+		cli      string
+		wants    ListOptions
+		wantsErr bool
 	}{
 		{
 			name: "no arguments",
@@ -70,6 +72,26 @@ func TestNewCmdList(t *testing.T) {
 				Visibility: "all",
 			},
 		},
+		{
+			name:     "invalid limit",
+			cli:      "--limit 0",
+			wantsErr: true,
+		},
+		{
+			name: "filter and include-content",
+			cli:  "--filter octo --include-content",
+			wants: ListOptions{
+				Limit:          10,
+				Filter:         regexp.MustCompilePOSIX("octo"),
+				IncludeContent: true,
+				Visibility:     "all",
+			},
+		},
+		{
+			name:     "invalid filter",
+			cli:      "--filter octo(",
+			wantsErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -90,6 +112,10 @@ func TestNewCmdList(t *testing.T) {
 			cmd.SetErr(&bytes.Buffer{})
 
 			_, err = cmd.ExecuteC()
+			if tt.wantsErr {
+				assert.Error(t, err)
+				return
+			}
 			assert.NoError(t, err)
 
 			assert.Equal(t, tt.wants.Visibility, gotOpts.Visibility)
@@ -358,6 +384,58 @@ func Test_listRun(t *testing.T) {
 			`),
 			nontty: true,
 		},
+		{
+			name: "with content filter",
+			opts: &ListOptions{
+				Filter:         regexp.MustCompile("octo"),
+				IncludeContent: true,
+				Visibility:     "all",
+			},
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234",
+								"files": [
+									{ "name": "main.txt", "text": "foo" }
+								],
+								"description": "octo match in the description",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "2345",
+								"files": [
+									{ "name": "main.txt", "text": "foo" },
+									{ "name": "octo.txt", "text": "bar" }
+								],
+								"description": "match in the file name",
+								"updatedAt": "%[1]v",
+								"isPublic": false
+							},
+							{
+								"name": "3456",
+								"files": [
+									{ "name": "main.txt", "text": "octo in the text" }
+								],
+								"description": "match in the file text",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Doc(`
+				ID    DESCRIPTION                    FILES    VISIBILITY  UPDATED
+				1234  octo match in the description  1 file   public      about 6 hours ago
+				2345  match in the file name         2 files  secret      about 6 hours ago
+				3456  match in the file text         1 file   public      about 6 hours ago
+			`),
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/pkg/cmd/gist/search/search.go b/pkg/cmd/gist/search/search.go
deleted file mode 100644
index b1c04a2c7..000000000
--- a/pkg/cmd/gist/search/search.go
+++ /dev/null
@@ -1,126 +0,0 @@
-package search
-
-import (
-	"net/http"
-	"regexp"
-
-	"github.com/MakeNowJust/heredoc"
-	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/pkg/cmd/gist/shared"
-	"github.com/cli/cli/v2/pkg/cmdutil"
-	"github.com/cli/cli/v2/pkg/iostreams"
-	"github.com/spf13/cobra"
-)
-
-type SearchOptions struct {
-	IO         *iostreams.IOStreams
-	Config     func() (gh.Config, error)
-	HttpClient func() (*http.Client, error)
-
-	Pattern    *regexp.Regexp
-	Filename   bool
-	Code       bool
-	Visibility string // all, secret, public
-	Limit      int
-}
-
-func NewCmdSearch(f *cmdutil.Factory, runF func(*SearchOptions) error) *cobra.Command {
-	opts := &SearchOptions{
-		IO:         f.IOStreams,
-		Config:     f.Config,
-		HttpClient: f.HttpClient,
-	}
-
-	var flagPublic bool
-	var flagSecret bool
-
-	cmd := &cobra.Command{
-		Use:   "search <pattern>",
-		Short: "Search your gists",
-		Long: heredoc.Docf(`
-			Search your gists' for a case-sensitive POSIX regular expression.
-
-			By default, all gists' descriptions are searched. Pass %[1]s--filename%[1]s to search
-			file names, or %[1]s--code%[1]s to search content as well.
-		`, "`"),
-		Example: heredoc.Doc(`
-			# search public gists' descriptions for "octo"
-			$ gh gist search --public octo
-
-			# search all gists' descriptions, file names, and code for "foo|bar"
-			$ gh gist search --filename --code "foo|bar"
-		`),
-		Args: cmdutil.ExactArgs(1, "no search pattern passed"),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			var err error
-			opts.Pattern, err = regexp.CompilePOSIX(args[0])
-			if err != nil {
-				return err
-			}
-
-			// Replicate precedence of existing `gist` commands instead of mutually exclusive arguments.
-			opts.Visibility = "all"
-			if flagSecret {
-				opts.Visibility = "secret"
-			} else if flagPublic {
-				opts.Visibility = "public"
-			}
-
-			if runF != nil {
-				return runF(opts)
-			}
-			return searchRun(opts)
-		},
-	}
-
-	cmd.Flags().IntVarP(&opts.Limit, "limit", "L", 10, "Maximum number of gists to fetch")
-	cmd.Flags().BoolVar(&flagPublic, "public", false, "Show only public gists")
-	cmd.Flags().BoolVar(&flagSecret, "secret", false, "Show only secret gists")
-	cmd.Flags().BoolVar(&opts.Filename, "filename", false, "Include file names in search")
-	cmd.Flags().BoolVar(&opts.Code, "code", false, "Include code in search")
-
-	return cmd
-}
-
-func searchRun(opts *SearchOptions) error {
-	client, err := opts.HttpClient()
-	if err != nil {
-		return err
-	}
-
-	cfg, err := opts.Config()
-	if err != nil {
-		return err
-	}
-
-	host, _ := cfg.Authentication().DefaultHost()
-
-	gists, err := shared.ListGists(client, host, opts.Limit, opts.Visibility, opts.Code, func(gist *shared.Gist) bool {
-		if opts.Pattern.MatchString(gist.Description) {
-			return true
-		}
-
-		if opts.Filename || opts.Code {
-			for _, file := range gist.Files {
-				if opts.Filename && opts.Pattern.MatchString(file.Filename) {
-					return true
-				}
-
-				if opts.Code && opts.Pattern.MatchString(file.Content) {
-					return true
-				}
-			}
-		}
-
-		return false
-	})
-	if err != nil {
-		return err
-	}
-
-	if len(gists) == 0 {
-		return cmdutil.NewNoResultsError("no gists found")
-	}
-
-	return shared.PrintGists(opts.IO, gists)
-}
diff --git a/pkg/cmd/gist/search/search_test.go b/pkg/cmd/gist/search/search_test.go
deleted file mode 100644
index d6f98c1a3..000000000
--- a/pkg/cmd/gist/search/search_test.go
+++ /dev/null
@@ -1,371 +0,0 @@
-package search
-
-import (
-	"bytes"
-	"fmt"
-	"net/http"
-	"regexp"
-	"testing"
-	"time"
-
-	"github.com/MakeNowJust/heredoc"
-	"github.com/cli/cli/v2/internal/config"
-	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/pkg/cmdutil"
-	"github.com/cli/cli/v2/pkg/httpmock"
-	"github.com/cli/cli/v2/pkg/iostreams"
-	"github.com/google/shlex"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNewCmdSearch(t *testing.T) {
-	tests := []struct {
-		name     string
-		cli      string
-		wants    SearchOptions
-		wantsErr bool
-	}{
-		{
-			name: "pattern only",
-			cli:  "octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Limit:      10,
-				Visibility: "all",
-			},
-		},
-		{
-			name: "public",
-			cli:  "--public octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Limit:      10,
-				Visibility: "public",
-			},
-		},
-		{
-			name: "secret",
-			cli:  `"foo|bar" --secret`,
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("foo|bar"),
-				Limit:      10,
-				Visibility: "secret",
-			},
-		},
-		{
-			name: "secret with explicit false value",
-			cli:  "--secret=false octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Limit:      10,
-				Visibility: "all",
-			},
-		},
-		{
-			name: "public and secret",
-			cli:  "--secret --public octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Limit:      10,
-				Visibility: "secret",
-			},
-		},
-		{
-			name: "limit",
-			cli:  "--limit 30 octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Limit:      30,
-				Visibility: "all",
-			},
-		},
-		{
-			name: "all arguments",
-			cli:  "--public --secret --filename --code --limit 30 octo",
-			wants: SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("octo"),
-				Filename:   true,
-				Code:       true,
-				Limit:      30,
-				Visibility: "secret",
-			},
-		},
-		{
-			name:     "invalid regexp pattern",
-			cli:      `invalid(\\`,
-			wantsErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f := &cmdutil.Factory{}
-
-			argv, err := shlex.Split(tt.cli)
-			assert.NoError(t, err)
-
-			var gotOpts *SearchOptions
-			cmd := NewCmdSearch(f, func(opts *SearchOptions) error {
-				gotOpts = opts
-				return nil
-			})
-			cmd.SetArgs(argv)
-			cmd.SetIn(&bytes.Buffer{})
-			cmd.SetOut(&bytes.Buffer{})
-			cmd.SetErr(&bytes.Buffer{})
-
-			_, err = cmd.ExecuteC()
-			if tt.wantsErr {
-				assert.Error(t, err)
-				return
-			}
-			assert.NoError(t, err)
-
-			assert.Equal(t, tt.wants.Pattern.String(), gotOpts.Pattern.String())
-			assert.Equal(t, tt.wants.Filename, gotOpts.Filename)
-			assert.Equal(t, tt.wants.Code, gotOpts.Code)
-			assert.Equal(t, tt.wants.Visibility, gotOpts.Visibility)
-			assert.Equal(t, tt.wants.Limit, gotOpts.Limit)
-		})
-	}
-}
-
-func Test_searchRun(t *testing.T) {
-	const query = `query GistList\b`
-	sixHours, _ := time.ParseDuration("6h")
-	sixHoursAgo := time.Now().Add(-sixHours)
-
-	tests := []struct {
-		name    string
-		opts    *SearchOptions
-		wantErr bool
-		wantOut string
-		stubs   func(*httpmock.Registry)
-		nontty  bool
-	}{
-		{
-			name: "no gists",
-			opts: &SearchOptions{},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(`{ "data": { "viewer": {
-						"gists": { "nodes": [] }
-					} } }`))
-			},
-			wantErr: true,
-		},
-		{
-			name: "description only",
-			opts: &SearchOptions{
-				Pattern: regexp.MustCompilePOSIX("foo"),
-			},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(fmt.Sprintf(
-						`{ "data": { "viewer": { "gists": { "nodes": [
-							{
-								"name": "1234567890",
-								"files": [{ "name": "cool.txt" }],
-								"description": "foo example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							},
-							{
-								"name": "4567890123",
-								"files": [{ "name": "gistfile0.txt" }],
-								"description": "bar example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							}
-						] } } } }`,
-						sixHoursAgo.Format(time.RFC3339),
-					)),
-				)
-			},
-			wantOut: heredoc.Doc(`
-				ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
-				1234567890  foo example  1 file  public      about 6 hours ago
-			`),
-		},
-		{
-			name: "no results with public filter",
-			opts: &SearchOptions{
-				Pattern:    regexp.MustCompilePOSIX("foo"),
-				Visibility: "public",
-			},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(fmt.Sprintf(
-						`{ "data": { "viewer": { "gists": { "nodes": [
-							{
-								"name": "4567890123",
-								"files": [{ "name": "gistfile0.txt" }],
-								"description": "bar example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							}
-						] } } } }`,
-						sixHoursAgo.Format(time.RFC3339),
-					)),
-				)
-			},
-			wantErr: true,
-		},
-		{
-			name: "description only",
-			opts: &SearchOptions{
-				Pattern: regexp.MustCompilePOSIX("foo"),
-			},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(fmt.Sprintf(
-						`{ "data": { "viewer": { "gists": { "nodes": [
-							{
-								"name": "1234567890",
-								"files": [{ "name": "cool.txt" }],
-								"description": "foo example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							},
-							{
-								"name": "4567890123",
-								"files": [{ "name": "gistfile0.txt" }],
-								"description": "bar example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							}
-						] } } } }`,
-						sixHoursAgo.Format(time.RFC3339),
-					)),
-				)
-			},
-			wantOut: heredoc.Doc(`
-				ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
-				1234567890  foo example  1 file  public      about 6 hours ago
-			`),
-		},
-		{
-			name: "include filenames",
-			opts: &SearchOptions{
-				Pattern:  regexp.MustCompilePOSIX("gistfile7"),
-				Filename: true,
-			},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(fmt.Sprintf(
-						`{ "data": { "viewer": { "gists": { "nodes": [
-							{
-								"name": "2345678901",
-								"files": [
-									{ "name": "gistfile0.txt" },
-									{ "name": "gistfile1.txt" }
-								],
-								"description": "foo example",
-								"updatedAt": "%[1]v",
-								"isPublic": true
-							},
-							{
-								"name": "3456789012",
-								"files": [
-									{ "name": "gistfile0.txt" },
-									{ "name": "gistfile1.txt" },
-									{ "name": "gistfile2.txt" },
-									{ "name": "gistfile3.txt" },
-									{ "name": "gistfile4.txt" },
-									{ "name": "gistfile5.txt" },
-									{ "name": "gistfile6.txt" },
-									{ "name": "gistfile7.txt" },
-									{ "name": "gistfile9.txt" },
-									{ "name": "gistfile10.txt" },
-									{ "name": "gistfile11.txt" }
-								],
-								"description": "bar example",
-								"updatedAt": "%[1]v",
-								"isPublic": false
-							}
-						] } } } }`,
-						sixHoursAgo.Format(time.RFC3339),
-					)),
-				)
-			},
-			wantOut: heredoc.Doc(`
-				ID          DESCRIPTION  FILES     VISIBILITY  UPDATED
-				3456789012  bar example  11 files  secret      about 6 hours ago
-			`),
-		},
-		{
-			name: "include code",
-			opts: &SearchOptions{
-				Pattern: regexp.MustCompilePOSIX("octo"),
-				Code:    true,
-			},
-			stubs: func(reg *httpmock.Registry) {
-				reg.Register(
-					httpmock.GraphQL(query),
-					httpmock.StringResponse(fmt.Sprintf(
-						`{ "data": { "viewer": { "gists": { "nodes": [
-								{
-									"name": "2345678901",
-									"files": [
-										{
-											"name": "gistfile0.txt",
-											"text": "octo"
-										}
-									],
-									"description": "foo example",
-									"updatedAt": "%[1]v",
-									"isPublic": true
-								}
-							] } } } }`,
-						sixHoursAgo.Format(time.RFC3339),
-					)),
-				)
-			},
-			wantOut: heredoc.Doc(`
-					ID          DESCRIPTION  FILES   VISIBILITY  UPDATED
-					2345678901  foo example  1 file  public      about 6 hours ago
-				`),
-		},
-	}
-
-	for _, tt := range tests {
-		reg := &httpmock.Registry{}
-		tt.stubs(reg)
-
-		tt.opts.HttpClient = func() (*http.Client, error) {
-			return &http.Client{Transport: reg}, nil
-		}
-
-		tt.opts.Config = func() (gh.Config, error) {
-			return config.NewBlankConfig(), nil
-		}
-
-		ios, _, stdout, _ := iostreams.Test()
-		ios.SetStdoutTTY(!tt.nontty)
-		tt.opts.IO = ios
-
-		if tt.opts.Limit == 0 {
-			tt.opts.Limit = 10
-		}
-
-		if tt.opts.Visibility == "" {
-			tt.opts.Visibility = "all"
-		}
-		t.Run(tt.name, func(t *testing.T) {
-			err := searchRun(tt.opts)
-			if tt.wantErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-
-			assert.Equal(t, tt.wantOut, stdout.String())
-			reg.Verify(t)
-		})
-	}
-}
diff --git a/pkg/cmd/gist/shared/shared.go b/pkg/cmd/gist/shared/shared.go
index a616ca9b6..ee6dcf1e3 100644
--- a/pkg/cmd/gist/shared/shared.go
+++ b/pkg/cmd/gist/shared/shared.go
@@ -5,13 +5,13 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"regexp"
 	"sort"
 	"strings"
 	"time"
 
 	"github.com/cli/cli/v2/api"
 	"github.com/cli/cli/v2/internal/prompter"
-	"github.com/cli/cli/v2/internal/tableprinter"
 	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/gabriel-vasile/mimetype"
@@ -77,7 +77,7 @@ func GistIDFromURL(gistURL string) (string, error) {
 
 const maxPerPage = 100
 
-func ListGists(client *http.Client, hostname string, limit int, visibility string, includeText bool, filter func(*Gist) bool) ([]Gist, error) {
+func ListGists(client *http.Client, hostname string, limit int, filter *regexp.Regexp, includeContent bool, visibility string) ([]Gist, error) {
 	type response struct {
 		Viewer struct {
 			Gists struct {
@@ -85,7 +85,7 @@ func ListGists(client *http.Client, hostname string, limit int, visibility strin
 					Description string
 					Files       []struct {
 						Name string
-						Text string `graphql:"text @include(if: $includeText)"`
+						Text string `graphql:"text @include(if: $includeContent)"`
 					}
 					IsPublic  bool
 					Name      string
@@ -105,10 +105,28 @@ func ListGists(client *http.Client, hostname string, limit int, visibility strin
 	}
 
 	variables := map[string]interface{}{
-		"per_page":    githubv4.Int(perPage),
-		"endCursor":   (*githubv4.String)(nil),
-		"visibility":  githubv4.GistPrivacy(strings.ToUpper(visibility)),
-		"includeText": githubv4.Boolean(includeText),
+		"per_page":       githubv4.Int(perPage),
+		"endCursor":      (*githubv4.String)(nil),
+		"visibility":     githubv4.GistPrivacy(strings.ToUpper(visibility)),
+		"includeContent": githubv4.Boolean(includeContent),
+	}
+
+	filterFunc := func(gist *Gist) bool {
+		if filter.MatchString(gist.Description) {
+			return true
+		}
+
+		for _, file := range gist.Files {
+			if filter.MatchString(file.Filename) {
+				return true
+			}
+
+			if includeContent && filter.MatchString(file.Content) {
+				return true
+			}
+		}
+
+		return false
 	}
 
 	gql := api.NewClientFromHTTP(client)
@@ -139,7 +157,7 @@ pagination:
 				Public:      gist.IsPublic,
 			}
 
-			if filter == nil || filter(&gist) {
+			if filter == nil || filterFunc(&gist) {
 				gists = append(gists, gist)
 			}
 
@@ -185,7 +203,7 @@ func IsBinaryContents(contents []byte) bool {
 }
 
 func PromptGists(prompter prompter.Prompter, client *http.Client, host string, cs *iostreams.ColorScheme) (gistID string, err error) {
-	gists, err := ListGists(client, host, 10, "all", false, nil)
+	gists, err := ListGists(client, host, 10, nil, false, "all")
 	if err != nil {
 		return "", err
 	}
@@ -228,47 +246,3 @@ func PromptGists(prompter prompter.Prompter, client *http.Client, host string, c
 
 	return gistIDs[result], nil
 }
-
-func PrintGists(io *iostreams.IOStreams, gists []Gist) error {
-	if err := io.StartPager(); err == nil {
-		defer io.StopPager()
-	} else {
-		fmt.Fprintf(io.ErrOut, "failed to start pager: %v\n", err)
-	}
-
-	cs := io.ColorScheme()
-	tp := tableprinter.New(io, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
-
-	for _, gist := range gists {
-		fileCount := len(gist.Files)
-
-		visibility := "public"
-		visColor := cs.Green
-		if !gist.Public {
-			visibility = "secret"
-			visColor = cs.Red
-		}
-
-		description := gist.Description
-		if description == "" {
-			for filename := range gist.Files {
-				if !strings.HasPrefix(filename, "gistfile") {
-					description = filename
-					break
-				}
-			}
-		}
-
-		tp.AddField(gist.ID)
-		tp.AddField(
-			text.RemoveExcessiveWhitespace(description),
-			tableprinter.WithColor(cs.Bold),
-		)
-		tp.AddField(text.Pluralize(fileCount, "file"))
-		tp.AddField(visibility, tableprinter.WithColor(visColor))
-		tp.AddTimeField(time.Now(), gist.UpdatedAt, cs.Gray)
-		tp.EndRow()
-	}
-
-	return tp.Render()
-}

From 73af9f8bd98494d212d9a671ee00af74135376bd Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Wed, 9 Oct 2024 08:56:13 -0700
Subject: [PATCH 152/301] Improve help docs

Also changes `--filter` argument to "expression" to coincide with some other commands' help text e.g., `--jq`.
---
 pkg/cmd/gist/list/list.go | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 215fedcce..87db0fc5c 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/tableprinter"
 	"github.com/cli/cli/v2/internal/text"
@@ -39,8 +40,24 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 	var flagFilter string
 
 	cmd := &cobra.Command{
-		Use:     "list",
-		Short:   "List your gists",
+		Use:   "list",
+		Short: "List your gists",
+		Long: heredoc.Docf(`
+			List gists from your user account.
+
+			You can use a regular expression to filter the description, file names,
+			or even the content of files in the gist. See https://pkg.go.dev/regexp/syntax
+			for the regular expression syntax you can pass to %[1]s--filter%[1]s. Pass
+			%[1]s--include-content%[1]s to also search the content of files noting that
+			this will take longer since all files' content is fetched.
+		`, "`"),
+		Example: heredoc.Doc(`
+			# list all secret gists from your user account
+			$ gh gist list --secret
+
+			# find all gists from your user account mentioning "octo" anywhere
+			$ gh gist list --filter octo --include-content
+		`),
 		Aliases: []string{"ls"},
 		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -71,7 +88,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 	cmd.Flags().IntVarP(&opts.Limit, "limit", "L", 10, "Maximum number of gists to fetch")
 	cmd.Flags().BoolVar(&flagPublic, "public", false, "Show only public gists")
 	cmd.Flags().BoolVar(&flagSecret, "secret", false, "Show only secret gists")
-	cmd.Flags().StringVar(&flagFilter, "filter", "", "Filter gists using a regular expression")
+	cmd.Flags().StringVar(&flagFilter, "filter", "", "Filter gists using a regular `expression`")
 	cmd.Flags().BoolVar(&opts.IncludeContent, "include-content", false, "Include gists' file content when filtering")
 
 	return cmd

From b56353dc0222bffaa224cc40f64da39d43dcbd8b Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 10 Oct 2024 11:12:24 -0700
Subject: [PATCH 153/301] Disallow use of --include-content without --filter

---
 pkg/cmd/gist/list/list.go      | 6 ++++++
 pkg/cmd/gist/list/list_test.go | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 87db0fc5c..6e228b51c 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -65,6 +65,12 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 				return cmdutil.FlagErrorf("invalid limit: %v", opts.Limit)
 			}
 
+			if flagFilter == "" {
+				if opts.IncludeContent {
+					return cmdutil.FlagErrorf("cannot use --include-content without --filter")
+				}
+			}
+
 			if filter, err := regexp.CompilePOSIX(flagFilter); err != nil {
 				return err
 			} else {
diff --git a/pkg/cmd/gist/list/list_test.go b/pkg/cmd/gist/list/list_test.go
index 80e3178ab..0b88caf83 100644
--- a/pkg/cmd/gist/list/list_test.go
+++ b/pkg/cmd/gist/list/list_test.go
@@ -92,6 +92,11 @@ func TestNewCmdList(t *testing.T) {
 			cli:      "--filter octo(",
 			wantsErr: true,
 		},
+		{
+			name:     "include content without filter",
+			cli:      "--include-content",
+			wantsErr: true,
+		},
 	}
 
 	for _, tt := range tests {

From 1615f2c1e1c9cb3547807becb07bd961e8eb3764 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Fri, 11 Oct 2024 10:28:57 -0700
Subject: [PATCH 154/301] Simplify description

---
 pkg/cmd/gist/list/list.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 6e228b51c..40e422c73 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -46,10 +46,12 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 			List gists from your user account.
 
 			You can use a regular expression to filter the description, file names,
-			or even the content of files in the gist. See https://pkg.go.dev/regexp/syntax
-			for the regular expression syntax you can pass to %[1]s--filter%[1]s. Pass
-			%[1]s--include-content%[1]s to also search the content of files noting that
-			this will take longer since all files' content is fetched.
+			or even the content of files in the gist using %[1]s--filter%[1]s.
+
+			Use %[1]s--include-content%[1]s to include content of files, noting that
+			this will be slower and increase the rate limit used.
+
+			For supported regular expression syntax, see https://pkg.go.dev/regexp/syntax
 		`, "`"),
 		Example: heredoc.Doc(`
 			# list all secret gists from your user account

From 4eaeda580b6f33292f3dddc0f767e4fdf803acf5 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Fri, 11 Oct 2024 13:20:43 -0700
Subject: [PATCH 155/301] Show progress when filtering

Filtering can take a while, so show progress. This also uncovered a bug
that I wasn't checking if a filter was actually specified, resulting in
a non-nil `opts.Filter`.
---
 pkg/cmd/gist/list/list.go | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 40e422c73..ae138d6a2 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -71,12 +71,12 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 				if opts.IncludeContent {
 					return cmdutil.FlagErrorf("cannot use --include-content without --filter")
 				}
-			}
-
-			if filter, err := regexp.CompilePOSIX(flagFilter); err != nil {
-				return err
 			} else {
-				opts.Filter = filter
+				if filter, err := regexp.CompilePOSIX(flagFilter); err != nil {
+					return err
+				} else {
+					opts.Filter = filter
+				}
 			}
 
 			opts.Visibility = "all"
@@ -115,7 +115,13 @@ func listRun(opts *ListOptions) error {
 
 	host, _ := cfg.Authentication().DefaultHost()
 
+	// Filtering can take a while so start the progress indicator. StopProgressIndicator will no-op if not running.
+	if opts.Filter != nil {
+		opts.IO.StartProgressIndicator()
+	}
 	gists, err := shared.ListGists(client, host, opts.Limit, opts.Filter, opts.IncludeContent, opts.Visibility)
+	opts.IO.StopProgressIndicator()
+
 	if err != nil {
 		return err
 	}

From 70b14215ec1d0dccce17109ea8b680dc0caec1e2 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Fri, 11 Oct 2024 00:52:00 -0700
Subject: [PATCH 156/301] Print filtered gists similar to code search

---
 pkg/cmd/gist/list/list.go   | 85 ++++++++++++++++++++++++++++++++++++-
 pkg/cmd/search/code/code.go | 16 +++----
 pkg/iostreams/color.go      | 30 +++++++++++++
 3 files changed, 120 insertions(+), 11 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index ae138d6a2..c58ed06ea 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -136,8 +136,16 @@ func listRun(opts *ListOptions) error {
 		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
 	}
 
-	cs := opts.IO.ColorScheme()
-	tp := tableprinter.New(opts.IO, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
+	if opts.IO.ColorEnabled() && opts.Filter != nil {
+		return printHighlights(opts.IO, gists, opts.Filter)
+	}
+
+	return printTable(opts.IO, gists)
+}
+
+func printTable(io *iostreams.IOStreams, gists []shared.Gist) error {
+	cs := io.ColorScheme()
+	tp := tableprinter.New(io, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
 
 	for _, gist := range gists {
 		fileCount := len(gist.Files)
@@ -172,3 +180,76 @@ func listRun(opts *ListOptions) error {
 
 	return tp.Render()
 }
+
+func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Regexp) error {
+	const tab string = "    "
+	cs := io.ColorScheme()
+
+	out := &strings.Builder{}
+	var filename, description string
+	var err error
+	text := func(s string) string {
+		return s
+	}
+	for _, gist := range gists {
+		for _, file := range gist.Files {
+			found := false
+			out.Reset()
+
+			if filename, err = highlightMatch(file.Filename, filter, &found, cs.Green, cs.Highlight); err != nil {
+				return err
+			}
+			fmt.Fprintln(out, cs.Blue(gist.ID), filename)
+
+			if gist.Description != "" {
+				if description, err = highlightMatch(gist.Description, filter, &found, cs.Bold, cs.Highlight); err != nil {
+					return err
+				}
+				fmt.Fprintln(out, tab, description)
+			}
+
+			if file.Content != "" {
+				for _, line := range strings.Split(file.Content, "\n") {
+					if filter.MatchString(line) {
+						if line, err = highlightMatch(line, filter, &found, text, cs.Highlight); err != nil {
+							return err
+						}
+						fmt.Fprintln(out, tab, tab, line)
+					}
+				}
+			}
+
+			if found {
+				fmt.Fprintln(io.Out, out.String())
+			}
+		}
+	}
+
+	return nil
+}
+
+func highlightMatch(s string, filter *regexp.Regexp, found *bool, color, highlight func(string) string) (string, error) {
+	matches := filter.FindAllStringIndex(s, -1)
+	if matches == nil {
+		return color(s), nil
+	}
+
+	out := strings.Builder{}
+	if _, err := out.WriteString(color(s[:matches[0][0]])); err != nil {
+		return "", err
+	}
+
+	for _, match := range matches {
+		if _, err := out.WriteString(highlight(s[match[0]:match[1]])); err != nil {
+			return "", err
+		}
+		if _, err := out.WriteString(color(s[match[1]:])); err != nil {
+			return "", nil
+		}
+	}
+
+	if found != nil {
+		*found = *found || true
+	}
+	return out.String(), nil
+}
diff --git a/pkg/cmd/search/code/code.go b/pkg/cmd/search/code/code.go
index 0c318be74..63633cc53 100644
--- a/pkg/cmd/search/code/code.go
+++ b/pkg/cmd/search/code/code.go
@@ -143,7 +143,7 @@ func displayResults(io *iostreams.IOStreams, results search.CodeResult) error {
 			}
 			fmt.Fprintf(io.Out, "%s %s\n", cs.Blue(code.Repository.FullName), cs.GreenBold(code.Path))
 			for _, match := range code.TextMatches {
-				lines := formatMatch(match.Fragment, match.Matches, io.ColorEnabled())
+				lines := formatMatch(match.Fragment, match.Matches, io)
 				for _, line := range lines {
 					fmt.Fprintf(io.Out, "\t%s\n", strings.TrimSpace(line))
 				}
@@ -153,7 +153,7 @@ func displayResults(io *iostreams.IOStreams, results search.CodeResult) error {
 	}
 	for _, code := range results.Items {
 		for _, match := range code.TextMatches {
-			lines := formatMatch(match.Fragment, match.Matches, io.ColorEnabled())
+			lines := formatMatch(match.Fragment, match.Matches, io)
 			for _, line := range lines {
 				fmt.Fprintf(io.Out, "%s:%s: %s\n", cs.Blue(code.Repository.FullName), cs.GreenBold(code.Path), strings.TrimSpace(line))
 			}
@@ -162,7 +162,9 @@ func displayResults(io *iostreams.IOStreams, results search.CodeResult) error {
 	return nil
 }
 
-func formatMatch(t string, matches []search.Match, colorize bool) []string {
+func formatMatch(t string, matches []search.Match, io *iostreams.IOStreams) []string {
+	cs := io.ColorScheme()
+
 	startIndices := map[int]struct{}{}
 	endIndices := map[int]struct{}{}
 	for _, m := range matches {
@@ -186,14 +188,10 @@ func formatMatch(t string, matches []search.Match, colorize bool) []string {
 			continue
 		}
 		if _, ok := startIndices[i]; ok {
-			if colorize {
-				b.WriteString("\x1b[30;43m") // black text on yellow background
-			}
+			b.WriteString(cs.HighlightStart()) // black text on yellow background
 			found = true
 		} else if _, ok := endIndices[i]; ok {
-			if colorize {
-				b.WriteString("\x1b[m") // color reset
-			}
+			b.WriteString(cs.Reset()) // color reset
 		}
 		b.WriteRune(c)
 	}
diff --git a/pkg/iostreams/color.go b/pkg/iostreams/color.go
index 804b9a275..c8d48168f 100644
--- a/pkg/iostreams/color.go
+++ b/pkg/iostreams/color.go
@@ -8,6 +8,10 @@ import (
 	"github.com/mgutz/ansi"
 )
 
+const (
+	highlightStyle = "black:yellow"
+)
+
 var (
 	magenta            = ansi.ColorFunc("magenta")
 	cyan               = ansi.ColorFunc("cyan")
@@ -20,6 +24,8 @@ var (
 	bold               = ansi.ColorFunc("default+b")
 	cyanBold           = ansi.ColorFunc("cyan+b")
 	greenBold          = ansi.ColorFunc("green+b")
+	highlightStart     = ansi.ColorCode(highlightStyle)
+	highlight          = ansi.ColorFunc(highlightStyle)
 
 	gray256 = func(t string) string {
 		return fmt.Sprintf("\x1b[%d;5;%dm%s\x1b[m", 38, 242, t)
@@ -176,6 +182,30 @@ func (c *ColorScheme) FailureIconWithColor(colo func(string) string) string {
 	return colo("X")
 }
 
+func (c *ColorScheme) HighlightStart() string {
+	if !c.enabled {
+		return ""
+	}
+
+	return highlightStart
+}
+
+func (c *ColorScheme) Highlight(t string) string {
+	if !c.enabled {
+		return t
+	}
+
+	return highlight(t)
+}
+
+func (c *ColorScheme) Reset() string {
+	if !c.enabled {
+		return ""
+	}
+
+	return ansi.Reset
+}
+
 func (c *ColorScheme) ColorFromString(s string) func(string) string {
 	s = strings.ToLower(s)
 	var fn func(string) string

From 86f045ef0e0e0b4d21296747aad08b48b9676df9 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Fri, 11 Oct 2024 10:40:54 -0700
Subject: [PATCH 157/301] Split all newlines, and output no-color to non-TTY

---
 pkg/cmd/gist/list/list.go | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index c58ed06ea..e5d55d8c1 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -136,7 +136,7 @@ func listRun(opts *ListOptions) error {
 		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
 	}
 
-	if opts.IO.ColorEnabled() && opts.Filter != nil {
+	if opts.Filter != nil {
 		return printHighlights(opts.IO, gists, opts.Filter)
 	}
 
@@ -188,9 +188,13 @@ func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regex
 	out := &strings.Builder{}
 	var filename, description string
 	var err error
+	split := func(r rune) bool {
+		return r == '\n' || r == '\r'
+	}
 	text := func(s string) string {
 		return s
 	}
+
 	for _, gist := range gists {
 		for _, file := range gist.Files {
 			found := false
@@ -209,7 +213,7 @@ func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regex
 			}
 
 			if file.Content != "" {
-				for _, line := range strings.Split(file.Content, "\n") {
+				for _, line := range strings.FieldsFunc(file.Content, split) {
 					if filter.MatchString(line) {
 						if line, err = highlightMatch(line, filter, &found, text, cs.Highlight); err != nil {
 							return err
@@ -248,8 +252,6 @@ func highlightMatch(s string, filter *regexp.Regexp, found *bool, color, highlig
 		}
 	}
 
-	if found != nil {
-		*found = *found || true
-	}
+	*found = *found || true
 	return out.String(), nil
 }

From bddadef5740558caf40ebd0487c3de4a0b508f4b Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Sat, 12 Oct 2024 02:03:47 -0700
Subject: [PATCH 158/301] Highlight matches in table and content

When `--filter` is passed, matches will be highlighted in the existing table. If file names match, the "n file(s)" cell will be highlighted.

When `--include-content` is additionally passed, the file name, description, and/or content will be printed like `search code` with matches highlighted.
---
 pkg/cmd/gist/list/list.go      |  70 +++++++++----
 pkg/cmd/gist/list/list_test.go | 185 +++++++++++++++++++++++++++++++--
 2 files changed, 227 insertions(+), 28 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index e5d55d8c1..2975a55df 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -49,7 +49,8 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 			or even the content of files in the gist using %[1]s--filter%[1]s.
 
 			Use %[1]s--include-content%[1]s to include content of files, noting that
-			this will be slower and increase the rate limit used.
+			this will be slower and increase the rate limit used. Instead of printing a table,
+			code will be printed with highlights.
 
 			For supported regular expression syntax, see https://pkg.go.dev/regexp/syntax
 		`, "`"),
@@ -136,17 +137,39 @@ func listRun(opts *ListOptions) error {
 		fmt.Fprintf(opts.IO.ErrOut, "failed to start pager: %v\n", err)
 	}
 
-	if opts.Filter != nil {
-		return printHighlights(opts.IO, gists, opts.Filter)
+	if opts.Filter != nil && opts.IncludeContent {
+		return printContent(opts.IO, gists, opts.Filter)
 	}
 
-	return printTable(opts.IO, gists)
+	return printTable(opts.IO, gists, opts.Filter)
 }
 
-func printTable(io *iostreams.IOStreams, gists []shared.Gist) error {
+func printTable(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Regexp) error {
 	cs := io.ColorScheme()
 	tp := tableprinter.New(io, tableprinter.WithHeader("ID", "DESCRIPTION", "FILES", "VISIBILITY", "UPDATED"))
 
+	// Highlight filter matches in the description when printing the table.
+	highlightDescription := func(s string) string {
+		if filter != nil {
+			if str, err := highlightMatch(s, filter, nil, cs.Bold, cs.Highlight); err == nil {
+				return str
+			}
+		}
+		return cs.Bold(s)
+	}
+
+	// Highlight the files column when any file name matches the filter.
+	highlightFilesFunc := func(gist *shared.Gist) func(string) string {
+		if filter != nil {
+			for _, file := range gist.Files {
+				if filter.MatchString(file.Filename) {
+					return cs.Highlight
+				}
+			}
+		}
+		return normal
+	}
+
 	for _, gist := range gists {
 		fileCount := len(gist.Files)
 
@@ -170,9 +193,12 @@ func printTable(io *iostreams.IOStreams, gists []shared.Gist) error {
 		tp.AddField(gist.ID)
 		tp.AddField(
 			text.RemoveExcessiveWhitespace(description),
-			tableprinter.WithColor(cs.Bold),
+			tableprinter.WithColor(highlightDescription),
+		)
+		tp.AddField(
+			text.Pluralize(fileCount, "file"),
+			tableprinter.WithColor(highlightFilesFunc(&gist)),
 		)
-		tp.AddField(text.Pluralize(fileCount, "file"))
 		tp.AddField(visibility, tableprinter.WithColor(visColor))
 		tp.AddTimeField(time.Now(), gist.UpdatedAt, cs.Gray)
 		tp.EndRow()
@@ -181,7 +207,7 @@ func printTable(io *iostreams.IOStreams, gists []shared.Gist) error {
 	return tp.Render()
 }
 
-func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Regexp) error {
+func printContent(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Regexp) error {
 	const tab string = "    "
 	cs := io.ColorScheme()
 
@@ -191,39 +217,36 @@ func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regex
 	split := func(r rune) bool {
 		return r == '\n' || r == '\r'
 	}
-	text := func(s string) string {
-		return s
-	}
 
 	for _, gist := range gists {
 		for _, file := range gist.Files {
-			found := false
+			matched := false
 			out.Reset()
 
-			if filename, err = highlightMatch(file.Filename, filter, &found, cs.Green, cs.Highlight); err != nil {
+			if filename, err = highlightMatch(file.Filename, filter, &matched, cs.Green, cs.Highlight); err != nil {
 				return err
 			}
 			fmt.Fprintln(out, cs.Blue(gist.ID), filename)
 
 			if gist.Description != "" {
-				if description, err = highlightMatch(gist.Description, filter, &found, cs.Bold, cs.Highlight); err != nil {
+				if description, err = highlightMatch(gist.Description, filter, &matched, cs.Bold, cs.Highlight); err != nil {
 					return err
 				}
-				fmt.Fprintln(out, tab, description)
+				fmt.Fprintf(out, "%s%s\n", tab, description)
 			}
 
 			if file.Content != "" {
 				for _, line := range strings.FieldsFunc(file.Content, split) {
 					if filter.MatchString(line) {
-						if line, err = highlightMatch(line, filter, &found, text, cs.Highlight); err != nil {
+						if line, err = highlightMatch(line, filter, &matched, normal, cs.Highlight); err != nil {
 							return err
 						}
-						fmt.Fprintln(out, tab, tab, line)
+						fmt.Fprintf(out, "%[1]s%[1]s%[2]s\n", tab, line)
 					}
 				}
 			}
 
-			if found {
+			if matched {
 				fmt.Fprintln(io.Out, out.String())
 			}
 		}
@@ -232,7 +255,7 @@ func printHighlights(io *iostreams.IOStreams, gists []shared.Gist, filter *regex
 	return nil
 }
 
-func highlightMatch(s string, filter *regexp.Regexp, found *bool, color, highlight func(string) string) (string, error) {
+func highlightMatch(s string, filter *regexp.Regexp, matched *bool, color, highlight func(string) string) (string, error) {
 	matches := filter.FindAllStringIndex(s, -1)
 	if matches == nil {
 		return color(s), nil
@@ -252,6 +275,13 @@ func highlightMatch(s string, filter *regexp.Regexp, found *bool, color, highlig
 		}
 	}
 
-	*found = *found || true
+	if matched != nil {
+		*matched = *matched || true
+	}
+
 	return out.String(), nil
 }
+
+func normal(s string) string {
+	return s
+}
diff --git a/pkg/cmd/gist/list/list_test.go b/pkg/cmd/gist/list/list_test.go
index 0b88caf83..b20c0efeb 100644
--- a/pkg/cmd/gist/list/list_test.go
+++ b/pkg/cmd/gist/list/list_test.go
@@ -141,6 +141,7 @@ func Test_listRun(t *testing.T) {
 		wantErr bool
 		wantOut string
 		stubs   func(*httpmock.Registry)
+		color   bool
 		nontty  bool
 	}{
 		{
@@ -390,12 +391,62 @@ func Test_listRun(t *testing.T) {
 			nontty: true,
 		},
 		{
-			name: "with content filter",
+			name: "filtered",
 			opts: &ListOptions{
-				Filter:         regexp.MustCompile("octo"),
-				IncludeContent: true,
-				Visibility:     "all",
+				Filter:     regexp.MustCompile("octo"),
+				Visibility: "all",
 			},
+			nontty: true,
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234",
+								"files": [
+									{ "name": "main.txt", "text": "foo" }
+								],
+								"description": "octo match in the description",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "2345",
+								"files": [
+									{ "name": "main.txt", "text": "foo" },
+									{ "name": "octo.txt", "text": "bar" }
+								],
+								"description": "match in the file name",
+								"updatedAt": "%[1]v",
+								"isPublic": false
+							},
+							{
+								"name": "3456",
+								"files": [
+									{ "name": "main.txt", "text": "octo in the text" }
+								],
+								"description": "match in the file text",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						absTime.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Docf(`
+				1234%[1]socto match in the description%[1]s1 file%[1]spublic%[1]s2020-07-30T15:24:28Z
+				2345%[1]smatch in the file name%[1]s2 files%[1]ssecret%[1]s2020-07-30T15:24:28Z
+			`, "\t"),
+		},
+		{
+			name: "filtered (tty)",
+			opts: &ListOptions{
+				Filter:     regexp.MustCompile("octo"),
+				Visibility: "all",
+			},
+			color: true,
 			stubs: func(reg *httpmock.Registry) {
 				reg.Register(
 					httpmock.GraphQL(query),
@@ -434,13 +485,130 @@ func Test_listRun(t *testing.T) {
 					)),
 				)
 			},
+			wantOut: heredoc.Docf(`
+				%[1]s[0;2;4;37mID  %[1]s[0m  %[1]s[0;2;4;37mDESCRIPTION                  %[1]s[0m  %[1]s[0;2;4;37mFILES  %[1]s[0m  %[1]s[0;2;4;37mVISIBILITY%[1]s[0m  %[1]s[0;2;4;37mUPDATED          %[1]s[0m
+				1234  %[1]s[0;30;43mocto%[1]s[0m%[1]s[0;1;39m match in the description%[1]s[0m  1 file   %[1]s[0;32mpublic    %[1]s[0m  %[1]s[38;5;242mabout 6 hours ago%[1]s[m
+				2345  %[1]s[0;1;39mmatch in the file name       %[1]s[0m  %[1]s[0;30;43m2 files%[1]s[0m  %[1]s[0;31msecret    %[1]s[0m  %[1]s[38;5;242mabout 6 hours ago%[1]s[m
+			`, "\x1b"),
+		},
+		{
+			name: "filtered with content",
+			opts: &ListOptions{
+				Filter:         regexp.MustCompile("octo"),
+				IncludeContent: true,
+				Visibility:     "all",
+			},
+			nontty: true,
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234",
+								"files": [
+									{ "name": "main.txt", "text": "foo" }
+								],
+								"description": "octo match in the description",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "2345",
+								"files": [
+									{ "name": "main.txt", "text": "foo" },
+									{ "name": "octo.txt", "text": "bar" }
+								],
+								"description": "match in the file name",
+								"updatedAt": "%[1]v",
+								"isPublic": false
+							},
+							{
+								"name": "3456",
+								"files": [
+									{ "name": "main.txt", "text": "octo in the text" }
+								],
+								"description": "match in the file text",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						absTime.Format(time.RFC3339),
+					)),
+				)
+			},
 			wantOut: heredoc.Doc(`
-				ID    DESCRIPTION                    FILES    VISIBILITY  UPDATED
-				1234  octo match in the description  1 file   public      about 6 hours ago
-				2345  match in the file name         2 files  secret      about 6 hours ago
-				3456  match in the file text         1 file   public      about 6 hours ago
+				1234 main.txt
+				    octo match in the description
+				
+				2345 octo.txt
+				    match in the file name
+
+				3456 main.txt
+				    match in the file text
+				        octo in the text
+				
 			`),
 		},
+		{
+			name: "filtered with content (tty)",
+			opts: &ListOptions{
+				Filter:         regexp.MustCompile("octo"),
+				IncludeContent: true,
+				Visibility:     "all",
+			},
+			color: true,
+			stubs: func(reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(query),
+					httpmock.StringResponse(fmt.Sprintf(
+						`{ "data": { "viewer": { "gists": { "nodes": [
+							{
+								"name": "1234",
+								"files": [
+									{ "name": "main.txt", "text": "foo" }
+								],
+								"description": "octo match in the description",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							},
+							{
+								"name": "2345",
+								"files": [
+									{ "name": "main.txt", "text": "foo" },
+									{ "name": "octo.txt", "text": "bar" }
+								],
+								"description": "match in the file name",
+								"updatedAt": "%[1]v",
+								"isPublic": false
+							},
+							{
+								"name": "3456",
+								"files": [
+									{ "name": "main.txt", "text": "octo in the text" }
+								],
+								"description": "match in the file text",
+								"updatedAt": "%[1]v",
+								"isPublic": true
+							}
+						] } } } }`,
+						sixHoursAgo.Format(time.RFC3339),
+					)),
+				)
+			},
+			wantOut: heredoc.Docf(`
+				%[1]s[0;34m1234%[1]s[0m %[1]s[0;32mmain.txt%[1]s[0m
+				    %[1]s[0;30;43mocto%[1]s[0m%[1]s[0;1;39m match in the description%[1]s[0m
+				
+				%[1]s[0;34m2345%[1]s[0m %[1]s[0;30;43mocto%[1]s[0m%[1]s[0;32m.txt%[1]s[0m
+				    %[1]s[0;1;39mmatch in the file name%[1]s[0m
+				
+				%[1]s[0;34m3456%[1]s[0m %[1]s[0;32mmain.txt%[1]s[0m
+				    %[1]s[0;1;39mmatch in the file text%[1]s[0m
+				        %[1]s[0;30;43mocto%[1]s[0m in the text
+				
+			`, "\x1b"),
+		},
 	}
 
 	for _, tt := range tests {
@@ -456,6 +624,7 @@ func Test_listRun(t *testing.T) {
 		}
 
 		ios, _, stdout, _ := iostreams.Test()
+		ios.SetColorEnabled(tt.color)
 		ios.SetStdoutTTY(!tt.nontty)
 		tt.opts.IO = ios
 

From e9d8092ffc632186791b703944fa0e9e043378c0 Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Sat, 12 Oct 2024 11:04:31 -0700
Subject: [PATCH 159/301] Don't append remaining text if more matches

---
 pkg/cmd/gist/list/list.go      | 12 ++++++--
 pkg/cmd/gist/list/list_test.go | 56 ++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index 2975a55df..bb5b7089c 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -262,15 +262,23 @@ func highlightMatch(s string, filter *regexp.Regexp, matched *bool, color, highl
 	}
 
 	out := strings.Builder{}
+
+	// Color up to the first match. If an empty string, no ANSI color sequence is added.
 	if _, err := out.WriteString(color(s[:matches[0][0]])); err != nil {
 		return "", err
 	}
 
-	for _, match := range matches {
+	// Highlight each match, then color the remaining text which, if an empty string, no ANSI color sequence is added.
+	for i, match := range matches {
 		if _, err := out.WriteString(highlight(s[match[0]:match[1]])); err != nil {
 			return "", err
 		}
-		if _, err := out.WriteString(color(s[match[1]:])); err != nil {
+
+		text := s[match[1]:]
+		if i+1 < len(matches) {
+			text = s[match[1]:matches[i+1][0]]
+		}
+		if _, err := out.WriteString(color(text)); err != nil {
 			return "", nil
 		}
 	}
diff --git a/pkg/cmd/gist/list/list_test.go b/pkg/cmd/gist/list/list_test.go
index b20c0efeb..e6cb35d53 100644
--- a/pkg/cmd/gist/list/list_test.go
+++ b/pkg/cmd/gist/list/list_test.go
@@ -648,3 +648,59 @@ func Test_listRun(t *testing.T) {
 		})
 	}
 }
+
+func Test_highlightMatch(t *testing.T) {
+	regex := regexp.MustCompilePOSIX(`[Oo]cto`)
+	tests := []struct {
+		name  string
+		input string
+		color bool
+		want  string
+	}{
+		{
+			name:  "single match",
+			input: "Octo",
+			want:  "Octo",
+		},
+		{
+			name:  "single match (color)",
+			input: "Octo",
+			color: true,
+			want:  "\x1b[0;30;43mOcto\x1b[0m",
+		},
+		{
+			name:  "single match with extra",
+			input: "Hello, Octocat!",
+			want:  "Hello, Octocat!",
+		},
+		{
+			name:  "single match with extra (color)",
+			input: "Hello, Octocat!",
+			color: true,
+			want:  "\x1b[0;34mHello, \x1b[0m\x1b[0;30;43mOcto\x1b[0m\x1b[0;34mcat!\x1b[0m",
+		},
+		{
+			name:  "multiple matches",
+			input: "Octocat/octo",
+			want:  "Octocat/octo",
+		},
+		{
+			name:  "multiple matches (color)",
+			input: "Octocat/octo",
+			color: true,
+			want:  "\x1b[0;30;43mOcto\x1b[0m\x1b[0;34mcat/\x1b[0m\x1b[0;30;43mocto\x1b[0m",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cs := iostreams.NewColorScheme(tt.color, false, false)
+
+			matched := false
+			got, err := highlightMatch(tt.input, regex, &matched, cs.Blue, cs.Highlight)
+			assert.NoError(t, err)
+			assert.True(t, matched)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

From 503659f11cd6b8c1e1a8ff03e1b680d662664bbd Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 12:56:27 +0200
Subject: [PATCH 160/301] Add host recommendation to Acceptance test docs

---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 9828bfe74..07e51f688 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -16,7 +16,7 @@ The GitHub host to target e.g. `github.com`
 
 #### `GH_ACCEPTANCE_ORG`
 
-The organization in which the acceptance tests can manage resources in.
+The organization in which the acceptance tests can manage resources in. Consider using `gh-acceptance-testing` on `github.com`.
 
 #### `GH_ACCEPTANCE_TOKEN`
 

From fbc72fd2befda6818105a916bbdd67fc54e3e987 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 13:01:13 +0200
Subject: [PATCH 161/301] Suggest using legacy PAT for acceptance tests

---
 acceptance/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/acceptance/README.md b/acceptance/README.md
index 07e51f688..cc3af0f98 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -22,6 +22,8 @@ The organization in which the acceptance tests can manage resources in. Consider
 
 The token to use for authenticatin with the `GH_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
 
+It's recommended to create and use a Legacy PAT for this; Fine-Grained PATs do not offer all the necessary privileges required. You can use an OAuth token provided via `gh auth login --web` and can provide it to the acceptance tests via `GH_ACCEPTANCE_TOKEN=$(gh auth token --hostname <host>)` but this can be a bit confusing and annoying if you `gh auth login` again without `-s` and lose the required scopes.
+
 ---
 
 A full example invocation can be found below:

From 4d986aaed44fea6ca42772c6736e8091f60eea91 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 13:54:31 +0200
Subject: [PATCH 162/301] Acceptance test PR creation with metadata

---
 .../testdata/pr/pr-create-with-metadata.txtar | 26 +++++++++++++++++++
 .../testdata/pr/pr-merge-merge-strategy.txtar |  2 +-
 .../pr/pr-merge-rebase-strategy.txtar         |  2 +-
 3 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 acceptance/testdata/pr/pr-create-with-metadata.txtar

diff --git a/acceptance/testdata/pr/pr-create-with-metadata.txtar b/acceptance/testdata/pr/pr-create-with-metadata.txtar
new file mode 100644
index 000000000..765c84b67
--- /dev/null
+++ b/acceptance/testdata/pr/pr-create-with-metadata.txtar
@@ -0,0 +1,26 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty Commit'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body' --assignee '@me' --label 'bug'
+stdout2env PR_URL
+
+# Check the PR is indeed created
+exec gh pr view $PR_URL
+stdout 'assignees:\t.*$'
+stdout 'labels:\tbug$'
diff --git a/acceptance/testdata/pr/pr-merge-merge-strategy.txtar b/acceptance/testdata/pr/pr-merge-merge-strategy.txtar
index 7acf6da2b..1d8355506 100644
--- a/acceptance/testdata/pr/pr-merge-merge-strategy.txtar
+++ b/acceptance/testdata/pr/pr-merge-merge-strategy.txtar
@@ -31,7 +31,7 @@ exec gh pr merge $PR_URL --merge
 
 # Check that the state of the PR is now merged
 exec gh pr view $PR_URL
-stdout 'state:\tMERGED'
+stdout 'state:\tMERGED$'
 
 # Pull and check the file exists on the main branch
 exec git pull -r
diff --git a/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar b/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar
index 73acd238c..f26338c4a 100644
--- a/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar
+++ b/acceptance/testdata/pr/pr-merge-rebase-strategy.txtar
@@ -31,7 +31,7 @@ exec gh pr merge $PR_URL --rebase
 
 # Check that the state of the PR is now merged
 exec gh pr view $PR_URL
-stdout 'state:\tMERGED'
+stdout 'state:\tMERGED$'
 
 # Pull and check the file exists on the main branch
 exec git pull -r

From bfa5b6afa5bb1f39990dda9ddbb03e639cdfd8ab Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 13:59:55 +0200
Subject: [PATCH 163/301] Support skipping Acceptance test cleanup

---
 acceptance/README.md          |  4 +--
 acceptance/acceptance_test.go | 49 +++++++++++++++++++++++------------
 2 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index cc3af0f98..1311704d4 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -113,9 +113,7 @@ This is generally enough information to understand why a test has failed. Howeve
 > [!WARNING]
 > Verbose mode dumps the `testscript` environment variables, including the `GH_TOKEN`, so be careful.
 
-Finally, the `testscript.Params` struct has a `TestWork` field; when `TestWork` is set to true, the `WORK` directory will not be cleaned up, allowing for manual investigation of state in the shell. However, `defer` statements will still be run.
-
-TODO: Probably we want to add a `NO_CLEANUP` flag so `defer` is not run. Maybe this implies we want `defer` to be called `cleanup`? It might not be so clear in its intent though. Maybe `NO_CLEANUP_WORK` and `NO_DEFER`?
+By default `testscript` removes the directory in which it was running the script, and if you've been a conscientious engineer, you should be cleaning up resources using the `defer` statement. However, this can be an impediment to debugging. As such you can set `GH_ACCEPTANCE_PRESERVE_WORK_DIR=true` and `GH_ACCEPTANCE_SKIP_DEFER=true` to skip these cleanup steps.
 
 ### Effective Test Authoring
 
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 6a5e32ff7..8d4d4b302 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -40,9 +40,10 @@ func testScriptParamsFor(tsEnv testScriptEnv, dir string) testscript.Params {
 		Dir:                 path.Join("testdata", dir),
 		Files:               []string{},
 		Setup:               sharedSetup(tsEnv),
-		Cmds:                sharedCmds,
+		Cmds:                sharedCmds(tsEnv),
 		RequireExplicitExec: true,
 		RequireUniqueNames:  true,
+		TestWork:            tsEnv.preserveWorkDir,
 	}
 }
 
@@ -65,22 +66,32 @@ func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
 	}
 }
 
-var sharedCmds = map[string]func(ts *testscript.TestScript, neg bool, args []string){
-	"defer": func(ts *testscript.TestScript, neg bool, args []string) {
-		ts.Defer(func() {
-			ts.Check(ts.Exec(args[0], args[1:]...))
-		})
-	},
-	"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
-		if neg {
-			ts.Fatalf("unsupported: ! stdout2env")
-		}
-		if len(args) != 1 {
-			ts.Fatalf("usage: stdout2env name")
-		}
+func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript, neg bool, args []string) {
+	return map[string]func(ts *testscript.TestScript, neg bool, args []string){
+		"defer": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! defer")
+			}
 
-		ts.Setenv(args[0], strings.TrimRight(ts.ReadFile("stdout"), "\n"))
-	},
+			if tsEnv.skipDefer {
+				return
+			}
+
+			ts.Defer(func() {
+				ts.Check(ts.Exec(args[0], args[1:]...))
+			})
+		},
+		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! stdout2env")
+			}
+			if len(args) != 1 {
+				ts.Fatalf("usage: stdout2env name")
+			}
+
+			ts.Setenv(args[0], strings.TrimRight(ts.ReadFile("stdout"), "\n"))
+		},
+	}
 }
 
 var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
@@ -115,6 +126,9 @@ type testScriptEnv struct {
 	host  string
 	org   string
 	token string
+
+	skipDefer       bool
+	preserveWorkDir bool
 }
 
 func (e *testScriptEnv) fromEnv() error {
@@ -149,5 +163,8 @@ func (e *testScriptEnv) fromEnv() error {
 	e.org = envMap["GH_ACCEPTANCE_ORG"]
 	e.token = envMap["GH_ACCEPTANCE_TOKEN"]
 
+	e.preserveWorkDir = os.Getenv("GH_ACCEPTANCE_PRESERVE_WORK_DIR") == "true"
+	e.skipDefer = os.Getenv("GH_ACCEPTANCE_SKIP_DEFER") == "true"
+
 	return nil
 }

From 1f94cf9dac2284cc4642275abf2f725da9ce28ea Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:31:24 +0200
Subject: [PATCH 164/301] Acceptance test PR list

---
 acceptance/testdata/pr/pr-create-basic.txtar |  2 +-
 acceptance/testdata/pr/pr-list.txtar         | 24 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 acceptance/testdata/pr/pr-list.txtar

diff --git a/acceptance/testdata/pr/pr-create-basic.txtar b/acceptance/testdata/pr/pr-create-basic.txtar
index 46d1de990..98bb2faa9 100644
--- a/acceptance/testdata/pr/pr-create-basic.txtar
+++ b/acceptance/testdata/pr/pr-create-basic.txtar
@@ -20,5 +20,5 @@ exec git push -u origin feature-branch
 exec gh pr create --title 'Feature Title' --body 'Feature Body'
 
 # Check the PR is indeed created
-exec gh pr list
+exec gh pr view
 stdout 'Feature Title'
diff --git a/acceptance/testdata/pr/pr-list.txtar b/acceptance/testdata/pr/pr-list.txtar
new file mode 100644
index 000000000..6fcd8e6b7
--- /dev/null
+++ b/acceptance/testdata/pr/pr-list.txtar
@@ -0,0 +1,24 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Prepare a branch to PR
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec git checkout -b feature-branch
+exec git commit --allow-empty -m 'Empty Commit'
+exec git push -u origin feature-branch
+
+# Create the PR
+exec gh pr create --title 'Feature Title' --body 'Feature Body'
+
+# List PRs and see the new PR is in the list
+exec gh pr list
+stdout 'Feature Title\tfeature-branch\tOPEN'

From c2c88b293e44e70ef7d98c434df2bda749613666 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:32:05 +0200
Subject: [PATCH 165/301] Fix GH_HOST / GH_ACCEPTANCE_HOST misuse

---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 1311704d4..c15d439fd 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -20,7 +20,7 @@ The organization in which the acceptance tests can manage resources in. Consider
 
 #### `GH_ACCEPTANCE_TOKEN`
 
-The token to use for authenticatin with the `GH_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
+The token to use for authenticatin with the `GH_ACCEPTANCE_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
 
 It's recommended to create and use a Legacy PAT for this; Fine-Grained PATs do not offer all the necessary privileges required. You can use an OAuth token provided via `gh auth login --web` and can provide it to the acceptance tests via `GH_ACCEPTANCE_TOKEN=$(gh auth token --hostname <host>)` but this can be a bit confusing and annoying if you `gh auth login` again without `-s` and lose the required scopes.
 

From f3589b2573eefa66060427f0567c7b3bcb05d3aa Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:33:17 +0200
Subject: [PATCH 166/301] Add VSCode extension links to Acceptance README

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index c15d439fd..3f2fa2f8d 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -67,7 +67,7 @@ Due to the `//go:build acceptance` build constraint, some functionality is limit
   },
 ```
 
-You can install the `txtar` or `vscode-testscript` extensions to get syntax highlighting.
+You can install the [`txtar`](https://marketplace.visualstudio.com/items?itemName=brody715.txtar) or [`vscode-testscript`](https://marketplace.visualstudio.com/items?itemName=twpayne.vscode-testscript) extensions to get syntax highlighting.
 
 ### Debugging Tests
 

From b095d6bd582dc239ea5aa150dd4bcc859ce3ebca Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:33:49 +0200
Subject: [PATCH 167/301] Add link to testscript pkg documentation

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 3f2fa2f8d..4160f5e6d 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -1,6 +1,6 @@
 ## Acceptance Tests
 
-The acceptance tests are blackbox* tests that are expected to interact with resources on a real GitHub instance.
+The acceptance tests are blackbox* tests that are expected to interact with resources on a real GitHub instance.  They are built on top of [`go-internal/testscript` module](https://pkg.go.dev/github.com/rogpeppe/go-internal/testscript), which supports a variety of commands for defining filesystem-based tests.
 
 *Note: they aren't strictly blackbox because `exec gh` commands delegate to a binary set up by `testscript` that calls into `ghcmd.Main`. However, since our real `func main` is an extremely thin adapter over `ghcmd.Main`, this is reasonable. This tradeoff avoids us building the binary ourselves for the tests, and allows us to get code coverage metrics.
 

From f7b279db1134c94e0f8442fc99af465ee0c48af1 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:35:35 +0200
Subject: [PATCH 168/301] Correct testscript description in Acceptance readme

---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 4160f5e6d..1a7f6a93d 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -1,6 +1,6 @@
 ## Acceptance Tests
 
-The acceptance tests are blackbox* tests that are expected to interact with resources on a real GitHub instance.  They are built on top of [`go-internal/testscript` module](https://pkg.go.dev/github.com/rogpeppe/go-internal/testscript), which supports a variety of commands for defining filesystem-based tests.
+The acceptance tests are blackbox* tests that are expected to interact with resources on a real GitHub instance.  They are built on top of the [`go-internal/testscript`](https://pkg.go.dev/github.com/rogpeppe/go-internal/testscript) package, which provides a framework for building tests for command line tools.
 
 *Note: they aren't strictly blackbox because `exec gh` commands delegate to a binary set up by `testscript` that calls into `ghcmd.Main`. However, since our real `func main` is an extremely thin adapter over `ghcmd.Main`, this is reasonable. This tradeoff avoids us building the binary ourselves for the tests, and allows us to get code coverage metrics.
 

From 5e023267929d1c5ed771adc3b208ec736a7f5153 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:36:34 +0200
Subject: [PATCH 169/301] Document sharedCmds func in acceptance tests

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 acceptance/acceptance_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 8d4d4b302..bcc27faca 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -66,6 +66,7 @@ func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
 	}
 }
 
+// sharedCmds defines a collection of custom testscript commands for our use.
 func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript, neg bool, args []string) {
 	return map[string]func(ts *testscript.TestScript, neg bool, args []string){
 		"defer": func(ts *testscript.TestScript, neg bool, args []string) {

From 2a0be61d5e811ed0561a5a482b83fa93b0f2768b Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 14:50:59 +0200
Subject: [PATCH 170/301] Ensure pr create with metadata has assignment

---
 acceptance/testdata/pr/pr-create-with-metadata.txtar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/testdata/pr/pr-create-with-metadata.txtar b/acceptance/testdata/pr/pr-create-with-metadata.txtar
index 765c84b67..3e06b533b 100644
--- a/acceptance/testdata/pr/pr-create-with-metadata.txtar
+++ b/acceptance/testdata/pr/pr-create-with-metadata.txtar
@@ -22,5 +22,5 @@ stdout2env PR_URL
 
 # Check the PR is indeed created
 exec gh pr view $PR_URL
-stdout 'assignees:\t.*$'
+stdout 'assignees:\t.+$'
 stdout 'labels:\tbug$'

From d709dd5b597421216f7ea9bbd6906d9b6072c870 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 14 Oct 2024 14:22:07 +0000
Subject: [PATCH 171/301] build(deps): bump github.com/gabriel-vasile/mimetype
 from 1.4.5 to 1.4.6

Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.5 to 1.4.6.
- [Release notes](https://github.com/gabriel-vasile/mimetype/releases)
- [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.5...v1.4.6)

---
updated-dependencies:
- dependency-name: github.com/gabriel-vasile/mimetype
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 10 +++++-----
 go.sum | 20 ++++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/go.mod b/go.mod
index e638459fa..d9675cba2 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.5
 	github.com/creack/pty v1.1.23
 	github.com/distribution/reference v0.5.0
-	github.com/gabriel-vasile/mimetype v1.4.5
+	github.com/gabriel-vasile/mimetype v1.4.6
 	github.com/gdamore/tcell/v2 v2.5.4
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.20.2
@@ -43,10 +43,10 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/zalando/go-keyring v0.2.5
-	golang.org/x/crypto v0.27.0
+	golang.org/x/crypto v0.28.0
 	golang.org/x/sync v0.8.0
-	golang.org/x/term v0.24.0
-	golang.org/x/text v0.18.0
+	golang.org/x/term v0.25.0
+	golang.org/x/text v0.19.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -158,7 +158,7 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/net v0.27.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/sys v0.26.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
diff --git a/go.sum b/go.sum
index d1a85b60e..9d0e0e264 100644
--- a/go.sum
+++ b/go.sum
@@ -147,8 +147,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.5 h1:J7wGKdGu33ocBOhGy0z653k/lFKLFDPJMG8Gql0kxn4=
-github.com/gabriel-vasile/mimetype v1.4.5/go.mod h1:ibHel+/kbxn9x2407k1izTA1S81ku1z/DlgOW2QE0M4=
+github.com/gabriel-vasile/mimetype v1.4.6 h1:3+PzJTKLkvgjeTbts6msPJt4DixhT4YtFNf1gtGe3zc=
+github.com/gabriel-vasile/mimetype v1.4.6/go.mod h1:JX1qVKqZd40hUPpAfiNTe0Sne7hdfKSbOqqmkq8GCXc=
 github.com/gdamore/encoding v1.0.0 h1:+7OoQ1Bc6eTm5niUzBa0Ctsh6JbMW6Ra+YNuAtDBdko=
 github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg=
 github.com/gdamore/tcell/v2 v2.5.4 h1:TGU4tSjD3sCL788vFNeJnTdzpNKIw1H5dgLnJRQVv/k=
@@ -486,8 +486,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -496,8 +496,8 @@ golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
-golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
 golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -519,15 +519,15 @@ golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
-golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
+golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
+golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

From ae37c25d25a6499652026ab0e74089ef46814a0c Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 13:06:16 +0200
Subject: [PATCH 172/301] Add acceptance task to makefile

---
 Makefile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e68b68939..04babcc53 100644
--- a/Makefile
+++ b/Makefile
@@ -38,11 +38,15 @@ completions: bin/gh$(EXE)
 	bin/gh$(EXE) completion -s fish > ./share/fish/vendor_completions.d/gh.fish
 	bin/gh$(EXE) completion -s zsh > ./share/zsh/site-functions/_gh
 
-# just a convenience task around `go test`
+# just convenience tasks around `go test`
 .PHONY: test
 test:
 	go test ./...
 
+.PHONY: acceptance
+acceptance:
+	go test -tags acceptance ./acceptance
+
 ## Site-related tasks are exclusively intended for use by the GitHub CLI team and for our release automation.
 
 site:

From 3b1f06a88f8e185c939590df90bb9bf9deff5299 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 20:27:34 +0200
Subject: [PATCH 173/301] Ensure Acceptance defer failures are debuggable

---
 acceptance/acceptance_test.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index bcc27faca..e7b2c1313 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -47,6 +47,8 @@ func testScriptParamsFor(tsEnv testScriptEnv, dir string) testscript.Params {
 	}
 }
 
+var keyT struct{}
+
 func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
 	return func(ts *testscript.Env) error {
 		scriptName, ok := extractScriptName(ts.Vars)
@@ -62,6 +64,8 @@ func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
 		ts.Setenv("GH_TOKEN", tsEnv.token)
 
 		ts.Setenv("RANDOM_STRING", randomString(10))
+
+		ts.Values[keyT] = ts.T()
 		return nil
 	}
 }
@@ -78,8 +82,21 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				return
 			}
 
+			tt, ok := ts.Value(keyT).(testscript.T)
+			if !ok {
+				ts.Fatalf("%v is not a testscript.T", ts.Value(keyT))
+			}
+
 			ts.Defer(func() {
-				ts.Check(ts.Exec(args[0], args[1:]...))
+				// If you're wondering why we're not using ts.Check here, it's because it raises a panic, and testscript
+				// only catches the panics directly from commands, not from the deferred functions. So what we do
+				// instead is grab the `t` in the setup function and store it as a value. It's important that we use
+				// `t` from the setup function because it represents the subtest created for each individual script,
+				// rather than each top-level test.
+				// See: https://github.com/rogpeppe/go-internal/issues/276
+				if err := ts.Exec(args[0], args[1:]...); err != nil {
+					tt.FailNow()
+				}
 			})
 		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {

From 5ad4a385bb7d676a220b2858143d07ffbc25eaf9 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 20:36:42 +0200
Subject: [PATCH 174/301] Support GH_ACCEPTANCE_SCRIPT

---
 acceptance/README.md          |  6 ++++++
 acceptance/acceptance_test.go | 19 ++++++++++++++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 1a7f6a93d..a1cd3f216 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -32,6 +32,12 @@ A full example invocation can be found below:
 GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> go test -tags=acceptance ./acceptance
 ```
 
+While writing a new test, it can be useful to target that specific script by providing the `GH_ACCEPTANCE_SCRIPT` env var in combination with the `-run` flag, for example:
+
+```
+GH_ACCEPTANCE_SCRIPT=pr-view.txtar GH_ACCEPTANCE_HOST=<host> GH_ACCEPTANCE_ORG=<org> GH_ACCEPTANCE_TOKEN=<token> go test -tags=acceptance -run ^TestPullRequests$ ./acceptance
+```
+
 #### Code Coverage
 
 To get code coverage, `go test` can be invoked with `coverpkg` and `coverprofile` like so:
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index bcc27faca..3f3fb48ec 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -35,10 +35,20 @@ func TestPullRequests(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
 }
 
-func testScriptParamsFor(tsEnv testScriptEnv, dir string) testscript.Params {
+func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
+	var files []string
+	if tsEnv.script != "" {
+		files = []string{path.Join("testdata", command, tsEnv.script)}
+	}
+
+	var dir string
+	if len(files) == 0 {
+		dir = path.Join("testdata", command)
+	}
+
 	return testscript.Params{
-		Dir:                 path.Join("testdata", dir),
-		Files:               []string{},
+		Dir:                 dir,
+		Files:               files,
 		Setup:               sharedSetup(tsEnv),
 		Cmds:                sharedCmds(tsEnv),
 		RequireExplicitExec: true,
@@ -128,6 +138,8 @@ type testScriptEnv struct {
 	org   string
 	token string
 
+	script string
+
 	skipDefer       bool
 	preserveWorkDir bool
 }
@@ -164,6 +176,7 @@ func (e *testScriptEnv) fromEnv() error {
 	e.org = envMap["GH_ACCEPTANCE_ORG"]
 	e.token = envMap["GH_ACCEPTANCE_TOKEN"]
 
+	e.script = os.Getenv("GH_ACCEPTANCE_SCRIPT")
 	e.preserveWorkDir = os.Getenv("GH_ACCEPTANCE_PRESERVE_WORK_DIR") == "true"
 	e.skipDefer = os.Getenv("GH_ACCEPTANCE_SKIP_DEFER") == "true"
 

From 6970eb36f134beb88fc0170675b5ff5984005a8e Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Mon, 14 Oct 2024 20:48:38 +0200
Subject: [PATCH 175/301] Acceptance test issue command

---
 acceptance/acceptance_test.go                 | 14 ++++++++++---
 acceptance/testdata/issue/issue-comment.txtar | 20 +++++++++++++++++++
 .../testdata/issue/issue-create-basic.txtar   | 17 ++++++++++++++++
 .../issue/issue-create-with-metadata.txtar    | 19 ++++++++++++++++++
 acceptance/testdata/issue/issue-list.txtar    | 16 +++++++++++++++
 acceptance/testdata/issue/issue-view.txtar    | 17 ++++++++++++++++
 6 files changed, 100 insertions(+), 3 deletions(-)
 create mode 100644 acceptance/testdata/issue/issue-comment.txtar
 create mode 100644 acceptance/testdata/issue/issue-create-basic.txtar
 create mode 100644 acceptance/testdata/issue/issue-create-with-metadata.txtar
 create mode 100644 acceptance/testdata/issue/issue-list.txtar
 create mode 100644 acceptance/testdata/issue/issue-view.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index bcc27faca..429e0850c 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -28,8 +28,16 @@ func TestMain(m *testing.M) {
 func TestPullRequests(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
+}
+
+func TestIssues(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
 	}
 
 	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
@@ -120,7 +128,7 @@ type missingEnvError struct {
 }
 
 func (e missingEnvError) Error() string {
-	return fmt.Sprintf("environment variables %s must be set and non-empty", strings.Join(e.missingEnvs, ", "))
+	return fmt.Sprintf("environment variable(s) %s must be set and non-empty", strings.Join(e.missingEnvs, ", "))
 }
 
 type testScriptEnv struct {
diff --git a/acceptance/testdata/issue/issue-comment.txtar b/acceptance/testdata/issue/issue-comment.txtar
new file mode 100644
index 000000000..f47bf619c
--- /dev/null
+++ b/acceptance/testdata/issue/issue-comment.txtar
@@ -0,0 +1,20 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body'
+stdout2env ISSUE_URL
+
+# Comment on the issue
+exec gh issue comment $ISSUE_URL --body 'Looks like a great feature!'
+
+# View the issue
+exec gh issue view $ISSUE_URL --comments
+stdout 'Looks like a great feature!'
diff --git a/acceptance/testdata/issue/issue-create-basic.txtar b/acceptance/testdata/issue/issue-create-basic.txtar
new file mode 100644
index 000000000..ddba28eec
--- /dev/null
+++ b/acceptance/testdata/issue/issue-create-basic.txtar
@@ -0,0 +1,17 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body'
+stdout2env ISSUE_URL
+
+# Check the issue was created
+exec gh issue view $ISSUE_URL
+stdout 'title:\tFeature Request$'
diff --git a/acceptance/testdata/issue/issue-create-with-metadata.txtar b/acceptance/testdata/issue/issue-create-with-metadata.txtar
new file mode 100644
index 000000000..e1ce5a0da
--- /dev/null
+++ b/acceptance/testdata/issue/issue-create-with-metadata.txtar
@@ -0,0 +1,19 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body' --assignee '@me' --label 'bug'
+stdout2env ISSUE_URL
+
+# Check the issue was create
+exec gh issue view $ISSUE_URL
+stdout 'title:\tFeature Request$'
+stdout 'assignees:\t.*$'
+stdout 'labels:\tbug$'
diff --git a/acceptance/testdata/issue/issue-list.txtar b/acceptance/testdata/issue/issue-list.txtar
new file mode 100644
index 000000000..5a810f5e1
--- /dev/null
+++ b/acceptance/testdata/issue/issue-list.txtar
@@ -0,0 +1,16 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body'
+
+# Check the issue is included in the list output
+exec gh issue list
+stdout 'OPEN\tFeature Request'
diff --git a/acceptance/testdata/issue/issue-view.txtar b/acceptance/testdata/issue/issue-view.txtar
new file mode 100644
index 000000000..ddba28eec
--- /dev/null
+++ b/acceptance/testdata/issue/issue-view.txtar
@@ -0,0 +1,17 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body'
+stdout2env ISSUE_URL
+
+# Check the issue was created
+exec gh issue view $ISSUE_URL
+stdout 'title:\tFeature Request$'

From 9e00f1e4f227c5a68998cfdcd1ea19e56e0918bc Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Mon, 14 Oct 2024 15:08:23 -0700
Subject: [PATCH 176/301] Resolve PR feedback

---
 pkg/cmd/gist/list/list.go   | 2 +-
 pkg/cmd/search/code/code.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index bb5b7089c..b1e76e52e 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -52,7 +52,7 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 			this will be slower and increase the rate limit used. Instead of printing a table,
 			code will be printed with highlights.
 
-			For supported regular expression syntax, see https://pkg.go.dev/regexp/syntax
+			For supported regular expression syntax, see <https://pkg.go.dev/regexp/syntax>
 		`, "`"),
 		Example: heredoc.Doc(`
 			# list all secret gists from your user account
diff --git a/pkg/cmd/search/code/code.go b/pkg/cmd/search/code/code.go
index 63633cc53..761d2602c 100644
--- a/pkg/cmd/search/code/code.go
+++ b/pkg/cmd/search/code/code.go
@@ -188,10 +188,10 @@ func formatMatch(t string, matches []search.Match, io *iostreams.IOStreams) []st
 			continue
 		}
 		if _, ok := startIndices[i]; ok {
-			b.WriteString(cs.HighlightStart()) // black text on yellow background
+			b.WriteString(cs.HighlightStart())
 			found = true
 		} else if _, ok := endIndices[i]; ok {
-			b.WriteString(cs.Reset()) // color reset
+			b.WriteString(cs.Reset())
 		}
 		b.WriteRune(c)
 	}

From 7066bdb66f8b85c92dc0b0a75c5c587ee0b2101f Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 15 Oct 2024 17:33:18 +0100
Subject: [PATCH 177/301] Add comment to acceptance make target

Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>
---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index 04babcc53..32a06df2f 100644
--- a/Makefile
+++ b/Makefile
@@ -43,6 +43,7 @@ completions: bin/gh$(EXE)
 test:
 	go test ./...
 
+# For more information, see https://github.com/cli/cli/blob/trunk/acceptance/README.md
 .PHONY: acceptance
 acceptance:
 	go test -tags acceptance ./acceptance

From c3ffdc90c8819e1e7c70fb66ab4a5bb20d5fe871 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:01:09 -0600
Subject: [PATCH 178/301] implement base workflow list acceptance test

---
 acceptance/acceptance_test.go                 | 29 +++++++++++
 .../testdata/workflow/workflow-list.txtar     | 52 +++++++++++++++++++
 2 files changed, 81 insertions(+)
 create mode 100644 acceptance/testdata/workflow/workflow-list.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index cbd59b761..e390f2247 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"math/rand"
 
@@ -35,6 +37,16 @@ func TestPullRequests(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
 }
 
+func TestWorkflows(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
@@ -119,6 +131,23 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 
 			ts.Setenv(args[0], strings.TrimRight(ts.ReadFile("stdout"), "\n"))
 		},
+		"sleep": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! sleep")
+			}
+			if len(args) != 1 {
+				ts.Fatalf("usage: sleep seconds")
+			}
+
+			// sleep for the given number of seconds
+			seconds, err := strconv.Atoi(args[0])
+			if err != nil {
+				ts.Fatalf("invalid number of seconds: %v", err)
+			}
+
+			d := time.Duration(seconds) * time.Second
+			time.Sleep(d)
+		},
 	}
 }
 
diff --git a/acceptance/testdata/workflow/workflow-list.txtar b/acceptance/testdata/workflow/workflow-list.txtar
new file mode 100644
index 000000000..8cd211de0
--- /dev/null
+++ b/acceptance/testdata/workflow/workflow-list.txtar
@@ -0,0 +1,52 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sleep 10

From 5f919bc5b0f931d19c26ff9d8b648a23468c0358 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:01:21 -0600
Subject: [PATCH 179/301] implement workflow enable/disable acceptance test

---
 .../workflow/workflow-enable-disable.txtar    | 71 +++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 acceptance/testdata/workflow/workflow-enable-disable.txtar

diff --git a/acceptance/testdata/workflow/workflow-enable-disable.txtar b/acceptance/testdata/workflow/workflow-enable-disable.txtar
new file mode 100644
index 000000000..c248c1cad
--- /dev/null
+++ b/acceptance/testdata/workflow/workflow-enable-disable.txtar
@@ -0,0 +1,71 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# disable the workflow
+exec gh workflow disable 'Test Workflow Name'
+
+# Check the workflow is indeed disabled
+# Disabled workflows are hidden by default.
+exec gh workflow list
+stdout ''
+
+# Check that the listing shows it is disabled
+exec gh workflow list --all
+stdout 'Test\s+Workflow\s+Name\s+disabled_manually\s+\d+'
+
+# enable the workflow
+exec gh workflow enable 'Test Workflow Name'
+
+# Check the workflow is indeed enabled
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sleep 10

From 0b1d6923e1f8d660482c838bbfed7e1233309926 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:37:06 -0600
Subject: [PATCH 180/301] Create workflow-view.txtar

---
 .../testdata/workflow/workflow-view.txtar     | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 acceptance/testdata/workflow/workflow-view.txtar

diff --git a/acceptance/testdata/workflow/workflow-view.txtar b/acceptance/testdata/workflow/workflow-view.txtar
new file mode 100644
index 000000000..0783e7fac
--- /dev/null
+++ b/acceptance/testdata/workflow/workflow-view.txtar
@@ -0,0 +1,52 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow view 'Test Workflow Name'
+stdout 'Test Workflow Name - workflow.yml'
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sleep 10

From 3737f10246ac9be516f9059a4eb308bbaa91447a Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:37:11 -0600
Subject: [PATCH 181/301] Create workflow-run.txtar

---
 .../testdata/workflow/workflow-run.txtar      | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 acceptance/testdata/workflow/workflow-run.txtar

diff --git a/acceptance/testdata/workflow/workflow-run.txtar b/acceptance/testdata/workflow/workflow-run.txtar
new file mode 100644
index 000000000..7e9a823ee
--- /dev/null
+++ b/acceptance/testdata/workflow/workflow-run.txtar
@@ -0,0 +1,62 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Check the workflow run exists
+exec gh run list
+stdout 'Test Workflow Name' 
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: echo Hello, world!

From 446ffede1281359c0e4edc143a80321332c28dda Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 11:37:14 -0600
Subject: [PATCH 182/301] Create run-cancel.txtar

---
 acceptance/testdata/workflow/run-cancel.txtar | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 acceptance/testdata/workflow/run-cancel.txtar

diff --git a/acceptance/testdata/workflow/run-cancel.txtar b/acceptance/testdata/workflow/run-cancel.txtar
new file mode 100644
index 000000000..f06912c90
--- /dev/null
+++ b/acceptance/testdata/workflow/run-cancel.txtar
@@ -0,0 +1,73 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to cancel
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# cancel the workflow run
+exec gh run cancel $RUN_ID
+stdout '✓ Request to cancel workflow [0-9]+ submitted.'
+
+# It takes some time for a workflow run to be cancelled
+sleep 5
+
+# Check the workflow run is cancelled
+exec gh run list --json conclusion --jq '.[0].conclusion'
+stdout 'cancelled'
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sleep 30

From e37cf8b6944141059aa02ef7565b5850b8d7fbb0 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 15 Oct 2024 19:11:49 +0100
Subject: [PATCH 183/301] Fix issue creation with metadata regex

Co-authored-by: Andy Feller <andyfeller@github.com>
---
 acceptance/testdata/issue/issue-create-with-metadata.txtar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/testdata/issue/issue-create-with-metadata.txtar b/acceptance/testdata/issue/issue-create-with-metadata.txtar
index e1ce5a0da..8187f96cf 100644
--- a/acceptance/testdata/issue/issue-create-with-metadata.txtar
+++ b/acceptance/testdata/issue/issue-create-with-metadata.txtar
@@ -15,5 +15,5 @@ stdout2env ISSUE_URL
 # Check the issue was create
 exec gh issue view $ISSUE_URL
 stdout 'title:\tFeature Request$'
-stdout 'assignees:\t.*$'
+stdout 'assignees:\t.+$'
 stdout 'labels:\tbug$'

From 3a8417f6c781ae8d070c6b1b14344c7aea6968ec Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 14 Oct 2024 11:24:56 -0700
Subject: [PATCH 184/301] Add test coverage to places where IsEnterprise
 incorrectly covers Tenancy

IsEnterprise currently returns `true` when `IsTenancy` returns true. We
prefer that this behavior is orthogonal. This commit adds failing tests to
the instances where IsEnterprise should not behave the same as IsTenancy.

These test cases are expected to pass with the inclusion of the coming
improvements to go-gh to handle the orthogonality of IsEnterprise and
IsTenancy.
---
 internal/authflow/flow.go                     | 19 +++---
 internal/authflow/flow_test.go                | 36 +++++++++++
 .../feature_detection_test.go                 | 18 ++++++
 pkg/cmd/gist/clone/clone_test.go              | 18 ++++++
 pkg/cmd/pr/status/http.go                     | 22 ++++---
 pkg/cmd/pr/status/http_test.go                | 62 +++++++++++++++++++
 6 files changed, 160 insertions(+), 15 deletions(-)
 create mode 100644 internal/authflow/flow_test.go
 create mode 100644 pkg/cmd/pr/status/http_test.go

diff --git a/internal/authflow/flow.go b/internal/authflow/flow.go
index 52b00284b..e52f8dc0a 100644
--- a/internal/authflow/flow.go
+++ b/internal/authflow/flow.go
@@ -41,13 +41,6 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 	minimumScopes := []string{"repo", "read:org", "gist"}
 	scopes := append(minimumScopes, additionalScopes...)
 
-	callbackURI := "http://127.0.0.1/callback"
-	if ghinstance.IsEnterprise(oauthHost) {
-		// the OAuth app on Enterprise hosts is still registered with a legacy callback URL
-		// see https://github.com/cli/cli/pull/222, https://github.com/cli/cli/pull/650
-		callbackURI = "http://localhost/"
-	}
-
 	host, err := oauth.NewGitHubHost(ghinstance.HostPrefix(oauthHost))
 	if err != nil {
 		return "", "", err
@@ -57,7 +50,7 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 		Host:         host,
 		ClientID:     oauthClientID,
 		ClientSecret: oauthClientSecret,
-		CallbackURI:  callbackURI,
+		CallbackURI:  getCallbackURI(oauthHost),
 		Scopes:       scopes,
 		DisplayCode: func(code, verificationURL string) error {
 			fmt.Fprintf(w, "%s First copy your one-time code: %s\n", cs.Yellow("!"), cs.Bold(code))
@@ -110,6 +103,16 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 	return token.Token, userLogin, nil
 }
 
+func getCallbackURI(oauthHost string) string {
+	callbackURI := "http://127.0.0.1/callback"
+	if ghinstance.IsEnterprise(oauthHost) {
+		// the OAuth app on Enterprise hosts is still registered with a legacy callback URL
+		// see https://github.com/cli/cli/pull/222, https://github.com/cli/cli/pull/650
+		callbackURI = "http://localhost/"
+	}
+	return callbackURI
+}
+
 type cfg struct {
 	token string
 }
diff --git a/internal/authflow/flow_test.go b/internal/authflow/flow_test.go
new file mode 100644
index 000000000..a98938b5a
--- /dev/null
+++ b/internal/authflow/flow_test.go
@@ -0,0 +1,36 @@
+package authflow
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_getCallbackURI(t *testing.T) {
+	tests := []struct {
+		name      string
+		oauthHost string
+		want      string
+	}{
+		{
+			name:      "dotcom",
+			oauthHost: "github.com",
+			want:      "http://127.0.0.1/callback",
+		},
+		{
+			name:      "ghes",
+			oauthHost: "my.server.com",
+			want:      "http://localhost/",
+		},
+		{
+			name:      "ghec data residency",
+			oauthHost: "stampname.ghe.com",
+			want:      "http://127.0.0.1/callback",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, getCallbackURI(tt.oauthHost))
+		})
+	}
+}
diff --git a/internal/featuredetection/feature_detection_test.go b/internal/featuredetection/feature_detection_test.go
index 2a32e9a2d..ca6b593a1 100644
--- a/internal/featuredetection/feature_detection_test.go
+++ b/internal/featuredetection/feature_detection_test.go
@@ -25,6 +25,14 @@ func TestIssueFeatures(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:     "ghec data residency",
+			hostname: "stampname.ghe.com",
+			wantFeatures: IssueFeatures{
+				StateReason: true,
+			},
+			wantErr: false,
+		},
 		{
 			name:     "GHE empty response",
 			hostname: "git.my.org",
@@ -271,6 +279,16 @@ func TestRepositoryFeatures(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:     "ghec data residency",
+			hostname: "stampname.ghe.com",
+			wantFeatures: RepositoryFeatures{
+				PullRequestTemplateQuery: true,
+				VisibilityField:          true,
+				AutoMerge:                true,
+			},
+			wantErr: false,
+		},
 		{
 			name:     "GHE empty response",
 			hostname: "git.my.org",
diff --git a/pkg/cmd/gist/clone/clone_test.go b/pkg/cmd/gist/clone/clone_test.go
index 46ab53a0f..d93037e38 100644
--- a/pkg/cmd/gist/clone/clone_test.go
+++ b/pkg/cmd/gist/clone/clone_test.go
@@ -149,6 +149,24 @@ func Test_formatRemoteURL(t *testing.T) {
 			},
 			want: "git@gist.github.com:ID.git",
 		},
+		{
+			name: "ghec data residency HTTPS",
+			args: args{
+				hostname: "stampname.ghe.com",
+				protocol: "https",
+				gistID:   "ID",
+			},
+			want: "https://stampname.ghe.com/gist/ID.git",
+		},
+		{
+			name: "ghec data residency SSH",
+			args: args{
+				hostname: "stampname.ghe.com",
+				protocol: "ssh",
+				gistID:   "ID",
+			},
+			want: "git@stampname.ghe.com:gist/ID.git",
+		},
 		{
 			name: "Enterprise HTTPS",
 			args: args{
diff --git a/pkg/cmd/pr/status/http.go b/pkg/cmd/pr/status/http.go
index 1eb12ed74..a800a24ac 100644
--- a/pkg/cmd/pr/status/http.go
+++ b/pkg/cmd/pr/status/http.go
@@ -120,13 +120,10 @@ func pullRequestStatus(httpClient *http.Client, repo ghrepo.Interface, options r
 		}
 	`
 
-	currentUsername := options.Username
-	if currentUsername == "@me" && ghinstance.IsEnterprise(repo.RepoHost()) {
-		var err error
-		currentUsername, err = api.CurrentLoginName(apiClient, repo.RepoHost())
-		if err != nil {
-			return nil, err
-		}
+	currentUsername, err := getCurrentUsername(options.Username, repo.RepoHost(), apiClient)
+
+	if err != nil {
+		return nil, err
 	}
 
 	viewerQuery := fmt.Sprintf("repo:%s state:open is:pr author:%s", ghrepo.FullName(repo), currentUsername)
@@ -188,6 +185,17 @@ func pullRequestStatus(httpClient *http.Client, repo ghrepo.Interface, options r
 	return &payload, nil
 }
 
+func getCurrentUsername(username string, hostname string, apiClient *api.Client) (string, error) {
+	if username == "@me" && ghinstance.IsEnterprise(hostname) {
+		var err error
+		username, err = api.CurrentLoginName(apiClient, hostname)
+		if err != nil {
+			return "", err
+		}
+	}
+	return username, nil
+}
+
 func pullRequestFragment(conflictStatus bool, statusCheckRollupWithCountByState bool) (string, error) {
 	fields := []string{
 		"number", "title", "state", "url", "isDraft", "isCrossRepository",
diff --git a/pkg/cmd/pr/status/http_test.go b/pkg/cmd/pr/status/http_test.go
new file mode 100644
index 000000000..43449a082
--- /dev/null
+++ b/pkg/cmd/pr/status/http_test.go
@@ -0,0 +1,62 @@
+package status
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/cli/cli/v2/api"
+	"github.com/cli/cli/v2/pkg/httpmock"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_getCurrentUsername(t *testing.T) {
+	tests := []struct {
+		name            string
+		username        string
+		hostname        string
+		serverUsername  string
+		currentUsername string
+	}{
+		{
+			name:            "dotcom",
+			username:        "@me",
+			hostname:        "github.com",
+			currentUsername: "@me",
+		},
+		{
+			name:            "ghec data residency",
+			username:        "@me",
+			hostname:        "stampname.ghe.com",
+			currentUsername: "@me",
+		},
+		{
+			name:            "ghes",
+			username:        "@me",
+			hostname:        "my.server.com",
+			serverUsername:  "@serverUserName",
+			currentUsername: "@serverUserName",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clientStub := &http.Client{}
+			if tt.serverUsername != "" {
+				reg := &httpmock.Registry{}
+				defer reg.Verify(t)
+
+				reg.Register(
+					httpmock.GraphQL(`query UserCurrent\b`),
+					httpmock.StringResponse(`{"data":{"viewer":{"login":"`+tt.serverUsername+`"}}}`),
+				)
+
+				clientStub.Transport = reg
+			}
+
+			apiClientStub := api.NewClientFromHTTP(clientStub)
+
+			currentUsername, err := getCurrentUsername(tt.username, tt.hostname, apiClientStub)
+			assert.NoError(t, err)
+			assert.Equal(t, tt.currentUsername, currentUsername)
+		})
+	}
+}

From 44fdb3320d3c75ba339998f93c5e9037c75c97c1 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 14 Oct 2024 13:54:06 -0700
Subject: [PATCH 185/301] Upgrade go-gh version to 2.11.0

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 42e3c84e6..874885da6 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/charmbracelet/glamour v0.7.0
 	github.com/charmbracelet/lipgloss v0.10.1-0.20240413172830-d0be07ea6b9c
-	github.com/cli/go-gh/v2 v2.10.0
+	github.com/cli/go-gh/v2 v2.11.0
 	github.com/cli/oauth v1.1.1
 	github.com/cli/safeexec v1.0.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.5
diff --git a/go.sum b/go.sum
index 9a1fc23ee..28e339f9e 100644
--- a/go.sum
+++ b/go.sum
@@ -95,8 +95,8 @@ github.com/charmbracelet/x/exp/term v0.0.0-20240425164147-ba2a9512b05f/go.mod h1
 github.com/cli/browser v1.0.0/go.mod h1:IEWkHYbLjkhtjwwWlwTHW2lGxeS5gezEQBMLTwDHf5Q=
 github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
-github.com/cli/go-gh/v2 v2.10.0 h1:GMflBKoErBXlLvN2euxzL+p7JaM8erlSmw0cT7uZr7M=
-github.com/cli/go-gh/v2 v2.10.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
+github.com/cli/go-gh/v2 v2.11.0 h1:TERLYMMWderKBO3lBff/JIu2+eSly2oFRgN2WvO+3eA=
+github.com/cli/go-gh/v2 v2.11.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
 github.com/cli/oauth v1.1.1 h1:459gD3hSjlKX9B1uXBuiAMdpXBUQ9QGf/NDcCpoQxPs=
 github.com/cli/oauth v1.1.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=

From 81591a09b8a1a356ae9b6e8bfc130b64293a922e Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 11 Oct 2024 15:06:11 -0700
Subject: [PATCH 186/301] Use go-gh/auth package for IsEnterprise, IsTenancy,
 and NormalizeHostname

---
 api/client.go                                 |   4 +-
 api/http_client.go                            |   4 +-
 internal/authflow/flow.go                     |   4 +-
 internal/config/config.go                     |  10 +-
 .../featuredetection/feature_detection.go     |   7 +-
 internal/ghinstance/host.go                   |  42 +----
 internal/ghinstance/host_test.go              | 145 ------------------
 internal/ghrepo/repo.go                       |   4 +-
 pkg/cmd/attestation/auth/host.go              |   4 +-
 pkg/cmd/attestation/inspect/inspect.go        |   2 +-
 .../attestation/trustedroot/trustedroot.go    |   3 +-
 pkg/cmd/attestation/verify/verify.go          |   2 +-
 pkg/cmd/auth/login/login.go                   |   4 +-
 pkg/cmd/gist/clone/clone.go                   |   5 +-
 pkg/cmd/pr/status/http.go                     |   5 +-
 pkg/cmd/repo/delete/delete.go                 |   4 +-
 pkg/cmd/ruleset/list/list.go                  |   4 +-
 pkg/cmd/ruleset/view/view.go                  |   4 +-
 18 files changed, 45 insertions(+), 212 deletions(-)

diff --git a/api/client.go b/api/client.go
index e32856554..b30f5f164 100644
--- a/api/client.go
+++ b/api/client.go
@@ -10,8 +10,8 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
 	ghAPI "github.com/cli/go-gh/v2/pkg/api"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 const (
@@ -249,7 +249,7 @@ func generateScopesSuggestion(statusCode int, endpointNeedsScopes, tokenHasScope
 		return fmt.Sprintf(
 			"This API operation needs the %[1]q scope. To request it, run:  gh auth refresh -h %[2]s -s %[1]s",
 			s,
-			ghinstance.NormalizeHostname(hostname),
+			ghauth.NormalizeHostname(hostname),
 		)
 	}
 
diff --git a/api/http_client.go b/api/http_client.go
index f6e133f1f..e9381fa85 100644
--- a/api/http_client.go
+++ b/api/http_client.go
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/utils"
 	ghAPI "github.com/cli/go-gh/v2/pkg/api"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 type tokenGetter interface {
@@ -98,7 +98,7 @@ func AddAuthTokenHeader(rt http.RoundTripper, cfg tokenGetter) http.RoundTripper
 			// Only set header if an initial request or redirect request to the same host as the initial request.
 			// If the host has changed during a redirect do not add the authentication token header.
 			if !redirectHostnameChange {
-				hostname := ghinstance.NormalizeHostname(getHost(req))
+				hostname := ghauth.NormalizeHostname(getHost(req))
 				if token, _ := cfg.ActiveToken(hostname); token != "" {
 					req.Header.Set(authorization, fmt.Sprintf("token %s", token))
 				}
diff --git a/internal/authflow/flow.go b/internal/authflow/flow.go
index e52f8dc0a..1511f6e67 100644
--- a/internal/authflow/flow.go
+++ b/internal/authflow/flow.go
@@ -16,6 +16,8 @@ import (
 	"github.com/cli/cli/v2/utils"
 	"github.com/cli/oauth"
 	"github.com/henvic/httpretty"
+
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 var (
@@ -105,7 +107,7 @@ func AuthFlow(oauthHost string, IO *iostreams.IOStreams, notice string, addition
 
 func getCallbackURI(oauthHost string) string {
 	callbackURI := "http://127.0.0.1/callback"
-	if ghinstance.IsEnterprise(oauthHost) {
+	if ghauth.IsEnterprise(oauthHost) {
 		// the OAuth app on Enterprise hosts is still registered with a legacy callback URL
 		// see https://github.com/cli/cli/pull/222, https://github.com/cli/cli/pull/650
 		callbackURI = "http://localhost/"
diff --git a/internal/config/config.go b/internal/config/config.go
index 1b56d30b2..476154d66 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -10,7 +10,7 @@ import (
 	"github.com/cli/cli/v2/internal/gh"
 	"github.com/cli/cli/v2/internal/keyring"
 	o "github.com/cli/cli/v2/pkg/option"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	ghConfig "github.com/cli/go-gh/v2/pkg/config"
 )
 
@@ -206,7 +206,7 @@ func (c *AuthConfig) ActiveToken(hostname string) (string, string) {
 	if c.tokenOverride != nil {
 		return c.tokenOverride(hostname)
 	}
-	token, source := ghAuth.TokenFromEnvOrConfig(hostname)
+	token, source := ghauth.TokenFromEnvOrConfig(hostname)
 	if token == "" {
 		var err error
 		token, err = c.TokenFromKeyring(hostname)
@@ -240,7 +240,7 @@ func (c *AuthConfig) HasEnvToken() bool {
 	// It has to use a hostname that is not going to be found in the hosts so that it
 	// can guarantee that tokens will only be returned from a set env var.
 	// Discussed here, but maybe worth revisiting: https://github.com/cli/cli/pull/7169#discussion_r1136979033
-	token, _ := ghAuth.TokenFromEnvOrConfig(hostname)
+	token, _ := ghauth.TokenFromEnvOrConfig(hostname)
 	return token != ""
 }
 
@@ -282,7 +282,7 @@ func (c *AuthConfig) Hosts() []string {
 	if c.hostsOverride != nil {
 		return c.hostsOverride()
 	}
-	return ghAuth.KnownHosts()
+	return ghauth.KnownHosts()
 }
 
 // SetHosts will override any hosts resolution and return the given
@@ -297,7 +297,7 @@ func (c *AuthConfig) DefaultHost() (string, string) {
 	if c.defaultHostOverride != nil {
 		return c.defaultHostOverride()
 	}
-	return ghAuth.DefaultHost()
+	return ghauth.DefaultHost()
 }
 
 // SetDefaultHost will override any host resolution and return the given
diff --git a/internal/featuredetection/feature_detection.go b/internal/featuredetection/feature_detection.go
index 396d1eb5b..a9bbe25f8 100644
--- a/internal/featuredetection/feature_detection.go
+++ b/internal/featuredetection/feature_detection.go
@@ -4,8 +4,9 @@ import (
 	"net/http"
 
 	"github.com/cli/cli/v2/api"
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"golang.org/x/sync/errgroup"
+
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 type Detector interface {
@@ -62,7 +63,7 @@ func NewDetector(httpClient *http.Client, host string) Detector {
 }
 
 func (d *detector) IssueFeatures() (IssueFeatures, error) {
-	if !ghinstance.IsEnterprise(d.host) {
+	if !ghauth.IsEnterprise(d.host) {
 		return allIssueFeatures, nil
 	}
 
@@ -163,7 +164,7 @@ func (d *detector) PullRequestFeatures() (PullRequestFeatures, error) {
 }
 
 func (d *detector) RepositoryFeatures() (RepositoryFeatures, error) {
-	if !ghinstance.IsEnterprise(d.host) {
+	if !ghauth.IsEnterprise(d.host) {
 		return allRepositoryFeatures, nil
 	}
 
diff --git a/internal/ghinstance/host.go b/internal/ghinstance/host.go
index f80bfef57..836a478c5 100644
--- a/internal/ghinstance/host.go
+++ b/internal/ghinstance/host.go
@@ -4,6 +4,8 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 // DefaultHostname is the domain name of the default GitHub instance.
@@ -20,22 +22,10 @@ func Default() string {
 	return defaultHostname
 }
 
-// IsEnterprise reports whether a non-normalized host name looks like a GHE instance.
-func IsEnterprise(h string) bool {
-	normalizedHostName := NormalizeHostname(h)
-	return normalizedHostName != defaultHostname && normalizedHostName != localhost
-}
-
-// IsTenancy reports whether a non-normalized host name looks like a tenancy instance.
-func IsTenancy(h string) bool {
-	normalizedHostName := NormalizeHostname(h)
-	return strings.HasSuffix(normalizedHostName, "."+tenancyHost)
-}
-
 // TenantName extracts the tenant name from tenancy host name and
 // reports whether it found the tenant name.
 func TenantName(h string) (string, bool) {
-	normalizedHostName := NormalizeHostname(h)
+	normalizedHostName := ghauth.NormalizeHostname(h)
 	return cutSuffix(normalizedHostName, "."+tenancyHost)
 }
 
@@ -43,22 +33,6 @@ func isGarage(h string) bool {
 	return strings.EqualFold(h, "garage.github.com")
 }
 
-// NormalizeHostname returns the canonical host name of a GitHub instance.
-func NormalizeHostname(h string) string {
-	hostname := strings.ToLower(h)
-	if strings.HasSuffix(hostname, "."+defaultHostname) {
-		return defaultHostname
-	}
-	if strings.HasSuffix(hostname, "."+localhost) {
-		return localhost
-	}
-	if before, found := cutSuffix(hostname, "."+tenancyHost); found {
-		idx := strings.LastIndex(before, ".")
-		return fmt.Sprintf("%s.%s", before[idx+1:], tenancyHost)
-	}
-	return hostname
-}
-
 func HostnameValidator(hostname string) error {
 	if len(strings.TrimSpace(hostname)) < 1 {
 		return errors.New("a value is required")
@@ -77,10 +51,10 @@ func GraphQLEndpoint(hostname string) string {
 	// conditional can be removed as the flow will fall through to the bottom.
 	// However, we can't do that until we've investigated all places in which
 	// Tenancy is currently treated as Enterprise.
-	if IsTenancy(hostname) {
+	if ghauth.IsTenancy(hostname) {
 		return fmt.Sprintf("https://api.%s/graphql", hostname)
 	}
-	if IsEnterprise(hostname) {
+	if ghauth.IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/graphql", hostname)
 	}
 	if strings.EqualFold(hostname, localhost) {
@@ -97,10 +71,10 @@ func RESTPrefix(hostname string) string {
 	// conditional can be removed as the flow will fall through to the bottom.
 	// However, we can't do that until we've investigated all places in which
 	// Tenancy is currently treated as Enterprise.
-	if IsTenancy(hostname) {
+	if ghauth.IsTenancy(hostname) {
 		return fmt.Sprintf("https://api.%s/", hostname)
 	}
-	if IsEnterprise(hostname) {
+	if ghauth.IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/v3/", hostname)
 	}
 	if strings.EqualFold(hostname, localhost) {
@@ -121,7 +95,7 @@ func GistHost(hostname string) string {
 	if isGarage(hostname) {
 		return fmt.Sprintf("%s/gist/", hostname)
 	}
-	if IsEnterprise(hostname) {
+	if ghauth.IsEnterprise(hostname) {
 		return fmt.Sprintf("%s/gist/", hostname)
 	}
 	if strings.EqualFold(hostname, localhost) {
diff --git a/internal/ghinstance/host_test.go b/internal/ghinstance/host_test.go
index e9fb97008..1b7e0146d 100644
--- a/internal/ghinstance/host_test.go
+++ b/internal/ghinstance/host_test.go
@@ -6,88 +6,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestIsEnterprise(t *testing.T) {
-	tests := []struct {
-		host string
-		want bool
-	}{
-		{
-			host: "github.com",
-			want: false,
-		},
-		{
-			host: "api.github.com",
-			want: false,
-		},
-		{
-			host: "github.localhost",
-			want: false,
-		},
-		{
-			host: "api.github.localhost",
-			want: false,
-		},
-		{
-			host: "garage.github.com",
-			want: false,
-		},
-		{
-			host: "ghe.io",
-			want: true,
-		},
-		{
-			host: "example.com",
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			if got := IsEnterprise(tt.host); got != tt.want {
-				t.Errorf("IsEnterprise() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestIsTenancy(t *testing.T) {
-	tests := []struct {
-		host string
-		want bool
-	}{
-		{
-			host: "github.com",
-			want: false,
-		},
-		{
-			host: "github.localhost",
-			want: false,
-		},
-		{
-			host: "garage.github.com",
-			want: false,
-		},
-		{
-			host: "ghe.com",
-			want: false,
-		},
-		{
-			host: "tenant.ghe.com",
-			want: true,
-		},
-		{
-			host: "api.tenant.ghe.com",
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			if got := IsTenancy(tt.host); got != tt.want {
-				t.Errorf("IsTenancy() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 func TestTenantName(t *testing.T) {
 	tests := []struct {
 		host       string
@@ -130,69 +48,6 @@ func TestTenantName(t *testing.T) {
 	}
 }
 
-func TestNormalizeHostname(t *testing.T) {
-	tests := []struct {
-		host string
-		want string
-	}{
-		{
-			host: "GitHub.com",
-			want: "github.com",
-		},
-		{
-			host: "api.github.com",
-			want: "github.com",
-		},
-		{
-			host: "ssh.github.com",
-			want: "github.com",
-		},
-		{
-			host: "upload.github.com",
-			want: "github.com",
-		},
-		{
-			host: "GitHub.localhost",
-			want: "github.localhost",
-		},
-		{
-			host: "api.github.localhost",
-			want: "github.localhost",
-		},
-		{
-			host: "garage.github.com",
-			want: "github.com",
-		},
-		{
-			host: "GHE.IO",
-			want: "ghe.io",
-		},
-		{
-			host: "git.my.org",
-			want: "git.my.org",
-		},
-		{
-			host: "ghe.com",
-			want: "ghe.com",
-		},
-		{
-			host: "tenant.ghe.com",
-			want: "tenant.ghe.com",
-		},
-		{
-			host: "api.tenant.ghe.com",
-			want: "tenant.ghe.com",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			if got := NormalizeHostname(tt.host); got != tt.want {
-				t.Errorf("NormalizeHostname() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 func TestHostnameValidator(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/internal/ghrepo/repo.go b/internal/ghrepo/repo.go
index 4f0328e99..a31d354b5 100644
--- a/internal/ghrepo/repo.go
+++ b/internal/ghrepo/repo.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	"github.com/cli/cli/v2/internal/ghinstance"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/cli/go-gh/v2/pkg/repository"
 )
 
@@ -37,7 +37,7 @@ func FullName(r Interface) string {
 }
 
 func defaultHost() string {
-	host, _ := ghAuth.DefaultHost()
+	host, _ := ghauth.DefaultHost()
 	return host
 }
 
diff --git a/pkg/cmd/attestation/auth/host.go b/pkg/cmd/attestation/auth/host.go
index a40df8335..a8997c403 100644
--- a/pkg/cmd/attestation/auth/host.go
+++ b/pkg/cmd/attestation/auth/host.go
@@ -3,7 +3,7 @@ package auth
 import (
 	"errors"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")
@@ -11,7 +11,7 @@ var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that
 func IsHostSupported(host string) error {
 	// Note that this check is slightly redundant as Tenancy should not be considered Enterprise
 	// but the ghinstance package has not been updated to reflect this yet.
-	if ghinstance.IsEnterprise(host) && !ghinstance.IsTenancy(host) {
+	if ghauth.IsEnterprise(host) && !ghauth.IsTenancy(host) {
 		return ErrUnsupportedHost
 	}
 	return nil
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index 867ff8c1b..c548b2ec7 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -85,7 +85,7 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 				Logger: opts.Logger,
 			}
 			// Prepare for tenancy if detected
-			if ghinstance.IsTenancy(opts.Hostname) {
+			if ghauth.IsTenancy(opts.Hostname) {
 				hc, err := f.HttpClient()
 				if err != nil {
 					return err
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index 5473adc0c..c092b81ec 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/auth"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
@@ -68,7 +67,7 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 				return err
 			}
 
-			if ghinstance.IsTenancy(opts.Hostname) {
+			if ghauth.IsTenancy(opts.Hostname) {
 				c, err := f.Config()
 				if err != nil {
 					return err
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 17b8a84d1..d14081dd8 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -138,7 +138,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			}
 
 			// Prepare for tenancy if detected
-			if ghinstance.IsTenancy(opts.Hostname) {
+			if ghauth.IsTenancy(opts.Hostname) {
 				td, err := opts.APIClient.GetTrustDomain()
 				if err != nil {
 					return fmt.Errorf("error getting trust domain, make sure you are authenticated against the host: %w", err)
diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 1480a29a0..653c9e6c0 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -15,7 +15,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/auth/shared/gitcredentials"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/spf13/cobra"
 )
 
@@ -123,7 +123,7 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 			}
 
 			if opts.Hostname == "" && (!opts.Interactive || opts.Web) {
-				opts.Hostname, _ = ghAuth.DefaultHost()
+				opts.Hostname, _ = ghauth.DefaultHost()
 			}
 
 			opts.MainExecutable = f.Executable()
diff --git a/pkg/cmd/gist/clone/clone.go b/pkg/cmd/gist/clone/clone.go
index 6fa6f226a..9c9ec57e8 100644
--- a/pkg/cmd/gist/clone/clone.go
+++ b/pkg/cmd/gist/clone/clone.go
@@ -8,11 +8,12 @@ import (
 	"github.com/MakeNowJust/heredoc"
 	"github.com/cli/cli/v2/git"
 	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 type CloneOptions struct {
@@ -93,7 +94,7 @@ func cloneRun(opts *CloneOptions) error {
 }
 
 func formatRemoteURL(hostname string, gistID string, protocol string) string {
-	if ghinstance.IsEnterprise(hostname) {
+	if ghauth.IsEnterprise(hostname) || ghauth.IsTenancy(hostname) {
 		if protocol == "ssh" {
 			return fmt.Sprintf("git@%s:gist/%s.git", hostname, gistID)
 		}
diff --git a/pkg/cmd/pr/status/http.go b/pkg/cmd/pr/status/http.go
index a800a24ac..b3fbbac26 100644
--- a/pkg/cmd/pr/status/http.go
+++ b/pkg/cmd/pr/status/http.go
@@ -6,9 +6,10 @@ import (
 	"strings"
 
 	"github.com/cli/cli/v2/api"
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/ghrepo"
 	"github.com/cli/cli/v2/pkg/set"
+
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 )
 
 type requestOptions struct {
@@ -186,7 +187,7 @@ func pullRequestStatus(httpClient *http.Client, repo ghrepo.Interface, options r
 }
 
 func getCurrentUsername(username string, hostname string, apiClient *api.Client) (string, error) {
-	if username == "@me" && ghinstance.IsEnterprise(hostname) {
+	if username == "@me" && ghauth.IsEnterprise(hostname) {
 		var err error
 		username, err = api.CurrentLoginName(apiClient, hostname)
 		if err != nil {
diff --git a/pkg/cmd/repo/delete/delete.go b/pkg/cmd/repo/delete/delete.go
index 1e96e404d..722d748b9 100644
--- a/pkg/cmd/repo/delete/delete.go
+++ b/pkg/cmd/repo/delete/delete.go
@@ -10,7 +10,7 @@ import (
 	"github.com/cli/cli/v2/internal/ghrepo"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/spf13/cobra"
 )
 
@@ -85,7 +85,7 @@ func deleteRun(opts *DeleteOptions) error {
 	} else {
 		repoSelector := opts.RepoArg
 		if !strings.Contains(repoSelector, "/") {
-			defaultHost, _ := ghAuth.DefaultHost()
+			defaultHost, _ := ghauth.DefaultHost()
 			currentUser, err := api.CurrentLoginName(apiClient, defaultHost)
 			if err != nil {
 				return err
diff --git a/pkg/cmd/ruleset/list/list.go b/pkg/cmd/ruleset/list/list.go
index 7cc533e13..2b945c906 100644
--- a/pkg/cmd/ruleset/list/list.go
+++ b/pkg/cmd/ruleset/list/list.go
@@ -15,7 +15,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/ruleset/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/spf13/cobra"
 )
 
@@ -109,7 +109,7 @@ func listRun(opts *ListOptions) error {
 		}
 	}
 
-	hostname, _ := ghAuth.DefaultHost()
+	hostname, _ := ghauth.DefaultHost()
 
 	if opts.WebMode {
 		var rulesetURL string
diff --git a/pkg/cmd/ruleset/view/view.go b/pkg/cmd/ruleset/view/view.go
index d272d273e..cefd926ab 100644
--- a/pkg/cmd/ruleset/view/view.go
+++ b/pkg/cmd/ruleset/view/view.go
@@ -15,7 +15,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/ruleset/shared"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
-	ghAuth "github.com/cli/go-gh/v2/pkg/auth"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/spf13/cobra"
 )
 
@@ -124,7 +124,7 @@ func viewRun(opts *ViewOptions) error {
 		}
 	}
 
-	hostname, _ := ghAuth.DefaultHost()
+	hostname, _ := ghauth.DefaultHost()
 	cs := opts.IO.ColorScheme()
 
 	if opts.InteractiveMode {

From 8109594c4ce6038ab500fb403cf8bd919d17fd95 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 11 Oct 2024 15:21:52 -0700
Subject: [PATCH 187/301] auth: Removed redundant ghauth.IsTenancy(host) check

---
 pkg/cmd/attestation/auth/host.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/auth/host.go b/pkg/cmd/attestation/auth/host.go
index a8997c403..d72f82fa5 100644
--- a/pkg/cmd/attestation/auth/host.go
+++ b/pkg/cmd/attestation/auth/host.go
@@ -9,9 +9,7 @@ import (
 var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")
 
 func IsHostSupported(host string) error {
-	// Note that this check is slightly redundant as Tenancy should not be considered Enterprise
-	// but the ghinstance package has not been updated to reflect this yet.
-	if ghauth.IsEnterprise(host) && !ghauth.IsTenancy(host) {
+	if ghauth.IsEnterprise(host) {
 		return ErrUnsupportedHost
 	}
 	return nil

From 4df2e7be634cf2eb7f7d63b61351d68afc1c6c07 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 15 Oct 2024 12:16:20 -0700
Subject: [PATCH 188/301] Remove comment

---
 pkg/cmd/pr/shared/survey.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/cmd/pr/shared/survey.go b/pkg/cmd/pr/shared/survey.go
index 2ee343bfb..3d53be4c7 100644
--- a/pkg/cmd/pr/shared/survey.go
+++ b/pkg/cmd/pr/shared/survey.go
@@ -121,7 +121,6 @@ func TitleSurvey(p Prompt, io *iostreams.IOStreams, state *IssueMetadataState) e
 		if result == "" {
 			colorizeRed := io.ColorScheme().ColorFromString("red")
 			msg := fmt.Sprintf("%s Title cannot be blank.", colorizeRed("X"))
-			// For some reason, only Fprintln and Println work here. I can't use Fprintf or Printf to eliminate the line above
 			fmt.Fprintln(io.ErrOut, msg)
 		}
 	}

From e1a39d8e2bcbebf228d6b7ebaf49002bb84b866f Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 15 Oct 2024 12:24:41 -0700
Subject: [PATCH 189/301] Add ghe.com to tests describing ghec data residency

---
 internal/authflow/flow_test.go                      | 2 +-
 internal/featuredetection/feature_detection_test.go | 4 ++--
 pkg/cmd/gist/clone/clone_test.go                    | 4 ++--
 pkg/cmd/pr/status/http_test.go                      | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/authflow/flow_test.go b/internal/authflow/flow_test.go
index a98938b5a..b7ba1f64a 100644
--- a/internal/authflow/flow_test.go
+++ b/internal/authflow/flow_test.go
@@ -23,7 +23,7 @@ func Test_getCallbackURI(t *testing.T) {
 			want:      "http://localhost/",
 		},
 		{
-			name:      "ghec data residency",
+			name:      "ghec data residency (ghe.com)",
 			oauthHost: "stampname.ghe.com",
 			want:      "http://127.0.0.1/callback",
 		},
diff --git a/internal/featuredetection/feature_detection_test.go b/internal/featuredetection/feature_detection_test.go
index ca6b593a1..8af091c3f 100644
--- a/internal/featuredetection/feature_detection_test.go
+++ b/internal/featuredetection/feature_detection_test.go
@@ -26,7 +26,7 @@ func TestIssueFeatures(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:     "ghec data residency",
+			name:     "ghec data residency (ghe.com)",
 			hostname: "stampname.ghe.com",
 			wantFeatures: IssueFeatures{
 				StateReason: true,
@@ -280,7 +280,7 @@ func TestRepositoryFeatures(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name:     "ghec data residency",
+			name:     "ghec data residency (ghe.com)",
 			hostname: "stampname.ghe.com",
 			wantFeatures: RepositoryFeatures{
 				PullRequestTemplateQuery: true,
diff --git a/pkg/cmd/gist/clone/clone_test.go b/pkg/cmd/gist/clone/clone_test.go
index d93037e38..d944bf87d 100644
--- a/pkg/cmd/gist/clone/clone_test.go
+++ b/pkg/cmd/gist/clone/clone_test.go
@@ -150,7 +150,7 @@ func Test_formatRemoteURL(t *testing.T) {
 			want: "git@gist.github.com:ID.git",
 		},
 		{
-			name: "ghec data residency HTTPS",
+			name: "ghec data residency (ghe.com) HTTPS",
 			args: args{
 				hostname: "stampname.ghe.com",
 				protocol: "https",
@@ -159,7 +159,7 @@ func Test_formatRemoteURL(t *testing.T) {
 			want: "https://stampname.ghe.com/gist/ID.git",
 		},
 		{
-			name: "ghec data residency SSH",
+			name: "ghec data residency (ghe.com) SSH",
 			args: args{
 				hostname: "stampname.ghe.com",
 				protocol: "ssh",
diff --git a/pkg/cmd/pr/status/http_test.go b/pkg/cmd/pr/status/http_test.go
index 43449a082..eeb91e909 100644
--- a/pkg/cmd/pr/status/http_test.go
+++ b/pkg/cmd/pr/status/http_test.go
@@ -24,7 +24,7 @@ func Test_getCurrentUsername(t *testing.T) {
 			currentUsername: "@me",
 		},
 		{
-			name:            "ghec data residency",
+			name:            "ghec data residency (ghe.com)",
 			username:        "@me",
 			hostname:        "stampname.ghe.com",
 			currentUsername: "@me",

From 0bd4e034efb786a027ad00f17986ba4356a3d167 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 15 Oct 2024 12:35:35 -0700
Subject: [PATCH 190/301] Remove unnecessary code branches

---
 internal/ghinstance/host.go | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/internal/ghinstance/host.go b/internal/ghinstance/host.go
index 836a478c5..be839d62e 100644
--- a/internal/ghinstance/host.go
+++ b/internal/ghinstance/host.go
@@ -47,13 +47,6 @@ func GraphQLEndpoint(hostname string) string {
 	if isGarage(hostname) {
 		return fmt.Sprintf("https://%s/api/graphql", hostname)
 	}
-	// Once we change Tenancy to no longer be treated as Enterprise, this
-	// conditional can be removed as the flow will fall through to the bottom.
-	// However, we can't do that until we've investigated all places in which
-	// Tenancy is currently treated as Enterprise.
-	if ghauth.IsTenancy(hostname) {
-		return fmt.Sprintf("https://api.%s/graphql", hostname)
-	}
 	if ghauth.IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/graphql", hostname)
 	}
@@ -67,13 +60,6 @@ func RESTPrefix(hostname string) string {
 	if isGarage(hostname) {
 		return fmt.Sprintf("https://%s/api/v3/", hostname)
 	}
-	// Once we change Tenancy to no longer be treated as Enterprise, this
-	// conditional can be removed as the flow will fall through to the bottom.
-	// However, we can't do that until we've investigated all places in which
-	// Tenancy is currently treated as Enterprise.
-	if ghauth.IsTenancy(hostname) {
-		return fmt.Sprintf("https://api.%s/", hostname)
-	}
 	if ghauth.IsEnterprise(hostname) {
 		return fmt.Sprintf("https://%s/api/v3/", hostname)
 	}

From ddf90c78c2b71ae6f8c13a6bd0ed3f8c0b3b1ca2 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Tue, 15 Oct 2024 12:41:23 -0700
Subject: [PATCH 191/301] Remove IsTenancy and relevant tests from gists as
 they are unsupported

---
 pkg/cmd/gist/clone/clone.go      |  2 +-
 pkg/cmd/gist/clone/clone_test.go | 18 ------------------
 2 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/pkg/cmd/gist/clone/clone.go b/pkg/cmd/gist/clone/clone.go
index 9c9ec57e8..c7db74521 100644
--- a/pkg/cmd/gist/clone/clone.go
+++ b/pkg/cmd/gist/clone/clone.go
@@ -94,7 +94,7 @@ func cloneRun(opts *CloneOptions) error {
 }
 
 func formatRemoteURL(hostname string, gistID string, protocol string) string {
-	if ghauth.IsEnterprise(hostname) || ghauth.IsTenancy(hostname) {
+	if ghauth.IsEnterprise(hostname) {
 		if protocol == "ssh" {
 			return fmt.Sprintf("git@%s:gist/%s.git", hostname, gistID)
 		}
diff --git a/pkg/cmd/gist/clone/clone_test.go b/pkg/cmd/gist/clone/clone_test.go
index d944bf87d..46ab53a0f 100644
--- a/pkg/cmd/gist/clone/clone_test.go
+++ b/pkg/cmd/gist/clone/clone_test.go
@@ -149,24 +149,6 @@ func Test_formatRemoteURL(t *testing.T) {
 			},
 			want: "git@gist.github.com:ID.git",
 		},
-		{
-			name: "ghec data residency (ghe.com) HTTPS",
-			args: args{
-				hostname: "stampname.ghe.com",
-				protocol: "https",
-				gistID:   "ID",
-			},
-			want: "https://stampname.ghe.com/gist/ID.git",
-		},
-		{
-			name: "ghec data residency (ghe.com) SSH",
-			args: args{
-				hostname: "stampname.ghe.com",
-				protocol: "ssh",
-				gistID:   "ID",
-			},
-			want: "git@stampname.ghe.com:gist/ID.git",
-		},
 		{
 			name: "Enterprise HTTPS",
 			args: args{

From 3f080e0948dc8d5e88a3e8b3104ab10486348534 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:19:44 -0600
Subject: [PATCH 192/301] Create run-delete.txtar

---
 acceptance/testdata/workflow/run-delete.txtar | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 acceptance/testdata/workflow/run-delete.txtar

diff --git a/acceptance/testdata/workflow/run-delete.txtar b/acceptance/testdata/workflow/run-delete.txtar
new file mode 100644
index 000000000..16dc224fb
--- /dev/null
+++ b/acceptance/testdata/workflow/run-delete.txtar
@@ -0,0 +1,74 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to watch & delete
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Delete the workflow run
+exec gh run delete $RUN_ID
+stdout '✓ Request to delete workflow submitted.'
+
+# It takes some time for a workflow run to be deleted
+sleep 5
+
+# Check the workflow run is cancelled
+exec gh run list
+stdout ''
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: echo Hello, world!

From 3d3e061d06b6384efdc6189aad649b3acca00d35 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:19:47 -0600
Subject: [PATCH 193/301] Create run-download.txtar

---
 .../testdata/workflow/run-download.txtar      | 72 +++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 acceptance/testdata/workflow/run-download.txtar

diff --git a/acceptance/testdata/workflow/run-download.txtar b/acceptance/testdata/workflow/run-download.txtar
new file mode 100644
index 000000000..2aa3cae64
--- /dev/null
+++ b/acceptance/testdata/workflow/run-download.txtar
@@ -0,0 +1,72 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to watch
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Download the artifact
+exec gh run download $RUN_ID
+stdout '' 
+
+# Check if we downloaded the artifact
+exists ./my-artifact/world.txt
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - run: mkdir -p path/to/artifact
+      - run: echo hello > world.txt
+      - uses: actions/upload-artifact@v4
+        with:
+          name: my-artifact
+          path: world.txt
\ No newline at end of file

From 745863b3656a5f106dffcc11f9e5835fe7851362 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:19:49 -0600
Subject: [PATCH 194/301] Create run-rerun.txtar

---
 acceptance/testdata/workflow/run-rerun.txtar | 79 ++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 acceptance/testdata/workflow/run-rerun.txtar

diff --git a/acceptance/testdata/workflow/run-rerun.txtar b/acceptance/testdata/workflow/run-rerun.txtar
new file mode 100644
index 000000000..e5b895454
--- /dev/null
+++ b/acceptance/testdata/workflow/run-rerun.txtar
@@ -0,0 +1,79 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to rerun
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Get the run ID we want to rerun
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Rerun the workflow run
+# There's some inconsistency here compared to `run delete` and other `run`
+# commands because run rerun doesn't return output in non-tty.
+exec gh run rerun $RUN_ID
+stdout ''
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: echo Hello, world!

From 682b75fb4e91bc90da966d74543acb1f36fcfb8d Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:19:52 -0600
Subject: [PATCH 195/301] Create run-view.txtar

---
 acceptance/testdata/workflow/run-view.txtar | 66 +++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 acceptance/testdata/workflow/run-view.txtar

diff --git a/acceptance/testdata/workflow/run-view.txtar b/acceptance/testdata/workflow/run-view.txtar
new file mode 100644
index 000000000..c3ace4c4f
--- /dev/null
+++ b/acceptance/testdata/workflow/run-view.txtar
@@ -0,0 +1,66 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to view
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# View the workflow run
+exec gh run view $RUN_ID
+
+-- workflow.yml --
+# This is a basic workflow to help you get started with Actions
+
+name: Test Workflow Name
+
+# Controls when the workflow will run
+on:
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sleep 10

From 924d81a34bed6f34fbbe134a1f2f5b644fe0715b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:59:19 -0600
Subject: [PATCH 196/301] Create cache-list-delete.txtar

---
 .../testdata/workflow/cache-list-delete.txtar | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 acceptance/testdata/workflow/cache-list-delete.txtar

diff --git a/acceptance/testdata/workflow/cache-list-delete.txtar b/acceptance/testdata/workflow/cache-list-delete.txtar
new file mode 100644
index 000000000..30ce78bd0
--- /dev/null
+++ b/acceptance/testdata/workflow/cache-list-delete.txtar
@@ -0,0 +1,70 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# commit the workflow file
+cd $SCRIPT_NAME-$RANDOM_STRING
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 5
+
+# Get the run ID we want to watch
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# List the cache
+exec gh cache list
+stdout 'Linux-values'
+
+# Delete the cache
+exec gh cache delete 'Linux-values'
+stdout ''
+
+-- workflow.yml --
+name: Test Workflow Name
+
+on: workflow_dispatch
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Cache values
+      id: cache-values
+      uses: actions/cache@v4
+      with:
+        path: values.txt
+        key: ${{ runner.os }}-values
+
+    - name: Generate values file
+      if: steps.cache-values.outputs.cache-hit != 'true'
+      run: echo "values" > values.txt
\ No newline at end of file

From 8d626312a487c5f7efa9acc4cf708c9200c967de Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 14:59:21 -0600
Subject: [PATCH 197/301] Update run-rerun.txtar

---
 acceptance/testdata/workflow/run-rerun.txtar | 2 --
 1 file changed, 2 deletions(-)

diff --git a/acceptance/testdata/workflow/run-rerun.txtar b/acceptance/testdata/workflow/run-rerun.txtar
index e5b895454..1448dec4b 100644
--- a/acceptance/testdata/workflow/run-rerun.txtar
+++ b/acceptance/testdata/workflow/run-rerun.txtar
@@ -43,8 +43,6 @@ exec gh run list --json databaseId --jq '.[0].databaseId'
 stdout2env RUN_ID
 
 # Rerun the workflow run
-# There's some inconsistency here compared to `run delete` and other `run`
-# commands because run rerun doesn't return output in non-tty.
 exec gh run rerun $RUN_ID
 stdout ''
 

From 4ce82361422807f0a3f066f93b89ddfeb11dba0c Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 15 Oct 2024 15:09:47 -0600
Subject: [PATCH 198/301] sleep 10s before checking for workflow run

---
 acceptance/testdata/workflow/cache-list-delete.txtar | 2 +-
 acceptance/testdata/workflow/run-cancel.txtar        | 2 +-
 acceptance/testdata/workflow/run-delete.txtar        | 2 +-
 acceptance/testdata/workflow/run-download.txtar      | 2 +-
 acceptance/testdata/workflow/run-rerun.txtar         | 8 ++------
 acceptance/testdata/workflow/run-view.txtar          | 2 +-
 acceptance/testdata/workflow/workflow-run.txtar      | 2 +-
 7 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/acceptance/testdata/workflow/cache-list-delete.txtar b/acceptance/testdata/workflow/cache-list-delete.txtar
index 30ce78bd0..aa1dc91a7 100644
--- a/acceptance/testdata/workflow/cache-list-delete.txtar
+++ b/acceptance/testdata/workflow/cache-list-delete.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to watch
 exec gh run list --json databaseId --jq '.[0].databaseId'
diff --git a/acceptance/testdata/workflow/run-cancel.txtar b/acceptance/testdata/workflow/run-cancel.txtar
index f06912c90..2f1170bbc 100644
--- a/acceptance/testdata/workflow/run-cancel.txtar
+++ b/acceptance/testdata/workflow/run-cancel.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to cancel
 exec gh run list --json databaseId --jq '.[0].databaseId'
diff --git a/acceptance/testdata/workflow/run-delete.txtar b/acceptance/testdata/workflow/run-delete.txtar
index 16dc224fb..45b11f2d1 100644
--- a/acceptance/testdata/workflow/run-delete.txtar
+++ b/acceptance/testdata/workflow/run-delete.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to watch & delete
 exec gh run list --json databaseId --jq '.[0].databaseId'
diff --git a/acceptance/testdata/workflow/run-download.txtar b/acceptance/testdata/workflow/run-download.txtar
index 2aa3cae64..a8faaacec 100644
--- a/acceptance/testdata/workflow/run-download.txtar
+++ b/acceptance/testdata/workflow/run-download.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to watch
 exec gh run list --json databaseId --jq '.[0].databaseId'
diff --git a/acceptance/testdata/workflow/run-rerun.txtar b/acceptance/testdata/workflow/run-rerun.txtar
index 1448dec4b..273a4adea 100644
--- a/acceptance/testdata/workflow/run-rerun.txtar
+++ b/acceptance/testdata/workflow/run-rerun.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to rerun
 exec gh run list --json databaseId --jq '.[0].databaseId'
@@ -38,16 +38,12 @@ stdout2env RUN_ID
 # Wait for workflow to complete
 exec gh run watch $RUN_ID --exit-status
 
-# Get the run ID we want to rerun
-exec gh run list --json databaseId --jq '.[0].databaseId'
-stdout2env RUN_ID
-
 # Rerun the workflow run
 exec gh run rerun $RUN_ID
 stdout ''
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Wait for workflow to complete
 exec gh run watch $RUN_ID --exit-status
diff --git a/acceptance/testdata/workflow/run-view.txtar b/acceptance/testdata/workflow/run-view.txtar
index c3ace4c4f..bc739e580 100644
--- a/acceptance/testdata/workflow/run-view.txtar
+++ b/acceptance/testdata/workflow/run-view.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Get the run ID we want to view
 exec gh run list --json databaseId --jq '.[0].databaseId'
diff --git a/acceptance/testdata/workflow/workflow-run.txtar b/acceptance/testdata/workflow/workflow-run.txtar
index 7e9a823ee..010189c01 100644
--- a/acceptance/testdata/workflow/workflow-run.txtar
+++ b/acceptance/testdata/workflow/workflow-run.txtar
@@ -29,7 +29,7 @@ stdout 'Test Workflow Name'
 exec gh workflow run 'Test Workflow Name'
 
 # It takes some time for a workflow run to register
-sleep 5
+sleep 10
 
 # Check the workflow run exists
 exec gh run list

From 446f66070a38b9718357255f8abd66c6acf57c7d Mon Sep 17 00:00:00 2001
From: Heath Stewart <heaths@outlook.com>
Date: Tue, 15 Oct 2024 14:39:21 -0700
Subject: [PATCH 199/301] Add filtered content output to docs

---
 pkg/cmd/gist/list/list.go | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/gist/list/list.go b/pkg/cmd/gist/list/list.go
index b1e76e52e..00a401be4 100644
--- a/pkg/cmd/gist/list/list.go
+++ b/pkg/cmd/gist/list/list.go
@@ -48,11 +48,17 @@ func NewCmdList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Comman
 			You can use a regular expression to filter the description, file names,
 			or even the content of files in the gist using %[1]s--filter%[1]s.
 
+			For supported regular expression syntax, see <https://pkg.go.dev/regexp/syntax>.
+
 			Use %[1]s--include-content%[1]s to include content of files, noting that
 			this will be slower and increase the rate limit used. Instead of printing a table,
-			code will be printed with highlights.
+			code will be printed with highlights similar to %[1]sgh search code%[1]s:
 
-			For supported regular expression syntax, see <https://pkg.go.dev/regexp/syntax>
+				{{gist ID}} {{file name}}
+				    {{description}}
+				        {{matching lines from content}}
+
+			No highlights or other color is printed when output is redirected.
 		`, "`"),
 		Example: heredoc.Doc(`
 			# list all secret gists from your user account
@@ -207,6 +213,14 @@ func printTable(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Reg
 	return tp.Render()
 }
 
+// printContent prints a gist with optional description and content similar to `gh search code`
+// including highlighted matches in the form:
+//
+//	{{gist ID}} {{file name}}
+//	    {{description, if any}}
+//	        {{content lines with matches, if any}}
+//
+// If printing to a non-TTY stream the format will be the same but without highlights.
 func printContent(io *iostreams.IOStreams, gists []shared.Gist, filter *regexp.Regexp) error {
 	const tab string = "    "
 	cs := io.ColorScheme()

From fdfd4b30bb6f4627f782cc5555e046bad1beece0 Mon Sep 17 00:00:00 2001
From: Yukai Chou <muzimuzhi@gmail.com>
Date: Thu, 17 Oct 2024 01:12:21 +0800
Subject: [PATCH 200/301] Rewrite a sentence in CONTRIBUTING.md

---
 .github/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 35b211236..9a0acb58e 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -6,7 +6,7 @@ We accept pull requests for bug fixes and features where we've discussed the app
 
 Please do:
 
-* Check existing issues to verify that an existing [bug][bug issues] or [feature request][feature request issues] issue does not already exist for the same problem or feature.
+* Check issues to verify that a [bug][bug issues] or [feature request][feature request issues] issue does not already exist for the same problem or feature.
 * Open an issue if things aren't working as expected.
 * Open an issue to propose a significant change.
 * Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design) instructions below.

From 86b4bb99561857310bf0bc3238d928a1e0af5d60 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Wed, 16 Oct 2024 19:38:10 -0400
Subject: [PATCH 201/301] Include startedAt, completedAt in run steps data

This commit expands the `Step` structure used with GitHub Actions workflow runs to include fields indicating when steps start and complete.

This information is already provided by the GitHub API, so this only involves expanding the structure, fields exported, and the associated tests.

In the future, I could see `gh` including the duration calculation which is used when viewing workflow or workflow run.
---
 pkg/cmd/run/shared/shared.go      | 32 ++++++++++++++++----------
 pkg/cmd/run/shared/shared_test.go | 38 +++++++++++++++++++------------
 2 files changed, 44 insertions(+), 26 deletions(-)

diff --git a/pkg/cmd/run/shared/shared.go b/pkg/cmd/run/shared/shared.go
index e5f09dec9..90ab5a7fe 100644
--- a/pkg/cmd/run/shared/shared.go
+++ b/pkg/cmd/run/shared/shared.go
@@ -180,16 +180,22 @@ func (r *Run) ExportData(fields []string) map[string]interface{} {
 			for _, j := range r.Jobs {
 				steps := make([]interface{}, 0, len(j.Steps))
 				for _, s := range j.Steps {
+					var stepCompletedAt time.Time
+					if !s.CompletedAt.IsZero() {
+						stepCompletedAt = s.CompletedAt
+					}
 					steps = append(steps, map[string]interface{}{
-						"name":       s.Name,
-						"status":     s.Status,
-						"conclusion": s.Conclusion,
-						"number":     s.Number,
+						"name":        s.Name,
+						"status":      s.Status,
+						"conclusion":  s.Conclusion,
+						"number":      s.Number,
+						"startedAt":   s.StartedAt,
+						"completedAt": stepCompletedAt,
 					})
 				}
-				var completedAt time.Time
+				var jobCompletedAt time.Time
 				if !j.CompletedAt.IsZero() {
-					completedAt = j.CompletedAt
+					jobCompletedAt = j.CompletedAt
 				}
 				jobs = append(jobs, map[string]interface{}{
 					"databaseId":  j.ID,
@@ -198,7 +204,7 @@ func (r *Run) ExportData(fields []string) map[string]interface{} {
 					"name":        j.Name,
 					"steps":       steps,
 					"startedAt":   j.StartedAt,
-					"completedAt": completedAt,
+					"completedAt": jobCompletedAt,
 					"url":         j.URL,
 				})
 			}
@@ -225,11 +231,13 @@ type Job struct {
 }
 
 type Step struct {
-	Name       string
-	Status     Status
-	Conclusion Conclusion
-	Number     int
-	Log        *zip.File
+	Name        string
+	Status      Status
+	Conclusion  Conclusion
+	Number      int
+	StartedAt   time.Time `json:"started_at"`
+	CompletedAt time.Time `json:"completed_at"`
+	Log         *zip.File
 }
 
 type Steps []Step
diff --git a/pkg/cmd/run/shared/shared_test.go b/pkg/cmd/run/shared/shared_test.go
index 15663cd0a..752ba2fc4 100644
--- a/pkg/cmd/run/shared/shared_test.go
+++ b/pkg/cmd/run/shared/shared_test.go
@@ -110,8 +110,12 @@ func TestRun_Duration(t *testing.T) {
 
 func TestRunExportData(t *testing.T) {
 	oldestStartedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:20:13Z")
+	oldestStepStartedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:20:15Z")
+	oldestStepCompletedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:21:10Z")
 	oldestCompletedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:21:16Z")
 	newestStartedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:20:55Z")
+	newestStepStartedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:21:01Z")
+	newestStepCompletedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:23:10Z")
 	newestCompletedAt, _ := time.Parse(time.RFC3339, "2022-07-20T11:23:16Z")
 
 	tests := []struct {
@@ -132,10 +136,12 @@ func TestRunExportData(t *testing.T) {
 						Name:       "macos",
 						Steps: []Step{
 							{
-								Name:       "Checkout",
-								Status:     "completed",
-								Conclusion: "success",
-								Number:     1,
+								Name:        "Checkout",
+								Status:      "completed",
+								Conclusion:  "success",
+								Number:      1,
+								StartedAt:   oldestStepStartedAt,
+								CompletedAt: oldestStepCompletedAt,
 							},
 						},
 						StartedAt:   oldestStartedAt,
@@ -144,7 +150,7 @@ func TestRunExportData(t *testing.T) {
 					},
 				},
 			},
-			output: `{"jobs":[{"completedAt":"2022-07-20T11:21:16Z","conclusion":"success","databaseId":123456,"name":"macos","startedAt":"2022-07-20T11:20:13Z","status":"completed","steps":[{"conclusion":"success","name":"Checkout","number":1,"status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/123456"}]}`,
+			output: `{"jobs":[{"completedAt":"2022-07-20T11:21:16Z","conclusion":"success","databaseId":123456,"name":"macos","startedAt":"2022-07-20T11:20:13Z","status":"completed","steps":[{"completedAt":"2022-07-20T11:21:10Z","conclusion":"success","name":"Checkout","number":1,"startedAt":"2022-07-20T11:20:15Z","status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/123456"}]}`,
 		},
 		{
 			name:   "exports workflow run's multiple jobs",
@@ -158,10 +164,12 @@ func TestRunExportData(t *testing.T) {
 						Name:       "macos",
 						Steps: []Step{
 							{
-								Name:       "Checkout",
-								Status:     "completed",
-								Conclusion: "success",
-								Number:     1,
+								Name:        "Checkout",
+								Status:      "completed",
+								Conclusion:  "success",
+								Number:      1,
+								StartedAt:   oldestStepStartedAt,
+								CompletedAt: oldestStepCompletedAt,
 							},
 						},
 						StartedAt:   oldestStartedAt,
@@ -175,10 +183,12 @@ func TestRunExportData(t *testing.T) {
 						Name:       "windows",
 						Steps: []Step{
 							{
-								Name:       "Checkout",
-								Status:     "completed",
-								Conclusion: "error",
-								Number:     2,
+								Name:        "Checkout",
+								Status:      "completed",
+								Conclusion:  "error",
+								Number:      2,
+								StartedAt:   newestStepStartedAt,
+								CompletedAt: newestStepCompletedAt,
 							},
 						},
 						StartedAt:   newestStartedAt,
@@ -187,7 +197,7 @@ func TestRunExportData(t *testing.T) {
 					},
 				},
 			},
-			output: `{"jobs":[{"completedAt":"2022-07-20T11:21:16Z","conclusion":"success","databaseId":123456,"name":"macos","startedAt":"2022-07-20T11:20:13Z","status":"completed","steps":[{"conclusion":"success","name":"Checkout","number":1,"status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/123456"},{"completedAt":"2022-07-20T11:23:16Z","conclusion":"error","databaseId":234567,"name":"windows","startedAt":"2022-07-20T11:20:55Z","status":"completed","steps":[{"conclusion":"error","name":"Checkout","number":2,"status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/234567"}]}`,
+			output: `{"jobs":[{"completedAt":"2022-07-20T11:21:16Z","conclusion":"success","databaseId":123456,"name":"macos","startedAt":"2022-07-20T11:20:13Z","status":"completed","steps":[{"completedAt":"2022-07-20T11:21:10Z","conclusion":"success","name":"Checkout","number":1,"startedAt":"2022-07-20T11:20:15Z","status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/123456"},{"completedAt":"2022-07-20T11:23:16Z","conclusion":"error","databaseId":234567,"name":"windows","startedAt":"2022-07-20T11:20:55Z","status":"completed","steps":[{"completedAt":"2022-07-20T11:23:10Z","conclusion":"error","name":"Checkout","number":2,"startedAt":"2022-07-20T11:21:01Z","status":"completed"}],"url":"https://example.com/OWNER/REPO/actions/runs/234567"}]}`,
 		},
 		{
 			name:   "exports workflow run with attempt count",

From 8f567e2791abe3cf6bc750b383753184ad527a16 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 14:13:50 +0200
Subject: [PATCH 202/301] Watch for run to end for cancel Acceptance test

---
 acceptance/testdata/workflow/run-cancel.txtar | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acceptance/testdata/workflow/run-cancel.txtar b/acceptance/testdata/workflow/run-cancel.txtar
index 2f1170bbc..08d8d519a 100644
--- a/acceptance/testdata/workflow/run-cancel.txtar
+++ b/acceptance/testdata/workflow/run-cancel.txtar
@@ -39,8 +39,8 @@ stdout2env RUN_ID
 exec gh run cancel $RUN_ID
 stdout '✓ Request to cancel workflow [0-9]+ submitted.'
 
-# It takes some time for a workflow run to be cancelled
-sleep 5
+# Wait for workflow to complete
+exec gh run watch $RUN_ID
 
 # Check the workflow run is cancelled
 exec gh run list --json conclusion --jq '.[0].conclusion'

From 93081c9e65acaf6c56009a642a03259d48a34a91 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 14:25:02 +0200
Subject: [PATCH 203/301] Use regex assert for enable disable workflow
 Acceptance test

---
 acceptance/testdata/workflow/workflow-enable-disable.txtar | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/acceptance/testdata/workflow/workflow-enable-disable.txtar b/acceptance/testdata/workflow/workflow-enable-disable.txtar
index c248c1cad..c18ae7dc7 100644
--- a/acceptance/testdata/workflow/workflow-enable-disable.txtar
+++ b/acceptance/testdata/workflow/workflow-enable-disable.txtar
@@ -28,11 +28,6 @@ stdout 'Test Workflow Name'
 # disable the workflow
 exec gh workflow disable 'Test Workflow Name'
 
-# Check the workflow is indeed disabled
-# Disabled workflows are hidden by default.
-exec gh workflow list
-stdout ''
-
 # Check that the listing shows it is disabled
 exec gh workflow list --all
 stdout 'Test\s+Workflow\s+Name\s+disabled_manually\s+\d+'
@@ -42,7 +37,7 @@ exec gh workflow enable 'Test Workflow Name'
 
 # Check the workflow is indeed enabled
 exec gh workflow list
-stdout 'Test Workflow Name'
+stdout 'Test\s+Workflow\s+Name\s+active\s+\d+'
 
 -- workflow.yml --
 # This is a basic workflow to help you get started with Actions

From 0f62ec20e261796d314586e45446ee2736ac200c Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 15:06:45 +0200
Subject: [PATCH 204/301] Adjust sleeps to echos in Acceptance workflows

---
 acceptance/testdata/workflow/run-view.txtar                | 2 +-
 acceptance/testdata/workflow/workflow-enable-disable.txtar | 2 +-
 acceptance/testdata/workflow/workflow-list.txtar           | 2 +-
 acceptance/testdata/workflow/workflow-view.txtar           | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/acceptance/testdata/workflow/run-view.txtar b/acceptance/testdata/workflow/run-view.txtar
index bc739e580..25f12c3a5 100644
--- a/acceptance/testdata/workflow/run-view.txtar
+++ b/acceptance/testdata/workflow/run-view.txtar
@@ -63,4 +63,4 @@ jobs:
 
       # Runs a single command using the runners shell
       - name: Run a one-line script
-        run: sleep 10
+        run: echo Hello, world!
diff --git a/acceptance/testdata/workflow/workflow-enable-disable.txtar b/acceptance/testdata/workflow/workflow-enable-disable.txtar
index c18ae7dc7..f0b58116f 100644
--- a/acceptance/testdata/workflow/workflow-enable-disable.txtar
+++ b/acceptance/testdata/workflow/workflow-enable-disable.txtar
@@ -63,4 +63,4 @@ jobs:
 
       # Runs a single command using the runners shell
       - name: Run a one-line script
-        run: sleep 10
+        run: echo Hello, world!
diff --git a/acceptance/testdata/workflow/workflow-list.txtar b/acceptance/testdata/workflow/workflow-list.txtar
index 8cd211de0..ad0d87c88 100644
--- a/acceptance/testdata/workflow/workflow-list.txtar
+++ b/acceptance/testdata/workflow/workflow-list.txtar
@@ -49,4 +49,4 @@ jobs:
 
       # Runs a single command using the runners shell
       - name: Run a one-line script
-        run: sleep 10
+        run: echo Hello, world!
diff --git a/acceptance/testdata/workflow/workflow-view.txtar b/acceptance/testdata/workflow/workflow-view.txtar
index 0783e7fac..d3bc3d252 100644
--- a/acceptance/testdata/workflow/workflow-view.txtar
+++ b/acceptance/testdata/workflow/workflow-view.txtar
@@ -49,4 +49,4 @@ jobs:
 
       # Runs a single command using the runners shell
       - name: Run a one-line script
-        run: sleep 10
+        run: echo Hello, world!

From 07ea43ae5ab6b987ad0123b8d7f53553e1addc3f Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 15:09:27 +0200
Subject: [PATCH 205/301] Remove empty stdout checks

---
 acceptance/testdata/workflow/cache-list-delete.txtar | 3 +--
 acceptance/testdata/workflow/run-delete.txtar        | 2 +-
 acceptance/testdata/workflow/run-download.txtar      | 3 +--
 acceptance/testdata/workflow/run-rerun.txtar         | 1 -
 4 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/acceptance/testdata/workflow/cache-list-delete.txtar b/acceptance/testdata/workflow/cache-list-delete.txtar
index aa1dc91a7..6a99f4bc2 100644
--- a/acceptance/testdata/workflow/cache-list-delete.txtar
+++ b/acceptance/testdata/workflow/cache-list-delete.txtar
@@ -44,7 +44,6 @@ stdout 'Linux-values'
 
 # Delete the cache
 exec gh cache delete 'Linux-values'
-stdout ''
 
 -- workflow.yml --
 name: Test Workflow Name
@@ -67,4 +66,4 @@ jobs:
 
     - name: Generate values file
       if: steps.cache-values.outputs.cache-hit != 'true'
-      run: echo "values" > values.txt
\ No newline at end of file
+      run: echo "values" > values.txt
diff --git a/acceptance/testdata/workflow/run-delete.txtar b/acceptance/testdata/workflow/run-delete.txtar
index 45b11f2d1..72d098740 100644
--- a/acceptance/testdata/workflow/run-delete.txtar
+++ b/acceptance/testdata/workflow/run-delete.txtar
@@ -45,7 +45,7 @@ stdout '✓ Request to delete workflow submitted.'
 # It takes some time for a workflow run to be deleted
 sleep 5
 
-# Check the workflow run is cancelled
+# Check the workflow run is cancelled, which is implied by an empty list
 exec gh run list
 stdout ''
 
diff --git a/acceptance/testdata/workflow/run-download.txtar b/acceptance/testdata/workflow/run-download.txtar
index a8faaacec..dc0446598 100644
--- a/acceptance/testdata/workflow/run-download.txtar
+++ b/acceptance/testdata/workflow/run-download.txtar
@@ -40,7 +40,6 @@ exec gh run watch $RUN_ID --exit-status
 
 # Download the artifact
 exec gh run download $RUN_ID
-stdout '' 
 
 # Check if we downloaded the artifact
 exists ./my-artifact/world.txt
@@ -69,4 +68,4 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: my-artifact
-          path: world.txt
\ No newline at end of file
+          path: world.txt
diff --git a/acceptance/testdata/workflow/run-rerun.txtar b/acceptance/testdata/workflow/run-rerun.txtar
index 273a4adea..446aabbc4 100644
--- a/acceptance/testdata/workflow/run-rerun.txtar
+++ b/acceptance/testdata/workflow/run-rerun.txtar
@@ -40,7 +40,6 @@ exec gh run watch $RUN_ID --exit-status
 
 # Rerun the workflow run
 exec gh run rerun $RUN_ID
-stdout ''
 
 # It takes some time for a workflow run to register
 sleep 10

From dc3e805078d6c043a2bccff29a8b3aca8ebc507e Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 15:11:45 +0200
Subject: [PATCH 206/301] Remove unnecesary mkdir from download Acceptance test

---
 acceptance/testdata/workflow/run-download.txtar | 1 -
 1 file changed, 1 deletion(-)

diff --git a/acceptance/testdata/workflow/run-download.txtar b/acceptance/testdata/workflow/run-download.txtar
index dc0446598..653fdbef5 100644
--- a/acceptance/testdata/workflow/run-download.txtar
+++ b/acceptance/testdata/workflow/run-download.txtar
@@ -63,7 +63,6 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - run: mkdir -p path/to/artifact
       - run: echo hello > world.txt
       - uses: actions/upload-artifact@v4
         with:

From 06c20f3a8b00916631a6eeb1bc23b1f2b795b0d1 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 16 Oct 2024 10:31:20 -0600
Subject: [PATCH 207/301] Implement basic API acceptance test

---
 acceptance/acceptance_test.go               | 9 +++++++++
 acceptance/testdata/api/basic-graphql.txtar | 3 +++
 acceptance/testdata/api/basic-rest.txtar    | 3 +++
 3 files changed, 15 insertions(+)
 create mode 100644 acceptance/testdata/api/basic-graphql.txtar
 create mode 100644 acceptance/testdata/api/basic-rest.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 0c98271ca..3040ce9b2 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -55,6 +55,15 @@ func TestWorkflows(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
 }
 
+func TestAPI(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "api"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/api/basic-graphql.txtar b/acceptance/testdata/api/basic-graphql.txtar
new file mode 100644
index 000000000..15c16c49c
--- /dev/null
+++ b/acceptance/testdata/api/basic-graphql.txtar
@@ -0,0 +1,3 @@
+# Basic graphql request
+exec gh api graphql -f query='query { viewer { login } }'
+stdout '"login":'
\ No newline at end of file
diff --git a/acceptance/testdata/api/basic-rest.txtar b/acceptance/testdata/api/basic-rest.txtar
new file mode 100644
index 000000000..58d3b7570
--- /dev/null
+++ b/acceptance/testdata/api/basic-rest.txtar
@@ -0,0 +1,3 @@
+# Basic REST request
+exec gh api /user
+stdout '"login":'
\ No newline at end of file

From a009933a166b022613e1f98c8951bcd3e7ec96b4 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Wed, 16 Oct 2024 11:03:50 -0600
Subject: [PATCH 208/301] Add acceptance tests for `release` commands

---
 acceptance/acceptance_test.go                 | 12 +++++++--
 acceptance/testdata/release/create.txtar      | 12 +++++++++
 acceptance/testdata/release/list.txtar        | 16 ++++++++++++
 .../testdata/release/upload-download.txtar    | 25 +++++++++++++++++++
 acceptance/testdata/release/view.txtar        | 16 ++++++++++++
 5 files changed, 79 insertions(+), 2 deletions(-)
 create mode 100644 acceptance/testdata/release/create.txtar
 create mode 100644 acceptance/testdata/release/list.txtar
 create mode 100644 acceptance/testdata/release/upload-download.txtar
 create mode 100644 acceptance/testdata/release/view.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 3040ce9b2..51e96778a 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -48,8 +48,7 @@ func TestIssues(t *testing.T) {
 func TestWorkflows(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
+		t.Fatal(err)
 	}
 
 	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
@@ -64,6 +63,15 @@ func TestAPI(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "api"))
 }
 
+func TestReleases(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/release/create.txtar b/acceptance/testdata/release/create.txtar
new file mode 100644
index 000000000..3bdafe769
--- /dev/null
+++ b/acceptance/testdata/release/create.txtar
@@ -0,0 +1,12 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a release in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh release create v1.2.3 --notes 'awesome release' --latest
diff --git a/acceptance/testdata/release/list.txtar b/acceptance/testdata/release/list.txtar
new file mode 100644
index 000000000..844b25daa
--- /dev/null
+++ b/acceptance/testdata/release/list.txtar
@@ -0,0 +1,16 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a release in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh release create v1.2.3 --notes 'awesome release' --latest
+
+# List the releases
+exec gh release list
+stdout 'v1.2.3'
\ No newline at end of file
diff --git a/acceptance/testdata/release/upload-download.txtar b/acceptance/testdata/release/upload-download.txtar
new file mode 100644
index 000000000..92bfa4c71
--- /dev/null
+++ b/acceptance/testdata/release/upload-download.txtar
@@ -0,0 +1,25 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a release in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh release create v1.2.3 --notes 'awesome release' --latest
+
+# Upload an asset to the release
+exec gh release upload v1.2.3 ../asset.txt
+stdout ''
+
+# Download the asset from the release
+exec gh release download v1.2.3
+exists asset.txt
+exec gh release download v1.2.3 --archive=zip
+exists $SCRIPT_NAME-$RANDOM_STRING-1.2.3.zip
+
+-- asset.txt --
+Hello, world!
\ No newline at end of file
diff --git a/acceptance/testdata/release/view.txtar b/acceptance/testdata/release/view.txtar
new file mode 100644
index 000000000..a7138812a
--- /dev/null
+++ b/acceptance/testdata/release/view.txtar
@@ -0,0 +1,16 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a release in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh release create v1.2.3 --notes 'awesome release' --latest
+
+# View the release
+exec gh release view v1.2.3
+stdout 'v1.2.3'
\ No newline at end of file

From 473faea5739a7b8dfd39740d74c0b83780c18c05 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Thu, 17 Oct 2024 07:43:21 -0600
Subject: [PATCH 209/301] Rename test files

---
 .../testdata/release/{create.txtar => release-create.txtar}       | 0
 acceptance/testdata/release/{list.txtar => release-list.txtar}    | 0
 .../{upload-download.txtar => release-upload-download.txtar}      | 0
 acceptance/testdata/release/{view.txtar => release-view.txtar}    | 0
 4 files changed, 0 insertions(+), 0 deletions(-)
 rename acceptance/testdata/release/{create.txtar => release-create.txtar} (100%)
 rename acceptance/testdata/release/{list.txtar => release-list.txtar} (100%)
 rename acceptance/testdata/release/{upload-download.txtar => release-upload-download.txtar} (100%)
 rename acceptance/testdata/release/{view.txtar => release-view.txtar} (100%)

diff --git a/acceptance/testdata/release/create.txtar b/acceptance/testdata/release/release-create.txtar
similarity index 100%
rename from acceptance/testdata/release/create.txtar
rename to acceptance/testdata/release/release-create.txtar
diff --git a/acceptance/testdata/release/list.txtar b/acceptance/testdata/release/release-list.txtar
similarity index 100%
rename from acceptance/testdata/release/list.txtar
rename to acceptance/testdata/release/release-list.txtar
diff --git a/acceptance/testdata/release/upload-download.txtar b/acceptance/testdata/release/release-upload-download.txtar
similarity index 100%
rename from acceptance/testdata/release/upload-download.txtar
rename to acceptance/testdata/release/release-upload-download.txtar
diff --git a/acceptance/testdata/release/view.txtar b/acceptance/testdata/release/release-view.txtar
similarity index 100%
rename from acceptance/testdata/release/view.txtar
rename to acceptance/testdata/release/release-view.txtar

From 24fc2db39590bf92e0ff6df85d8609e33ec48c6f Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 17 Oct 2024 15:54:50 +0200
Subject: [PATCH 210/301] Remove stdout assertion from release

---
 acceptance/testdata/release/release-upload-download.txtar | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/acceptance/testdata/release/release-upload-download.txtar b/acceptance/testdata/release/release-upload-download.txtar
index 92bfa4c71..e19bc06d7 100644
--- a/acceptance/testdata/release/release-upload-download.txtar
+++ b/acceptance/testdata/release/release-upload-download.txtar
@@ -13,13 +13,14 @@ exec gh release create v1.2.3 --notes 'awesome release' --latest
 
 # Upload an asset to the release
 exec gh release upload v1.2.3 ../asset.txt
-stdout ''
 
 # Download the asset from the release
 exec gh release download v1.2.3
 exists asset.txt
+
+# Download the asset in archive form
 exec gh release download v1.2.3 --archive=zip
 exists $SCRIPT_NAME-$RANDOM_STRING-1.2.3.zip
 
 -- asset.txt --
-Hello, world!
\ No newline at end of file
+Hello, world!

From b1792403beae6e96c0638a3b1b383636ef62b74b Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 10:09:08 -0400
Subject: [PATCH 211/301] Add testscripts for `gh secret`, helper cmds

These are initial testscripts for confidence around core `gh secret` subcommands around 1) repository, 2) repository environment, 3) organization secrets.

Each testscript exercises the 3 core subcommands of `gh secret`: 1) setting, 2) listing, and 3) deleting each type of secret.

Note should be made that repository environments do not exist for free accounts such as `gh-acceptance-testing`.
---
 acceptance/acceptance_test.go                 | 29 +++++++++++++++++++
 acceptance/testdata/secret/secret-org.txtar   | 16 ++++++++++
 .../testdata/secret/secret-repo-env.txtar     | 28 ++++++++++++++++++
 acceptance/testdata/secret/secret-repo.txtar  | 24 +++++++++++++++
 4 files changed, 97 insertions(+)
 create mode 100644 acceptance/testdata/secret/secret-org.txtar
 create mode 100644 acceptance/testdata/secret/secret-repo-env.txtar
 create mode 100644 acceptance/testdata/secret/secret-repo.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 5b4fe7b58..7c135abfe 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -43,6 +43,15 @@ func TestIssues(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
 }
 
+func TestSecrets(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "secret"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
@@ -117,6 +126,26 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				}
 			})
 		},
+		"env2lower": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! env2lower")
+			}
+			if len(args) != 2 {
+				ts.Fatalf("usage: env2lower old new")
+			}
+
+			ts.Setenv(args[1], strings.ToLower(ts.Getenv(args[0])))
+		},
+		"env2upper": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! env2upper")
+			}
+			if len(args) != 2 {
+				ts.Fatalf("usage: env2upper old new")
+			}
+
+			ts.Setenv(args[1], strings.ToUpper(ts.Getenv(args[0])))
+		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! stdout2env")
diff --git a/acceptance/testdata/secret/secret-org.txtar b/acceptance/testdata/secret/secret-org.txtar
new file mode 100644
index 000000000..9d28ff428
--- /dev/null
+++ b/acceptance/testdata/secret/secret-org.txtar
@@ -0,0 +1,16 @@
+# Prepare organization secret, GitHub Actions uppercases secret names
+env2upper RANDOM_STRING ORG_SECRET_NAME
+
+# Confirm organization secret does not exist, will fail admin:org scope missing
+! exec gh api /orgs/$ORG/actions/secrets/$ORG_SECRET_NAME
+stdout '"status":"404"'
+
+# Create an organization secret
+exec gh secret set $ORG_SECRET_NAME --org $ORG --body 'does not matter as cannot read it once set'
+
+# Defer organization secret cleanup
+defer gh secret delete $ORG_SECRET_NAME --org $ORG
+
+# Confirm organization secret exists
+exec gh secret list --org $ORG
+stdout $ORG_SECRET_NAME
diff --git a/acceptance/testdata/secret/secret-repo-env.txtar b/acceptance/testdata/secret/secret-repo-env.txtar
new file mode 100644
index 000000000..2a8972b37
--- /dev/null
+++ b/acceptance/testdata/secret/secret-repo-env.txtar
@@ -0,0 +1,28 @@
+# Force GitHub CLI to treat testscript as TTY
+env GH_FORCE_TTY=80
+
+# Create a repository where the secret will be registered
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+cd $SCRIPT_NAME-$RANDOM_STRING
+
+# Create a repository environment
+exec gh api /repos/$ORG/$SCRIPT_NAME-$RANDOM_STRING/environments/testscripts -X PUT --jq '.name'
+stdout 'testscripts'
+
+# Verify no repository environment secrets exist
+exec gh secret list --env testscripts
+stderr 'no secrets found'
+
+# Create a repository environment secret
+exec gh secret set TESTSCRIPTS_ENV --env testscripts --body 'does not matter as cannot read it once set'
+stdout 'Set Actions secret TESTSCRIPTS_ENV for'
+
+# Verify new repository secret exists
+exec gh secret list --env testscripts
+stdout 'TESTSCRIPTS_ENV\s+less than a minute ago'
diff --git a/acceptance/testdata/secret/secret-repo.txtar b/acceptance/testdata/secret/secret-repo.txtar
new file mode 100644
index 000000000..d2c0a31c2
--- /dev/null
+++ b/acceptance/testdata/secret/secret-repo.txtar
@@ -0,0 +1,24 @@
+# Setup environment variables to force TTY
+env GH_FORCE_TTY=80
+
+# Create a repository where the secret will be registered
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Verify no repository secrets exist
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh secret list
+stderr 'no secrets found'
+
+# Create a repository secret
+exec gh secret set TESTSCRIPTS --body 'does not matter as cannot read it once set'
+stdout 'Set Actions secret TESTSCRIPTS for'
+
+# Verify new repository secret exists
+exec gh secret list
+stdout 'TESTSCRIPTS\s+less than a minute ago'

From 5bbe69b1d11c3898f4a77ca02b30f82cc65f55fe Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 10:11:50 -0400
Subject: [PATCH 212/301] Update secret note about potential failure

Environments are only supported for GitHub Actions with certain plans; `gh-acceptance-testing` at this time does not have this support.
---
 acceptance/testdata/secret/secret-repo-env.txtar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/testdata/secret/secret-repo-env.txtar b/acceptance/testdata/secret/secret-repo-env.txtar
index 2a8972b37..aba0994c8 100644
--- a/acceptance/testdata/secret/secret-repo-env.txtar
+++ b/acceptance/testdata/secret/secret-repo-env.txtar
@@ -11,7 +11,7 @@ defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
 cd $SCRIPT_NAME-$RANDOM_STRING
 
-# Create a repository environment
+# Create a repository environment, will fail if organization does not have environment support
 exec gh api /repos/$ORG/$SCRIPT_NAME-$RANDOM_STRING/environments/testscripts -X PUT --jq '.name'
 stdout 'testscripts'
 

From 7c534e60109756c0f2bafa988cc388f9fe37ccc0 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 10:49:17 -0400
Subject: [PATCH 213/301] Refactor env2upper, env2lower; add docs

This commit refactors 2 new custom commands to work more like the native env command, allowing for multiple environment variables to be set.

Additionally, the documentation on acceptance tests have been expanded to list out custom commands.
---
 acceptance/README.md                        | 33 +++++++++++++++++++++
 acceptance/acceptance_test.go               | 26 ++++++++++++----
 acceptance/testdata/secret/secret-org.txtar |  2 +-
 3 files changed, 54 insertions(+), 7 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index a1cd3f216..98f179f2c 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -61,6 +61,39 @@ The following custom environment variables are made available to the scripts:
  * `HOME`: Set to the initial working directory. Required for `git` operations
  * `GH_CONFIG_DIR`: Set to the initial working directory. Required for `gh` operations
 
+#### Custom Commands
+
+The following custom commands are defined within [`acceptance_test.go`](./acceptance_test.go) to help with writing tests:
+
+- `defer`: register a command to run after the testscript completes
+
+  ```txtar
+  # Defer repo cleanup
+  defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+  ```
+
+- `env2lower`: set environment variable to the lowercase version of another environment variable
+
+  ```txtar
+  # Prepare repository name, which is only lowercase
+  env2lower REPO_NAME=$RANDOM_STRING
+  ```
+
+- `env2uooer`: set environment variable to the uppercase version of another environment variable
+
+  ```txtar
+  # Prepare organization secret, GitHub Actions uppercases secret names
+  env2upper ORG_SECRET_NAME=$RANDOM_STRING
+  ```
+
+- `stdout2env`: set environment variable containing standard output from previous command
+
+  ```txtar
+  # Create the PR
+  exec gh pr create --title 'Feature Title' --body 'Feature Body' --assignee '@me' --label 'bug'
+  stdout2env PR_URL
+  ```
+
 ### Acceptance Test VS Code Support
 
 Due to the `//go:build acceptance` build constraint, some functionality is limited because `gopls` isn't being informed about the tag. To resolve this, set the following in your `settings.json`:
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 7c135abfe..35ea7b40b 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -130,21 +130,35 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 			if neg {
 				ts.Fatalf("unsupported: ! env2lower")
 			}
-			if len(args) != 2 {
-				ts.Fatalf("usage: env2lower old new")
+			if len(args) == 0 {
+				ts.Fatalf("usage: env2lower name=value ...")
 			}
+			for _, env := range args {
+				i := strings.Index(env, "=")
 
-			ts.Setenv(args[1], strings.ToLower(ts.Getenv(args[0])))
+				if i < 0 {
+					ts.Fatalf("env2lower: argument does not match name=value")
+				}
+
+				ts.Setenv(env[:i], strings.ToLower(env[i+1:]))
+			}
 		},
 		"env2upper": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! env2upper")
 			}
-			if len(args) != 2 {
-				ts.Fatalf("usage: env2upper old new")
+			if len(args) == 0 {
+				ts.Fatalf("usage: env2upper name=value ...")
 			}
+			for _, env := range args {
+				i := strings.Index(env, "=")
 
-			ts.Setenv(args[1], strings.ToUpper(ts.Getenv(args[0])))
+				if i < 0 {
+					ts.Fatalf("env2upper: argument does not match name=value")
+				}
+
+				ts.Setenv(env[:i], strings.ToUpper(env[i+1:]))
+			}
 		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
diff --git a/acceptance/testdata/secret/secret-org.txtar b/acceptance/testdata/secret/secret-org.txtar
index 9d28ff428..d6d2fd213 100644
--- a/acceptance/testdata/secret/secret-org.txtar
+++ b/acceptance/testdata/secret/secret-org.txtar
@@ -1,5 +1,5 @@
 # Prepare organization secret, GitHub Actions uppercases secret names
-env2upper RANDOM_STRING ORG_SECRET_NAME
+env2upper ORG_SECRET_NAME=$RANDOM_STRING
 
 # Confirm organization secret does not exist, will fail admin:org scope missing
 ! exec gh api /orgs/$ORG/actions/secrets/$ORG_SECRET_NAME

From e91052dd9b42c8934cec08147893c9eb76f2cd3b Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 10:59:54 -0400
Subject: [PATCH 214/301] Fix typo in custom command doc

---
 acceptance/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 98f179f2c..732369bc0 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -79,7 +79,7 @@ The following custom commands are defined within [`acceptance_test.go`](./accept
   env2lower REPO_NAME=$RANDOM_STRING
   ```
 
-- `env2uooer`: set environment variable to the uppercase version of another environment variable
+- `env2upper`: set environment variable to the uppercase version of another environment variable
 
   ```txtar
   # Prepare organization secret, GitHub Actions uppercases secret names

From e33511370670bcfad7bfe01523d5c64b17a7cda3 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 16:02:39 -0400
Subject: [PATCH 215/301] Minor polish / consistency

---
 acceptance/testdata/secret/secret-repo-env.txtar | 11 ++++++-----
 acceptance/testdata/secret/secret-repo.txtar     | 11 ++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/acceptance/testdata/secret/secret-repo-env.txtar b/acceptance/testdata/secret/secret-repo-env.txtar
index aba0994c8..b5236ea92 100644
--- a/acceptance/testdata/secret/secret-repo-env.txtar
+++ b/acceptance/testdata/secret/secret-repo-env.txtar
@@ -1,18 +1,19 @@
 # Force GitHub CLI to treat testscript as TTY
 env GH_FORCE_TTY=80
+env REPO=$SCRIPT_NAME-$RANDOM_STRING
 
 # Create a repository where the secret will be registered
-exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+exec gh repo create $ORG/$REPO --add-readme --private
 
 # Defer repo cleanup
-defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+defer gh repo delete --yes $ORG/$REPO
 
 # Clone the repo
-exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
-cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh repo clone $ORG/$REPO
+cd $REPO
 
 # Create a repository environment, will fail if organization does not have environment support
-exec gh api /repos/$ORG/$SCRIPT_NAME-$RANDOM_STRING/environments/testscripts -X PUT --jq '.name'
+exec gh api /repos/$ORG/$REPO/environments/testscripts -X PUT --jq '.name'
 stdout 'testscripts'
 
 # Verify no repository environment secrets exist
diff --git a/acceptance/testdata/secret/secret-repo.txtar b/acceptance/testdata/secret/secret-repo.txtar
index d2c0a31c2..f69a06e57 100644
--- a/acceptance/testdata/secret/secret-repo.txtar
+++ b/acceptance/testdata/secret/secret-repo.txtar
@@ -1,17 +1,18 @@
-# Setup environment variables to force TTY
+# Force GitHub CLI to treat testscript as TTY
 env GH_FORCE_TTY=80
+env REPO=$SCRIPT_NAME-$RANDOM_STRING
 
 # Create a repository where the secret will be registered
-exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+exec gh repo create $ORG/$REPO --add-readme --private
 
 # Defer repo cleanup
-defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+defer gh repo delete --yes $ORG/$REPO
 
 # Clone the repo
-exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+exec gh repo clone $ORG/$REPO
+cd $REPO
 
 # Verify no repository secrets exist
-cd $SCRIPT_NAME-$RANDOM_STRING
 exec gh secret list
 stderr 'no secrets found'
 

From b4be8cbf9dfeed652f96f0ba95317742f637d72b Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 16:01:48 -0400
Subject: [PATCH 216/301] Add acceptance tests for `gh variable`

---
 .../testdata/variable/variable-org.txtar      | 20 +++++++++++
 .../testdata/variable/variable-repo-env.txtar | 33 +++++++++++++++++++
 .../testdata/variable/variable-repo.txtar     | 29 ++++++++++++++++
 3 files changed, 82 insertions(+)
 create mode 100644 acceptance/testdata/variable/variable-org.txtar
 create mode 100644 acceptance/testdata/variable/variable-repo-env.txtar
 create mode 100644 acceptance/testdata/variable/variable-repo.txtar

diff --git a/acceptance/testdata/variable/variable-org.txtar b/acceptance/testdata/variable/variable-org.txtar
new file mode 100644
index 000000000..370e63b0d
--- /dev/null
+++ b/acceptance/testdata/variable/variable-org.txtar
@@ -0,0 +1,20 @@
+# Prepare organization variable, GitHub Actions uppercases names
+env2upper ORG_VARIABLE_NAME=$RANDOM_STRING
+
+# Confirm organization variable does not exist, will fail admin:org scope missing
+! exec gh variable get $ORG_VARIABLE_NAME --org $ORG
+stderr 'variable .+ was not found'
+
+# Create an organization variable
+exec gh variable set $ORG_VARIABLE_NAME --org $ORG --body 'just an org variable'
+
+# Defer organization variable cleanup
+defer gh variable delete $ORG_VARIABLE_NAME --org $ORG
+
+# Confirm organization variable exists
+exec gh variable list --org $ORG
+stdout $ORG_VARIABLE_NAME
+
+# Verify repository environment variable can be retrieved
+exec gh variable get $ORG_VARIABLE_NAME --org $ORG
+stdout 'just an org variable'
diff --git a/acceptance/testdata/variable/variable-repo-env.txtar b/acceptance/testdata/variable/variable-repo-env.txtar
new file mode 100644
index 000000000..f4b11c3dd
--- /dev/null
+++ b/acceptance/testdata/variable/variable-repo-env.txtar
@@ -0,0 +1,33 @@
+# Force GitHub CLI to treat testscript as TTY
+env GH_FORCE_TTY=80
+env REPO=$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a repository where the variable will be registered
+exec gh repo create $ORG/$REPO --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$REPO
+
+# Clone the repo
+exec gh repo clone $ORG/$REPO
+cd $REPO
+
+# Create a repository environment, will fail if organization does not have environment support
+exec gh api /repos/$ORG/$REPO/environments/testscripts -X PUT --jq '.name'
+stdout 'testscripts'
+
+# Verify no repository environment variables exist
+exec gh variable list --env testscripts
+stderr 'no variables found'
+
+# Create a repository environment variable
+exec gh variable set TESTSCRIPTS_ENV --env testscripts --body 'just a repo env variable'
+stdout 'Created variable TESTSCRIPTS_ENV for'
+
+# Verify new repository environment variable exists
+exec gh variable list --env testscripts
+stdout 'TESTSCRIPTS_ENV\s+just a repo env variable\s+less than a minute ago'
+
+# Verify repository environment variable can be retrieved
+exec gh variable get TESTSCRIPTS_ENV --env testscripts
+stdout 'just a repo env variable'
diff --git a/acceptance/testdata/variable/variable-repo.txtar b/acceptance/testdata/variable/variable-repo.txtar
new file mode 100644
index 000000000..f6295b566
--- /dev/null
+++ b/acceptance/testdata/variable/variable-repo.txtar
@@ -0,0 +1,29 @@
+# Setup environment variables to force TTY
+env GH_FORCE_TTY=80
+env REPO=$SCRIPT_NAME-$RANDOM_STRING
+
+# Create a repository where the variable will be registered
+exec gh repo create $ORG/$REPO --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$REPO
+
+# Clone the repo
+exec gh repo clone $ORG/$REPO
+cd $REPO
+
+# Verify no repository variables exist
+exec gh variable list
+stderr 'no variables found'
+
+# Create a repository variable
+exec gh variable set TESTSCRIPTS --body 'just a repo variable'
+stdout 'Created variable TESTSCRIPTS for'
+
+# Verify new repository variable exists
+exec gh variable list
+stdout 'TESTSCRIPTS\s+just a repo variable\s+less than a minute ago'
+
+# Verify repository variable can be retrieved
+exec gh variable get TESTSCRIPTS
+stdout 'just a repo variable'

From e8842f861fb54570a0bcaf2178eaa172653743f9 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 17 Oct 2024 16:03:15 -0400
Subject: [PATCH 217/301] Add missing test to trigger acceptance tests

---
 acceptance/acceptance_test.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 35ea7b40b..ef8e85ddc 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -52,6 +52,15 @@ func TestSecrets(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "secret"))
 }
 
+func TestVariables(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "variable"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {

From 13ab02729bd1b38c12d65199bbe57a6528bd2b99 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 14:40:17 -0700
Subject: [PATCH 218/301] Clean up Title Survey empty title message code

---
 pkg/cmd/pr/shared/survey.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/cmd/pr/shared/survey.go b/pkg/cmd/pr/shared/survey.go
index 3d53be4c7..ce38535d9 100644
--- a/pkg/cmd/pr/shared/survey.go
+++ b/pkg/cmd/pr/shared/survey.go
@@ -119,9 +119,7 @@ func TitleSurvey(p Prompt, io *iostreams.IOStreams, state *IssueMetadataState) e
 			return err
 		}
 		if result == "" {
-			colorizeRed := io.ColorScheme().ColorFromString("red")
-			msg := fmt.Sprintf("%s Title cannot be blank.", colorizeRed("X"))
-			fmt.Fprintln(io.ErrOut, msg)
+			fmt.Fprintf(io.ErrOut, "%s Title cannot be blank\n", io.ColorScheme().FailureIcon())
 		}
 	}
 

From 14acbe00a93106cccb70cfd3c5fb290618d21866 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 14:45:35 -0700
Subject: [PATCH 219/301] Remove . from test case for TestTitleSurvey

---
 pkg/cmd/pr/shared/survey_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/pr/shared/survey_test.go b/pkg/cmd/pr/shared/survey_test.go
index 0e62e0e5a..d74696460 100644
--- a/pkg/cmd/pr/shared/survey_test.go
+++ b/pkg/cmd/pr/shared/survey_test.go
@@ -194,7 +194,7 @@ func TestTitleSurvey(t *testing.T) {
 			assert.NoError(t, err)
 			assert.Equal(t, tt.expectedTitle, state.Title)
 			if tt.expectStderr {
-				assert.Equal(t, "X Title cannot be blank.\n", stderr.String())
+				assert.Equal(t, "X Title cannot be blank\n", stderr.String())
 			}
 		})
 	}

From b361cf4495230fb9f348622b59551ab22be286c3 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Fri, 18 Oct 2024 10:17:34 -0600
Subject: [PATCH 220/301] Implement acceptance tests for search commands

---
 acceptance/acceptance_test.go                 |  9 +++++++++
 .../testdata/search/search-issues.txtar       | 19 +++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 acceptance/testdata/search/search-issues.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 51e96778a..750dadd76 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -72,6 +72,15 @@ func TestReleases(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
 }
 
+func TestSearches(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "search"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/search/search-issues.txtar b/acceptance/testdata/search/search-issues.txtar
new file mode 100644
index 000000000..e41bc1eb6
--- /dev/null
+++ b/acceptance/testdata/search/search-issues.txtar
@@ -0,0 +1,19 @@
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Create an issue in the repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh issue create --title 'Feature Request' --body 'Feature Body $RANDOM_STRING'
+
+# It takes some time for the issue to be created and indexed
+sleep 5
+
+# Search for the issue
+exec gh search issues 'Feature Body $RANDOM_STRING' -R $ORG/$SCRIPT_NAME-$RANDOM_STRING
+stdout 'Feature Request'
\ No newline at end of file

From 18428671c3795504d15d8fa01199db595c2d3c0e Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Wed, 16 Oct 2024 15:14:18 -0700
Subject: [PATCH 221/301] Added test function for repos and repo-create test

---
 acceptance/acceptance_test.go                    |  8 ++++++++
 acceptance/testdata/repos/repo-create-view.txtar | 12 ++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-create-view.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 51e96778a..366d88cf4 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -72,6 +72,14 @@ func TestReleases(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
 }
 
+func TestRepos(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+	testscript.Run(t, testScriptParamsFor(tsEnv, "repos"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/repos/repo-create-view.txtar b/acceptance/testdata/repos/repo-create-view.txtar
new file mode 100644
index 000000000..b5b85f593
--- /dev/null
+++ b/acceptance/testdata/repos/repo-create-view.txtar
@@ -0,0 +1,12 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Check that the repo exists
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
+stdout $SCRIPT_NAME-$RANDOM_STRING
\ No newline at end of file

From 83cbdc4f3686cbfd1500ce71820d2e23997bcdee Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Wed, 16 Oct 2024 15:28:38 -0700
Subject: [PATCH 222/301] Added acceptance test for repo-delete

---
 acceptance/testdata/repos/repo-delete.txtar | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-delete.txtar

diff --git a/acceptance/testdata/repos/repo-delete.txtar b/acceptance/testdata/repos/repo-delete.txtar
new file mode 100644
index 000000000..855473ae9
--- /dev/null
+++ b/acceptance/testdata/repos/repo-delete.txtar
@@ -0,0 +1,16 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Check that the repo exists
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
+stdout $SCRIPT_NAME-$RANDOM_STRING
+
+# Delete the repo
+exec gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Ensure that the repo was deleted
+! exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
+stderr 'Could not resolve to a Repository with the name'
\ No newline at end of file

From 60e20ee5312b4caa9ce3e98b633bf974b949b863 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 08:51:51 -0700
Subject: [PATCH 223/301] Add acceptance test for repo-clone

---
 acceptance/testdata/repos/repo-clone.txtar | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-clone.txtar

diff --git a/acceptance/testdata/repos/repo-clone.txtar b/acceptance/testdata/repos/repo-clone.txtar
new file mode 100644
index 000000000..f0bad8e01
--- /dev/null
+++ b/acceptance/testdata/repos/repo-clone.txtar
@@ -0,0 +1,15 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Ensure the repo was cloned
+exec ls $SCRIPT_NAME-$RANDOM_STRING
+stdout README.md
\ No newline at end of file

From 0c632d7c4eada9577449921c87c2cb7c340b9071 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 09:43:50 -0700
Subject: [PATCH 224/301] Acceptance testing for repo-archive and
 repo-unarchive

---
 .../repos/repo-archive-unarchive.txtar        | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-archive-unarchive.txtar

diff --git a/acceptance/testdata/repos/repo-archive-unarchive.txtar b/acceptance/testdata/repos/repo-archive-unarchive.txtar
new file mode 100644
index 000000000..d72b36906
--- /dev/null
+++ b/acceptance/testdata/repos/repo-archive-unarchive.txtar
@@ -0,0 +1,26 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Check that the repo exists and isn't archived
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
+stdout false
+
+# Archive the repo
+exec gh repo archive $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
+
+# Check that the repo is archived
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
+stdout true
+
+# Unarchive the repo
+exec gh repo unarchive $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
+
+# Check that the repo is unarchived
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
+stdout false
\ No newline at end of file

From fb6f7733c4974524b25d6b7d66075e0d002a8a8c Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 09:58:59 -0700
Subject: [PATCH 225/301] Add acceptance tests for repo-list and repo-rename

---
 .../testdata/repos/repo-list-rename.txtar     | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-list-rename.txtar

diff --git a/acceptance/testdata/repos/repo-list-rename.txtar b/acceptance/testdata/repos/repo-list-rename.txtar
new file mode 100644
index 000000000..e758ac7fd
--- /dev/null
+++ b/acceptance/testdata/repos/repo-list-rename.txtar
@@ -0,0 +1,24 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# List the repos and check for the new repo
+exec gh repo list $ORG --json name --jq '.[].name'
+stdout $SCRIPT_NAME-$RANDOM_STRING
+
+# Rename the repo
+exec gh repo rename $SCRIPT_NAME-$RANDOM_STRING-renamed --repo=$ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
+
+# List the repos and check for the renamed repo
+exec gh repo list $ORG --json name --jq '.[].name'
+stdout $SCRIPT_NAME-$RANDOM_STRING-renamed
+
+# Delete the renamed repo
+exec gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING-renamed --yes
+
+# List the repos and check for the deleted repo
+exec gh repo list $ORG --json name --jq '.[].name'
+! stdout $SCRIPT_NAME-$RANDOM_STRING-renamed
+

From c572edbfd797780426def51559b3e0fece1ff59e Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 10:08:14 -0700
Subject: [PATCH 226/301] Add acceptance test for repo-edit

---
 acceptance/testdata/repos/repo-edit.txtar | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-edit.txtar

diff --git a/acceptance/testdata/repos/repo-edit.txtar b/acceptance/testdata/repos/repo-edit.txtar
new file mode 100644
index 000000000..c8e293cc0
--- /dev/null
+++ b/acceptance/testdata/repos/repo-edit.txtar
@@ -0,0 +1,19 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Check that the repo description is empty
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json description --jq '.description'
+stdout ''
+
+# Edit the repo description
+exec gh repo edit $ORG/$SCRIPT_NAME-$RANDOM_STRING --description 'newDescription'
+
+# Check that the repo description is updated
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json description --jq '.description'
+stdout 'newDescription'
\ No newline at end of file

From 750813135635b79c99ac292414e22f7d56cb7bb0 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 10:27:20 -0700
Subject: [PATCH 227/301] Add acceptance test for repo-set-default

---
 .../testdata/repos/repo-set-default.txtar     | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-set-default.txtar

diff --git a/acceptance/testdata/repos/repo-set-default.txtar b/acceptance/testdata/repos/repo-set-default.txtar
new file mode 100644
index 000000000..f8c0e68c5
--- /dev/null
+++ b/acceptance/testdata/repos/repo-set-default.txtar
@@ -0,0 +1,23 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Clone the repo
+exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
+cd $SCRIPT_NAME-$RANDOM_STRING
+
+# Ensure that no default is set
+exec gh repo set-default --view
+stderr 'no default repository has been set; use `gh repo set-default` to select one'
+
+# Set the default
+exec gh repo set-default $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Check that the default is set
+exec gh repo set-default --view
+stdout $ORG/$SCRIPT_NAME-$RANDOM_STRING
\ No newline at end of file

From 96fa8534daa9832b34fa42d432e66298e2fd62a4 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 10:55:28 -0700
Subject: [PATCH 228/301] Add acceptance tests for repo-fork and repo-sync

---
 .../testdata/repos/repo-fork-sync.txtar       | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-fork-sync.txtar

diff --git a/acceptance/testdata/repos/repo-fork-sync.txtar b/acceptance/testdata/repos/repo-fork-sync.txtar
new file mode 100644
index 000000000..73beb39f1
--- /dev/null
+++ b/acceptance/testdata/repos/repo-fork-sync.txtar
@@ -0,0 +1,44 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create and clone a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private --clone
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# Fork and clone the repo
+exec gh repo fork $ORG/$SCRIPT_NAME-$RANDOM_STRING --org $ORG --fork-name $SCRIPT_NAME-$RANDOM_STRING-fork --clone
+
+# Defer fork cleanup
+defer gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING-fork --yes
+
+# Sleep so that the BE has time to sync
+sleep 5
+
+# Check that the repo was forked
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING-fork --json='isFork' --jq='.isFork'
+stdout true
+
+# Modify original repo
+cd $SCRIPT_NAME-$RANDOM_STRING
+mv ../asset.txt asset.txt
+exec git add .
+exec git commit -m 'Add asset.txt'
+exec git push
+
+# Checkout the forked repo and ensure asset.txt is not present
+cd ../$SCRIPT_NAME-$RANDOM_STRING-fork
+exec git checkout main
+exec ls
+! stdout asset.txt
+
+# Sync the forked repo with the original repo
+exec gh repo sync
+
+# Check that asset.txt now exists in the fork
+exec ls
+stdout asset.txt
+
+-- asset.txt --
+Hello, world!
\ No newline at end of file

From 95ed11d9babcd3dfa41d4e1d345ef343888078d7 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 11:55:32 -0700
Subject: [PATCH 229/301] Add acceptance tests for repo deploy-key
 add/list/delete

---
 .../testdata/repos/repo-deploy-key.txtar      | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 acceptance/testdata/repos/repo-deploy-key.txtar

diff --git a/acceptance/testdata/repos/repo-deploy-key.txtar b/acceptance/testdata/repos/repo-deploy-key.txtar
new file mode 100644
index 000000000..69c2efef8
--- /dev/null
+++ b/acceptance/testdata/repos/repo-deploy-key.txtar
@@ -0,0 +1,35 @@
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create and clone a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private --clone
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
+
+# cd to the repo and list the deploy keys. There should be no keys
+cd $SCRIPT_NAME-$RANDOM_STRING
+exec gh repo deploy-key list --json=title
+! stdout title
+
+# Add a deploy key
+exec gh repo deploy-key add ../deployKey.pub
+
+# Ensure the deploy key was added
+exec gh repo deploy-key list --json=title --jq='.[].title'
+stdout myTitle
+
+# Get the deploy key id
+exec gh repo deploy-key list --json=title,id --jq='.[].title="myTitle" | .[].id'
+stdout2env DEPLOY_KEY_ID
+
+# Delete the deploy key
+exec gh repo deploy-key delete $DEPLOY_KEY_ID
+
+# Ensure the deploy key was deleted
+exec gh repo deploy-key list --json=id --jq='.[].id'
+! stdout $DEPLOY_KEY_ID
+
+-- deployKey.pub --
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZmdeRNskfpvYL5YHB/YJaW8hTEXpnvPMkx5Ri+YwUr myTitle
+

From e7549c93f9c4069b30173320b007ca330ee9161d Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 17 Oct 2024 13:36:19 -0700
Subject: [PATCH 230/301] Cleanup some inconsistencies and improve collapse
 some functionality

---
 .../testdata/repos/repo-archive-unarchive.txtar   |  2 +-
 acceptance/testdata/repos/repo-clone.txtar        |  2 +-
 acceptance/testdata/repos/repo-create-view.txtar  |  4 ++--
 acceptance/testdata/repos/repo-delete.txtar       |  2 +-
 acceptance/testdata/repos/repo-deploy-key.txtar   |  1 -
 acceptance/testdata/repos/repo-edit.txtar         |  4 ++--
 acceptance/testdata/repos/repo-fork-sync.txtar    |  2 +-
 acceptance/testdata/repos/repo-list-rename.txtar  | 15 +++++----------
 acceptance/testdata/repos/repo-set-default.txtar  | 11 ++++-------
 9 files changed, 17 insertions(+), 26 deletions(-)

diff --git a/acceptance/testdata/repos/repo-archive-unarchive.txtar b/acceptance/testdata/repos/repo-archive-unarchive.txtar
index d72b36906..de1f7df9f 100644
--- a/acceptance/testdata/repos/repo-archive-unarchive.txtar
+++ b/acceptance/testdata/repos/repo-archive-unarchive.txtar
@@ -23,4 +23,4 @@ exec gh repo unarchive $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
 
 # Check that the repo is unarchived
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
-stdout false
\ No newline at end of file
+stdout false
diff --git a/acceptance/testdata/repos/repo-clone.txtar b/acceptance/testdata/repos/repo-clone.txtar
index f0bad8e01..5afc3ab0e 100644
--- a/acceptance/testdata/repos/repo-clone.txtar
+++ b/acceptance/testdata/repos/repo-clone.txtar
@@ -12,4 +12,4 @@ exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Ensure the repo was cloned
 exec ls $SCRIPT_NAME-$RANDOM_STRING
-stdout README.md
\ No newline at end of file
+stdout README.md
diff --git a/acceptance/testdata/repos/repo-create-view.txtar b/acceptance/testdata/repos/repo-create-view.txtar
index b5b85f593..f1a67ac73 100644
--- a/acceptance/testdata/repos/repo-create-view.txtar
+++ b/acceptance/testdata/repos/repo-create-view.txtar
@@ -8,5 +8,5 @@ exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Check that the repo exists
-exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
-stdout $SCRIPT_NAME-$RANDOM_STRING
\ No newline at end of file
+exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=name --jq='.name'
+stdout $SCRIPT_NAME-$RANDOM_STRING
diff --git a/acceptance/testdata/repos/repo-delete.txtar b/acceptance/testdata/repos/repo-delete.txtar
index 855473ae9..c9fd2c058 100644
--- a/acceptance/testdata/repos/repo-delete.txtar
+++ b/acceptance/testdata/repos/repo-delete.txtar
@@ -13,4 +13,4 @@ exec gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Ensure that the repo was deleted
 ! exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
-stderr 'Could not resolve to a Repository with the name'
\ No newline at end of file
+stderr 'Could not resolve to a Repository with the name'
diff --git a/acceptance/testdata/repos/repo-deploy-key.txtar b/acceptance/testdata/repos/repo-deploy-key.txtar
index 69c2efef8..42c5b1746 100644
--- a/acceptance/testdata/repos/repo-deploy-key.txtar
+++ b/acceptance/testdata/repos/repo-deploy-key.txtar
@@ -32,4 +32,3 @@ exec gh repo deploy-key list --json=id --jq='.[].id'
 
 -- deployKey.pub --
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZmdeRNskfpvYL5YHB/YJaW8hTEXpnvPMkx5Ri+YwUr myTitle
-
diff --git a/acceptance/testdata/repos/repo-edit.txtar b/acceptance/testdata/repos/repo-edit.txtar
index c8e293cc0..3fd5a48f6 100644
--- a/acceptance/testdata/repos/repo-edit.txtar
+++ b/acceptance/testdata/repos/repo-edit.txtar
@@ -9,11 +9,11 @@ defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Check that the repo description is empty
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json description --jq '.description'
-stdout ''
+! stdout '.'
 
 # Edit the repo description
 exec gh repo edit $ORG/$SCRIPT_NAME-$RANDOM_STRING --description 'newDescription'
 
 # Check that the repo description is updated
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json description --jq '.description'
-stdout 'newDescription'
\ No newline at end of file
+stdout 'newDescription'
diff --git a/acceptance/testdata/repos/repo-fork-sync.txtar b/acceptance/testdata/repos/repo-fork-sync.txtar
index 73beb39f1..8bc437567 100644
--- a/acceptance/testdata/repos/repo-fork-sync.txtar
+++ b/acceptance/testdata/repos/repo-fork-sync.txtar
@@ -41,4 +41,4 @@ exec ls
 stdout asset.txt
 
 -- asset.txt --
-Hello, world!
\ No newline at end of file
+Hello, world!
diff --git a/acceptance/testdata/repos/repo-list-rename.txtar b/acceptance/testdata/repos/repo-list-rename.txtar
index e758ac7fd..972e5a74a 100644
--- a/acceptance/testdata/repos/repo-list-rename.txtar
+++ b/acceptance/testdata/repos/repo-list-rename.txtar
@@ -5,20 +5,15 @@ exec gh auth setup-git
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
 # List the repos and check for the new repo
-exec gh repo list $ORG --json name --jq '.[].name'
+exec gh repo list $ORG --json=name --jq='.[].name'
 stdout $SCRIPT_NAME-$RANDOM_STRING
 
 # Rename the repo
 exec gh repo rename $SCRIPT_NAME-$RANDOM_STRING-renamed --repo=$ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
 
+# Defer repo deletion
+defer gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING-renamed --yes
+
 # List the repos and check for the renamed repo
-exec gh repo list $ORG --json name --jq '.[].name'
+exec gh repo list $ORG --json=name --jq='.[].name'
 stdout $SCRIPT_NAME-$RANDOM_STRING-renamed
-
-# Delete the renamed repo
-exec gh repo delete $ORG/$SCRIPT_NAME-$RANDOM_STRING-renamed --yes
-
-# List the repos and check for the deleted repo
-exec gh repo list $ORG --json name --jq '.[].name'
-! stdout $SCRIPT_NAME-$RANDOM_STRING-renamed
-
diff --git a/acceptance/testdata/repos/repo-set-default.txtar b/acceptance/testdata/repos/repo-set-default.txtar
index f8c0e68c5..c5b16b9ac 100644
--- a/acceptance/testdata/repos/repo-set-default.txtar
+++ b/acceptance/testdata/repos/repo-set-default.txtar
@@ -1,17 +1,14 @@
 # Use gh as a credential helper
 exec gh auth setup-git
 
-# Create a repository with a file so it has a default branch
-exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
+# Create and clone a repository with a file so it has a default branch
+exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private --clone
 
 # Defer repo cleanup
 defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
-# Clone the repo
-exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
-cd $SCRIPT_NAME-$RANDOM_STRING
-
 # Ensure that no default is set
+cd $SCRIPT_NAME-$RANDOM_STRING
 exec gh repo set-default --view
 stderr 'no default repository has been set; use `gh repo set-default` to select one'
 
@@ -20,4 +17,4 @@ exec gh repo set-default $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Check that the default is set
 exec gh repo set-default --view
-stdout $ORG/$SCRIPT_NAME-$RANDOM_STRING
\ No newline at end of file
+stdout $ORG/$SCRIPT_NAME-$RANDOM_STRING

From a5a77532dfd13162c89cad201eba92e0329df82e Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 08:40:33 -0700
Subject: [PATCH 231/301] Remove unnecessary gh auth setup-git steps

---
 acceptance/testdata/repos/repo-archive-unarchive.txtar | 3 ---
 acceptance/testdata/repos/repo-clone.txtar             | 3 ---
 acceptance/testdata/repos/repo-create-view.txtar       | 3 ---
 acceptance/testdata/repos/repo-delete.txtar            | 3 ---
 acceptance/testdata/repos/repo-deploy-key.txtar        | 3 ---
 acceptance/testdata/repos/repo-edit.txtar              | 3 ---
 acceptance/testdata/repos/repo-list-rename.txtar       | 3 ---
 acceptance/testdata/repos/repo-set-default.txtar       | 3 ---
 8 files changed, 24 deletions(-)

diff --git a/acceptance/testdata/repos/repo-archive-unarchive.txtar b/acceptance/testdata/repos/repo-archive-unarchive.txtar
index de1f7df9f..79122a80c 100644
--- a/acceptance/testdata/repos/repo-archive-unarchive.txtar
+++ b/acceptance/testdata/repos/repo-archive-unarchive.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-clone.txtar b/acceptance/testdata/repos/repo-clone.txtar
index 5afc3ab0e..f08953be1 100644
--- a/acceptance/testdata/repos/repo-clone.txtar
+++ b/acceptance/testdata/repos/repo-clone.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-create-view.txtar b/acceptance/testdata/repos/repo-create-view.txtar
index f1a67ac73..9774def35 100644
--- a/acceptance/testdata/repos/repo-create-view.txtar
+++ b/acceptance/testdata/repos/repo-create-view.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-delete.txtar b/acceptance/testdata/repos/repo-delete.txtar
index c9fd2c058..2e0bbc62a 100644
--- a/acceptance/testdata/repos/repo-delete.txtar
+++ b/acceptance/testdata/repos/repo-delete.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-deploy-key.txtar b/acceptance/testdata/repos/repo-deploy-key.txtar
index 42c5b1746..d93d07ee5 100644
--- a/acceptance/testdata/repos/repo-deploy-key.txtar
+++ b/acceptance/testdata/repos/repo-deploy-key.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create and clone a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private --clone
 
diff --git a/acceptance/testdata/repos/repo-edit.txtar b/acceptance/testdata/repos/repo-edit.txtar
index 3fd5a48f6..00d3cdd2c 100644
--- a/acceptance/testdata/repos/repo-edit.txtar
+++ b/acceptance/testdata/repos/repo-edit.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-list-rename.txtar b/acceptance/testdata/repos/repo-list-rename.txtar
index 972e5a74a..7f3ff1281 100644
--- a/acceptance/testdata/repos/repo-list-rename.txtar
+++ b/acceptance/testdata/repos/repo-list-rename.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private
 
diff --git a/acceptance/testdata/repos/repo-set-default.txtar b/acceptance/testdata/repos/repo-set-default.txtar
index c5b16b9ac..4f7fa3273 100644
--- a/acceptance/testdata/repos/repo-set-default.txtar
+++ b/acceptance/testdata/repos/repo-set-default.txtar
@@ -1,6 +1,3 @@
-# Use gh as a credential helper
-exec gh auth setup-git
-
 # Create and clone a repository with a file so it has a default branch
 exec gh repo create $ORG/$SCRIPT_NAME-$RANDOM_STRING --add-readme --private --clone
 

From ee0d9ab901843a9bd106395928a627b77af63731 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 08:44:36 -0700
Subject: [PATCH 232/301] Wrap boolean strings in '' so it is clear they are
 strings

---
 acceptance/testdata/repos/repo-archive-unarchive.txtar | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/acceptance/testdata/repos/repo-archive-unarchive.txtar b/acceptance/testdata/repos/repo-archive-unarchive.txtar
index 79122a80c..33ff519f3 100644
--- a/acceptance/testdata/repos/repo-archive-unarchive.txtar
+++ b/acceptance/testdata/repos/repo-archive-unarchive.txtar
@@ -6,18 +6,18 @@ defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Check that the repo exists and isn't archived
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
-stdout false
+stdout 'false'
 
 # Archive the repo
 exec gh repo archive $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
 
 # Check that the repo is archived
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
-stdout true
+stdout 'true'
 
 # Unarchive the repo
 exec gh repo unarchive $ORG/$SCRIPT_NAME-$RANDOM_STRING --yes
 
 # Check that the repo is unarchived
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json=isArchived --jq='.isArchived'
-stdout false
+stdout 'false'

From 25f2956e671721a153ded1822f2e11be0644b4e3 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 08:45:02 -0700
Subject: [PATCH 233/301] Replace LICENSE Makefile README.md acceptance api bin
 build cmd context docs git go.mod go.sum internal pkg script share test utils
 commands with

---
 acceptance/testdata/repos/repo-clone.txtar     | 3 +--
 acceptance/testdata/repos/repo-fork-sync.txtar | 6 ++----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/acceptance/testdata/repos/repo-clone.txtar b/acceptance/testdata/repos/repo-clone.txtar
index f08953be1..b90a0894b 100644
--- a/acceptance/testdata/repos/repo-clone.txtar
+++ b/acceptance/testdata/repos/repo-clone.txtar
@@ -8,5 +8,4 @@ defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Ensure the repo was cloned
-exec ls $SCRIPT_NAME-$RANDOM_STRING
-stdout README.md
+exists $SCRIPT_NAME-$RANDOM_STRING/README.md
diff --git a/acceptance/testdata/repos/repo-fork-sync.txtar b/acceptance/testdata/repos/repo-fork-sync.txtar
index 8bc437567..5b2362ffe 100644
--- a/acceptance/testdata/repos/repo-fork-sync.txtar
+++ b/acceptance/testdata/repos/repo-fork-sync.txtar
@@ -30,15 +30,13 @@ exec git push
 # Checkout the forked repo and ensure asset.txt is not present
 cd ../$SCRIPT_NAME-$RANDOM_STRING-fork
 exec git checkout main
-exec ls
-! stdout asset.txt
+! exists asset.txt
 
 # Sync the forked repo with the original repo
 exec gh repo sync
 
 # Check that asset.txt now exists in the fork
-exec ls
-stdout asset.txt
+exists asset.txt
 
 -- asset.txt --
 Hello, world!

From 6c3ad5011b7acb076a039582d52eb6f4f72b16fb Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 08:47:15 -0700
Subject: [PATCH 234/301] Remove unnecessary flags from repo-delete testscript

---
 acceptance/testdata/repos/repo-delete.txtar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/testdata/repos/repo-delete.txtar b/acceptance/testdata/repos/repo-delete.txtar
index 2e0bbc62a..b82388068 100644
--- a/acceptance/testdata/repos/repo-delete.txtar
+++ b/acceptance/testdata/repos/repo-delete.txtar
@@ -9,5 +9,5 @@ stdout $SCRIPT_NAME-$RANDOM_STRING
 exec gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Ensure that the repo was deleted
-! exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING --json name --jq '.name'
+! exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING
 stderr 'Could not resolve to a Repository with the name'

From 3f4a2aea2f95d41b633ade524dc800424a884228 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 09:22:58 -0700
Subject: [PATCH 235/301] Rename acceptance test directory from repos to repo

---
 acceptance/acceptance_test.go                                 | 4 ++--
 .../testdata/{repos => repo}/repo-archive-unarchive.txtar     | 0
 acceptance/testdata/{repos => repo}/repo-clone.txtar          | 0
 acceptance/testdata/{repos => repo}/repo-create-view.txtar    | 0
 acceptance/testdata/{repos => repo}/repo-delete.txtar         | 0
 acceptance/testdata/{repos => repo}/repo-deploy-key.txtar     | 0
 acceptance/testdata/{repos => repo}/repo-edit.txtar           | 0
 acceptance/testdata/{repos => repo}/repo-fork-sync.txtar      | 0
 acceptance/testdata/{repos => repo}/repo-list-rename.txtar    | 0
 acceptance/testdata/{repos => repo}/repo-set-default.txtar    | 0
 10 files changed, 2 insertions(+), 2 deletions(-)
 rename acceptance/testdata/{repos => repo}/repo-archive-unarchive.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-clone.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-create-view.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-delete.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-deploy-key.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-edit.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-fork-sync.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-list-rename.txtar (100%)
 rename acceptance/testdata/{repos => repo}/repo-set-default.txtar (100%)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 366d88cf4..18757cda7 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -72,12 +72,12 @@ func TestReleases(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
 }
 
-func TestRepos(t *testing.T) {
+func TestRepo(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
 		t.Fatal(err)
 	}
-	testscript.Run(t, testScriptParamsFor(tsEnv, "repos"))
+	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
 }
 
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
diff --git a/acceptance/testdata/repos/repo-archive-unarchive.txtar b/acceptance/testdata/repo/repo-archive-unarchive.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-archive-unarchive.txtar
rename to acceptance/testdata/repo/repo-archive-unarchive.txtar
diff --git a/acceptance/testdata/repos/repo-clone.txtar b/acceptance/testdata/repo/repo-clone.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-clone.txtar
rename to acceptance/testdata/repo/repo-clone.txtar
diff --git a/acceptance/testdata/repos/repo-create-view.txtar b/acceptance/testdata/repo/repo-create-view.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-create-view.txtar
rename to acceptance/testdata/repo/repo-create-view.txtar
diff --git a/acceptance/testdata/repos/repo-delete.txtar b/acceptance/testdata/repo/repo-delete.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-delete.txtar
rename to acceptance/testdata/repo/repo-delete.txtar
diff --git a/acceptance/testdata/repos/repo-deploy-key.txtar b/acceptance/testdata/repo/repo-deploy-key.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-deploy-key.txtar
rename to acceptance/testdata/repo/repo-deploy-key.txtar
diff --git a/acceptance/testdata/repos/repo-edit.txtar b/acceptance/testdata/repo/repo-edit.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-edit.txtar
rename to acceptance/testdata/repo/repo-edit.txtar
diff --git a/acceptance/testdata/repos/repo-fork-sync.txtar b/acceptance/testdata/repo/repo-fork-sync.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-fork-sync.txtar
rename to acceptance/testdata/repo/repo-fork-sync.txtar
diff --git a/acceptance/testdata/repos/repo-list-rename.txtar b/acceptance/testdata/repo/repo-list-rename.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-list-rename.txtar
rename to acceptance/testdata/repo/repo-list-rename.txtar
diff --git a/acceptance/testdata/repos/repo-set-default.txtar b/acceptance/testdata/repo/repo-set-default.txtar
similarity index 100%
rename from acceptance/testdata/repos/repo-set-default.txtar
rename to acceptance/testdata/repo/repo-set-default.txtar

From ba324d85ebc3c210c445b93c86daa72f1ee57191 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 09:34:13 -0700
Subject: [PATCH 236/301] Wrap true in '' in repo-fork-sync

---
 acceptance/testdata/repo/repo-fork-sync.txtar | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acceptance/testdata/repo/repo-fork-sync.txtar b/acceptance/testdata/repo/repo-fork-sync.txtar
index 5b2362ffe..6ed7b94e1 100644
--- a/acceptance/testdata/repo/repo-fork-sync.txtar
+++ b/acceptance/testdata/repo/repo-fork-sync.txtar
@@ -18,7 +18,7 @@ sleep 5
 
 # Check that the repo was forked
 exec gh repo view $ORG/$SCRIPT_NAME-$RANDOM_STRING-fork --json='isFork' --jq='.isFork'
-stdout true
+stdout 'true'
 
 # Modify original repo
 cd $SCRIPT_NAME-$RANDOM_STRING

From f4f161c09686225d2ee9981620073a13081cce67 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 18 Oct 2024 15:56:03 -0400
Subject: [PATCH 237/301] Refactor `gh secret` testscript

This is a bit of a refactor based on the work done in `gh workflow` as a better approach to verify secrets created are what we expect.

Changes made:

1. Removed `env2lower` as it wasn't being used in testscripts
2. Added `replace` custom command to deal with testing organization workflow secrets
3. Refactored secret testscripts to create and run workflow that tests the value of the secret provided
4. Minor reordering of test `acceptance` test functions as appending to the end is confusing and adds conflicts
5. Removed stdout TTY assertions
---
 acceptance/README.md                          | 23 +++--
 acceptance/acceptance_test.go                 | 93 +++++++++++--------
 acceptance/testdata/secret/secret-org.txtar   | 85 +++++++++++++++--
 .../testdata/secret/secret-repo-env.txtar     | 75 ++++++++++++---
 acceptance/testdata/secret/secret-repo.txtar  | 71 ++++++++++++--
 5 files changed, 272 insertions(+), 75 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 732369bc0..82d7e1ab6 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -72,13 +72,6 @@ The following custom commands are defined within [`acceptance_test.go`](./accept
   defer gh repo delete --yes $ORG/$SCRIPT_NAME-$RANDOM_STRING
   ```
 
-- `env2lower`: set environment variable to the lowercase version of another environment variable
-
-  ```txtar
-  # Prepare repository name, which is only lowercase
-  env2lower REPO_NAME=$RANDOM_STRING
-  ```
-
 - `env2upper`: set environment variable to the uppercase version of another environment variable
 
   ```txtar
@@ -86,6 +79,22 @@ The following custom commands are defined within [`acceptance_test.go`](./accept
   env2upper ORG_SECRET_NAME=$RANDOM_STRING
   ```
 
+- `replace`: replace placeholders in file with interpolated content provided
+
+  ```txtar
+  env2upper SECRET_NAME=$SCRIPT_NAME_$RANDOM_STRING
+
+  # Modify workflow file to use generated organization secret name
+  mv ../workflow.yml .github/workflows/workflow.yml
+  replace .github/workflows/workflow.yml SECRET_NAME=$SECRET_NAME
+
+  -- workflow.yml --
+  on:
+    workflow_dispatch:
+  env:
+    ORG_SECRET: ${{ secrets.$SECRET_NAME }}
+  ```
+
 - `stdout2env`: set environment variable containing standard output from previous command
 
   ```txtar
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index e3f439d36..58e27f506 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -27,13 +27,13 @@ func TestMain(m *testing.M) {
 	}))
 }
 
-func TestPullRequests(t *testing.T) {
+func TestAPI(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
 		t.Fatal(err)
 	}
 
-	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
+	testscript.Run(t, testScriptParamsFor(tsEnv, "api"))
 }
 
 func TestIssues(t *testing.T) {
@@ -45,6 +45,24 @@ func TestIssues(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
 }
 
+func TestPullRequests(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
+}
+
+func TestReleases(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
+}
+
 func TestSecrets(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
@@ -63,25 +81,6 @@ func TestWorkflows(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
 }
 
-func TestAPI(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "api"))
-}
-
-func TestReleases(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
->>>>>>> trunk
-}
-
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
@@ -156,23 +155,6 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				}
 			})
 		},
-		"env2lower": func(ts *testscript.TestScript, neg bool, args []string) {
-			if neg {
-				ts.Fatalf("unsupported: ! env2lower")
-			}
-			if len(args) == 0 {
-				ts.Fatalf("usage: env2lower name=value ...")
-			}
-			for _, env := range args {
-				i := strings.Index(env, "=")
-
-				if i < 0 {
-					ts.Fatalf("env2lower: argument does not match name=value")
-				}
-
-				ts.Setenv(env[:i], strings.ToLower(env[i+1:]))
-			}
-		},
 		"env2upper": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! env2upper")
@@ -190,6 +172,41 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				ts.Setenv(env[:i], strings.ToUpper(env[i+1:]))
 			}
 		},
+		"replace": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! replace")
+			}
+			if len(args) < 2 {
+				ts.Fatalf("usage: replace file env...")
+			}
+
+			src := ts.MkAbs(args[0])
+			ts.Logf("replace src: %s", src)
+			info, err := os.Stat(src)
+			ts.Check(err)
+			mode := info.Mode() & 0o777
+			data, err := os.ReadFile(src)
+			ts.Check(err)
+
+			for _, arg := range args[1:] {
+				i := strings.Index(arg, "=")
+				if i < 0 {
+					ts.Fatalf("replace: %s argument does not match name=value", arg)
+				}
+
+				name := fmt.Sprintf("$%s", arg[:i])
+				value := arg[i+1:]
+				ts.Logf("replace %s: %s", name, value)
+
+				// `replace` was originally built similar to `cmpenv`, expanding environment variables within a file.
+				// However files with content that looks like environments variable such as GitHub Actions workflows
+				// were being modified unexpectedly. Thus `replace` has been designed to using string replacement
+				// looking for `$KEY` specifically.
+				data = []byte(strings.ReplaceAll(string(data), name, value))
+			}
+
+			ts.Check(os.WriteFile(src, data, mode))
+		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! stdout2env")
diff --git a/acceptance/testdata/secret/secret-org.txtar b/acceptance/testdata/secret/secret-org.txtar
index d6d2fd213..2bc6a845b 100644
--- a/acceptance/testdata/secret/secret-org.txtar
+++ b/acceptance/testdata/secret/secret-org.txtar
@@ -1,16 +1,85 @@
-# Prepare organization secret, GitHub Actions uppercases secret names
-env2upper ORG_SECRET_NAME=$RANDOM_STRING
+# Setup environment variables used for testscript
+env REPO=$SCRIPT_NAME-$RANDOM_STRING
+env2upper SECRET_NAME=$SCRIPT_NAME_$RANDOM_STRING
+
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$REPO --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$REPO
+
+# Clone the repo
+exec gh repo clone $ORG/$REPO
+cd $REPO
 
 # Confirm organization secret does not exist, will fail admin:org scope missing
-! exec gh api /orgs/$ORG/actions/secrets/$ORG_SECRET_NAME
-stdout '"status":"404"'
+exec gh secret list --org $ORG
+! stdout $SECRET_NAME
 
 # Create an organization secret
-exec gh secret set $ORG_SECRET_NAME --org $ORG --body 'does not matter as cannot read it once set'
+exec gh secret set $SECRET_NAME --org $ORG --body 'just an organization secret' --repos $REPO
 
 # Defer organization secret cleanup
-defer gh secret delete $ORG_SECRET_NAME --org $ORG
+defer gh secret delete $SECRET_NAME --org $ORG
 
-# Confirm organization secret exists
+# Verify new organization secret exists
 exec gh secret list --org $ORG
-stdout $ORG_SECRET_NAME
+stdout $SECRET_NAME
+
+# Commit workflow file creating dispatchable workflow able to verify secret matches
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+replace .github/workflows/workflow.yml SECRET_NAME=$SECRET_NAME
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 10
+
+# Get the run ID we want to watch & delete
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Verify secret matched what was set earlier
+exec gh run view $RUN_ID --log
+stdout 'GitHub Actions secret value matches$'
+
+-- workflow.yml --
+# This workflow is intended to assert the value of the GitHub Actions secret was set appropriately
+name: Test Workflow Name
+on:
+  # Allow workflow to be dispatched by gh workflow run
+  workflow_dispatch:
+
+jobs:
+  # This workflow contains a single job called "assert" that should only pass if the GitHub Actions secret value matches
+  assert:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert secret value matches
+        env:
+          ORG_SECRET: ${{ secrets.$SECRET_NAME }}
+        run: |
+          if [[ "$ORG_SECRET" == "just an organization secret" ]]; then
+            echo "GitHub Actions secret value matches"
+          else
+            echo "GitHub Actions secret value does not match"
+            exit 1
+          fi
diff --git a/acceptance/testdata/secret/secret-repo-env.txtar b/acceptance/testdata/secret/secret-repo-env.txtar
index b5236ea92..a9a2c7353 100644
--- a/acceptance/testdata/secret/secret-repo-env.txtar
+++ b/acceptance/testdata/secret/secret-repo-env.txtar
@@ -1,8 +1,10 @@
-# Force GitHub CLI to treat testscript as TTY
-env GH_FORCE_TTY=80
+# Setup environment variables used for testscript
 env REPO=$SCRIPT_NAME-$RANDOM_STRING
 
-# Create a repository where the secret will be registered
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$REPO --add-readme --private
 
 # Defer repo cleanup
@@ -13,17 +15,66 @@ exec gh repo clone $ORG/$REPO
 cd $REPO
 
 # Create a repository environment, will fail if organization does not have environment support
-exec gh api /repos/$ORG/$REPO/environments/testscripts -X PUT --jq '.name'
-stdout 'testscripts'
-
-# Verify no repository environment secrets exist
-exec gh secret list --env testscripts
-stderr 'no secrets found'
+exec gh api /repos/$ORG/$REPO/environments/testscripts -X PUT
 
 # Create a repository environment secret
-exec gh secret set TESTSCRIPTS_ENV --env testscripts --body 'does not matter as cannot read it once set'
-stdout 'Set Actions secret TESTSCRIPTS_ENV for'
+exec gh secret set TESTSCRIPTS_ENV --env testscripts --body 'just a repository environment secret'
 
 # Verify new repository secret exists
 exec gh secret list --env testscripts
-stdout 'TESTSCRIPTS_ENV\s+less than a minute ago'
+stdout 'TESTSCRIPTS_ENV'
+
+# Commit workflow file creating dispatchable workflow able to verify secret matches
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 10
+
+# Get the run ID we want to watch & delete
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Verify secret matched what was set earlier
+exec gh run view $RUN_ID --log
+stdout 'GitHub Actions secret value matches$'
+
+-- workflow.yml --
+# This workflow is intended to assert the value of the GitHub Actions secret was set appropriately
+name: Test Workflow Name
+on:
+  # Allow workflow to be dispatched by gh workflow run
+  workflow_dispatch:
+
+jobs:
+  # This workflow contains a single job called "assert" that should only pass if the GitHub Actions secret value matches
+  assert:
+    runs-on: ubuntu-latest
+    environment: testscripts
+    steps:
+      - name: Assert secret value matches
+        env:
+          TESTSCRIPTS_ENV: ${{ secrets.TESTSCRIPTS_ENV }}
+        run: |
+          if [[ "$TESTSCRIPTS_ENV" == "just a repository environment secret" ]]; then
+            echo "GitHub Actions secret value matches"
+          else
+            echo "GitHub Actions secret value does not match"
+            exit 1
+          fi
diff --git a/acceptance/testdata/secret/secret-repo.txtar b/acceptance/testdata/secret/secret-repo.txtar
index f69a06e57..ed336626f 100644
--- a/acceptance/testdata/secret/secret-repo.txtar
+++ b/acceptance/testdata/secret/secret-repo.txtar
@@ -1,8 +1,10 @@
-# Force GitHub CLI to treat testscript as TTY
-env GH_FORCE_TTY=80
+# Setup environment variables used for testscript
 env REPO=$SCRIPT_NAME-$RANDOM_STRING
 
-# Create a repository where the secret will be registered
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
 exec gh repo create $ORG/$REPO --add-readme --private
 
 # Defer repo cleanup
@@ -12,14 +14,63 @@ defer gh repo delete --yes $ORG/$REPO
 exec gh repo clone $ORG/$REPO
 cd $REPO
 
-# Verify no repository secrets exist
-exec gh secret list
-stderr 'no secrets found'
-
 # Create a repository secret
-exec gh secret set TESTSCRIPTS --body 'does not matter as cannot read it once set'
-stdout 'Set Actions secret TESTSCRIPTS for'
+exec gh secret set TESTSCRIPTS --body 'just a repository secret'
 
 # Verify new repository secret exists
 exec gh secret list
-stdout 'TESTSCRIPTS\s+less than a minute ago'
+stdout 'TESTSCRIPTS'
+
+# Commit workflow file creating dispatchable workflow able to verify secret matches
+mkdir .github/workflows
+mv ../workflow.yml .github/workflows/workflow.yml
+exec git add .github/workflows/workflow.yml
+exec git commit -m 'Create workflow file'
+exec git push -u origin main
+
+# Sleep because it takes a second for the workflow to register
+sleep 1
+
+# Check the workflow is indeed created
+exec gh workflow list
+stdout 'Test Workflow Name'
+
+# Run the workflow
+exec gh workflow run 'Test Workflow Name'
+
+# It takes some time for a workflow run to register
+sleep 10
+
+# Get the run ID we want to watch & delete
+exec gh run list --json databaseId --jq '.[0].databaseId'
+stdout2env RUN_ID
+
+# Wait for workflow to complete
+exec gh run watch $RUN_ID --exit-status
+
+# Verify secret matched what was set earlier
+exec gh run view $RUN_ID --log
+stdout 'GitHub Actions secret value matches$'
+
+-- workflow.yml --
+# This workflow is intended to assert the value of the GitHub Actions secret was set appropriately
+name: Test Workflow Name
+on:
+  # Allow workflow to be dispatched by gh workflow run
+  workflow_dispatch:
+
+jobs:
+  # This workflow contains a single job called "assert" that should only pass if the GitHub Actions secret value matches
+  assert:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert secret value matches
+        env:
+          TESTSCRIPTS: ${{ secrets.TESTSCRIPTS }}
+        run: |
+          if [[ "$TESTSCRIPTS" == "just a repository secret" ]]; then
+            echo "GitHub Actions secret value matches"
+          else
+            echo "GitHub Actions secret value does not match"
+            exit 1
+          fi

From b33e2f92a764857d5d6d9dd7ecf1965e1d15c7a0 Mon Sep 17 00:00:00 2001
From: tsukasa inoue <inoue.tsukasa.4@gmail.com>
Date: Sat, 19 Oct 2024 11:11:24 +0900
Subject: [PATCH 238/301] feat: add ArchivedAt field to Repository struct

---
 api/queries_repo.go  | 7 ++++---
 api/query_builder.go | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/api/queries_repo.go b/api/queries_repo.go
index aadf64adc..53e6d879a 100644
--- a/api/queries_repo.go
+++ b/api/queries_repo.go
@@ -41,9 +41,10 @@ type Repository struct {
 	MirrorURL                string
 	SecurityPolicyURL        string
 
-	CreatedAt time.Time
-	PushedAt  *time.Time
-	UpdatedAt time.Time
+	CreatedAt  time.Time
+	PushedAt   *time.Time
+	UpdatedAt  time.Time
+	ArchivedAt *time.Time
 
 	IsBlankIssuesEnabled    bool
 	IsSecurityPolicyEnabled bool
diff --git a/api/query_builder.go b/api/query_builder.go
index 755179396..dbf889273 100644
--- a/api/query_builder.go
+++ b/api/query_builder.go
@@ -400,6 +400,7 @@ var RepositoryFields = []string{
 	"createdAt",
 	"pushedAt",
 	"updatedAt",
+	"archivedAt",
 
 	"isBlankIssuesEnabled",
 	"isSecurityPolicyEnabled",

From 6923fb5cc88494febf2551946810c6c03cc83f82 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Sun, 20 Oct 2024 15:22:42 -0600
Subject: [PATCH 239/301] add validation for local ext install

---
 pkg/cmd/extension/command.go      | 25 +++++++++
 pkg/cmd/extension/command_test.go | 90 ++++++++++++++++++++++++++++++-
 2 files changed, 113 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/extension/command.go b/pkg/cmd/extension/command.go
index b3c7b0c9f..43e9957fb 100644
--- a/pkg/cmd/extension/command.go
+++ b/pkg/cmd/extension/command.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	gio "io"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -317,6 +318,10 @@ func NewCmdExtension(f *cmdutil.Factory) *cobra.Command {
 						if err != nil {
 							return err
 						}
+						err = checkValidLocalExtension(cmd.Root(), m, wd)
+						if err != nil {
+							return err
+						}
 						return m.InstallLocal(wd)
 					}
 
@@ -639,6 +644,26 @@ func NewCmdExtension(f *cmdutil.Factory) *cobra.Command {
 	return &extCmd
 }
 
+func checkValidLocalExtension(rootCmd *cobra.Command, m extensions.ExtensionManager, extDir string) error {
+	extName := filepath.Base(extDir)
+	if !strings.HasPrefix(extName, "gh-") {
+		return errors.New("extension directory name must start with `gh-`")
+	}
+
+	commandName := strings.TrimPrefix(extName, "gh-")
+	if c, _, _ := rootCmd.Find([]string{commandName}); c != rootCmd && c.GroupID != "extension" {
+		return fmt.Errorf("%q matches the name of a built-in command or alias", commandName)
+	}
+
+	for _, ext := range m.List() {
+		if ext.Name() == commandName {
+			return fmt.Errorf("there is already an installed extension that provides the %q command", commandName)
+		}
+	}
+
+	return nil
+}
+
 func checkValidExtension(rootCmd *cobra.Command, m extensions.ExtensionManager, extName, extOwner string) (extensions.Extension, error) {
 	if !strings.HasPrefix(extName, "gh-") {
 		return nil, errors.New("extension repository name must start with `gh-`")
diff --git a/pkg/cmd/extension/command_test.go b/pkg/cmd/extension/command_test.go
index fc9c414a3..bddfdb93d 100644
--- a/pkg/cmd/extension/command_test.go
+++ b/pkg/cmd/extension/command_test.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -27,7 +28,9 @@ import (
 func TestNewCmdExtension(t *testing.T) {
 	tempDir := t.TempDir()
 	oldWd, _ := os.Getwd()
-	assert.NoError(t, os.Chdir(tempDir))
+	localExtensionTempDir := filepath.Join(tempDir, "gh-hello")
+	assert.NoError(t, os.MkdirAll(localExtensionTempDir, 0755))
+	assert.NoError(t, os.Chdir(localExtensionTempDir))
 	t.Cleanup(func() { _ = os.Chdir(oldWd) })
 
 	tests := []struct {
@@ -270,13 +273,16 @@ func TestNewCmdExtension(t *testing.T) {
 			name: "install local extension",
 			args: []string{"install", "."},
 			managerStubs: func(em *extensions.ExtensionManagerMock) func(*testing.T) {
+				em.ListFunc = func() []extensions.Extension {
+					return []extensions.Extension{}
+				}
 				em.InstallLocalFunc = func(dir string) error {
 					return nil
 				}
 				return func(t *testing.T) {
 					calls := em.InstallLocalCalls()
 					assert.Equal(t, 1, len(calls))
-					assert.Equal(t, tempDir, normalizeDir(calls[0].Dir))
+					assert.Equal(t, localExtensionTempDir, normalizeDir(calls[0].Dir))
 				}
 			},
 		},
@@ -1024,6 +1030,86 @@ func Test_checkValidExtension(t *testing.T) {
 	}
 }
 
+func Test_checkValidLocalExtension(t *testing.T) {
+	fakeRootCmd := &cobra.Command{}
+	fakeRootCmd.AddCommand(&cobra.Command{Use: "help"})
+	fakeRootCmd.AddCommand(&cobra.Command{Use: "auth"})
+
+	m := &extensions.ExtensionManagerMock{
+		ListFunc: func() []extensions.Extension {
+			return []extensions.Extension{
+				&extensions.ExtensionMock{
+					OwnerFunc: func() string { return "monalisa" },
+					NameFunc:  func() string { return "screensaver" },
+					PathFunc:  func() string { return "some/install/dir/gh-screensaver" },
+				},
+				&extensions.ExtensionMock{
+					OwnerFunc: func() string { return "monalisa" },
+					NameFunc:  func() string { return "triage" },
+					PathFunc:  func() string { return "some/install/dir/gh-triage" },
+				},
+			}
+		},
+	}
+
+	type args struct {
+		rootCmd *cobra.Command
+		manager extensions.ExtensionManager
+		dir     string
+	}
+	tests := []struct {
+		name      string
+		args      args
+		wantError string
+	}{
+		{
+			name: "valid extension",
+			args: args{
+				rootCmd: fakeRootCmd,
+				manager: m,
+				dir:     "some/install/dir/gh-hello",
+			},
+		},
+		{
+			name: "invalid extension name",
+			args: args{
+				rootCmd: fakeRootCmd,
+				manager: m,
+				dir:     "some/install/dir/hello",
+			},
+			wantError: "extension directory name must start with `gh-`",
+		},
+		{
+			name: "clashes with built-in command",
+			args: args{
+				rootCmd: fakeRootCmd,
+				manager: m,
+				dir:     "some/install/dir/gh-auth",
+			},
+			wantError: "\"auth\" matches the name of a built-in command or alias",
+		},
+		{
+			name: "clashes with an installed extension",
+			args: args{
+				rootCmd: fakeRootCmd,
+				manager: m,
+				dir:     "some/different/install/dir/gh-triage",
+			},
+			wantError: "there is already an installed extension that provides the \"triage\" command",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := checkValidLocalExtension(tt.args.rootCmd, tt.args.manager, tt.args.dir)
+			if tt.wantError == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.EqualError(t, err, tt.wantError)
+			}
+		})
+	}
+}
+
 func searchResults(numResults int) interface{} {
 	result := map[string]interface{}{
 		"incomplete_results": false,

From 664e09fdbcccedc50916ca533acb700e39e7fa9b Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Mon, 21 Oct 2024 11:20:46 -0400
Subject: [PATCH 240/301] wip: added test that fails in the absence of a
 backoff.

---
 pkg/cmd/attestation/api/client_test.go        | 26 +++++++++++++++++++
 .../attestation/api/mock_apiClient_test.go    | 25 ++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index bfcb40f5a..5544f7476 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -204,3 +204,29 @@ func TestGetTrustDomain(t *testing.T) {
 	})
 
 }
+
+func TestGetAttestationsRetries(t *testing.T) {
+	fetcher := mockDataGenerator{
+		NumAttestations: 5,
+	}
+	l := io.NewTestHandler()
+
+	c := &LiveClient{
+		api: mockAPIClient{
+			OnRESTWithNext: fetcher.FlakyOnRESTSuccessWithNextPageHandler(),
+		},
+		logger: l,
+	}
+
+	attestations, err := c.GetByRepoAndDigest(testRepo, testDigest, DefaultLimit)
+	require.NoError(t, err)
+
+	// assert the error path was executed; because this is a paged
+	// request, it should have errored twice
+	fetcher.AssertNumberOfCalls(t, "FlakyOnRESTSuccessWithNextPage:error", 2)
+
+	// but we still successfully got the right data
+	require.Equal(t, 10, len(attestations))
+	bundle := (attestations)[0].Bundle
+	require.Equal(t, bundle.GetMediaType(), "application/vnd.dev.sigstore.bundle.v0.3+json")
+}
diff --git a/pkg/cmd/attestation/api/mock_apiClient_test.go b/pkg/cmd/attestation/api/mock_apiClient_test.go
index d58cdbc79..e2364f048 100644
--- a/pkg/cmd/attestation/api/mock_apiClient_test.go
+++ b/pkg/cmd/attestation/api/mock_apiClient_test.go
@@ -6,6 +6,10 @@ import (
 	"fmt"
 	"io"
 	"strings"
+
+	cliAPI "github.com/cli/cli/v2/api"
+	ghAPI "github.com/cli/go-gh/v2/pkg/api"
+	"github.com/stretchr/testify/mock"
 )
 
 type mockAPIClient struct {
@@ -22,6 +26,7 @@ func (m mockAPIClient) REST(hostname, method, p string, body io.Reader, data int
 }
 
 type mockDataGenerator struct {
+	mock.Mock
 	NumAttestations int
 }
 
@@ -40,6 +45,26 @@ func (m mockDataGenerator) OnRESTSuccessWithNextPage(hostname, method, p string,
 	return m.OnRESTWithNextSuccessHelper(hostname, method, p, body, data, false)
 }
 
+// Returns a func that just calls OnRESTSuccessWithNextPage but half the time
+// it returns a 500 error.
+func (m *mockDataGenerator) FlakyOnRESTSuccessWithNextPageHandler() func(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+	// set up the flake counter
+	m.On("FlakyOnRESTSuccessWithNextPage:error").Return()
+
+	count := 0
+	return func(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+		if count%2 == 0 {
+			m.MethodCalled("FlakyOnRESTSuccessWithNextPage:error")
+
+			count = count + 1
+			return "", cliAPI.HTTPError{HTTPError: &ghAPI.HTTPError{StatusCode: 500}}
+		} else {
+			count = count + 1
+			return m.OnRESTSuccessWithNextPage(hostname, method, p, body, data)
+		}
+	}
+}
+
 func (m mockDataGenerator) OnRESTWithNextSuccessHelper(hostname, method, p string, body io.Reader, data interface{}, hasNext bool) (string, error) {
 	atts := make([]*Attestation, m.NumAttestations)
 	for j := 0; j < m.NumAttestations; j++ {

From acf62dacf2a42ad094ff19e0442f87e3da19e528 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Mon, 21 Oct 2024 11:53:05 -0400
Subject: [PATCH 241/301] Address @williammartin PR feedback

---
 acceptance/README.md                        |  2 +-
 acceptance/acceptance_test.go               | 10 ++++++++--
 acceptance/testdata/secret/secret-org.txtar |  4 ++--
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 82d7e1ab6..750cb75d1 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -57,7 +57,7 @@ The following custom environment variables are made available to the scripts:
  * `ORG`: Set to the value of the `GH_ACCEPTANCE_ORG` env var provided to `go test`
  * `GH_TOKEN`: Set to the value of the `GH_ACCEPTANCE_TOKEN` env var provided to `go test`
  * `RANDOM_STRING`: Set to a length 10 random string of letters to help isolate globally visible resources
- * `SCRIPT_NAME`: Set to the name of the `testscript` currently running, without extension e.g. `pr-view`
+ * `SCRIPT_NAME`: Set to the name of the `testscript` currently running, without extension and replacing hyphens with underscores e.g. `pr_view`
  * `HOME`: Set to the initial working directory. Required for `git` operations
  * `GH_CONFIG_DIR`: Set to the initial working directory. Required for `gh` operations
 
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 58e27f506..de708e38c 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -111,7 +111,11 @@ func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error {
 		if !ok {
 			ts.T().Fatal("script name not found")
 		}
-		ts.Setenv("SCRIPT_NAME", scriptName)
+
+		// When using script name to uniquely identify where test data comes from,
+		// some places like GitHub Actions secret names don't accept hyphens.
+		// Replace them with underscores until such a time this becomes a problem.
+		ts.Setenv("SCRIPT_NAME", strings.ReplaceAll(scriptName, "-", "_"))
 		ts.Setenv("HOME", ts.Cd)
 		ts.Setenv("GH_CONFIG_DIR", ts.Cd)
 
@@ -182,6 +186,8 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 
 			src := ts.MkAbs(args[0])
 			ts.Logf("replace src: %s", src)
+
+			// Preserve the existing file mode while replacing the contents similar to native cp behavior
 			info, err := os.Stat(src)
 			ts.Check(err)
 			mode := info.Mode() & 0o777
@@ -198,7 +204,7 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				value := arg[i+1:]
 				ts.Logf("replace %s: %s", name, value)
 
-				// `replace` was originally built similar to `cmpenv`, expanding environment variables within a file.
+				// `replace` was originally built similar to `cp` and `cmpenv`, expanding environment variables within a file.
 				// However files with content that looks like environments variable such as GitHub Actions workflows
 				// were being modified unexpectedly. Thus `replace` has been designed to using string replacement
 				// looking for `$KEY` specifically.
diff --git a/acceptance/testdata/secret/secret-org.txtar b/acceptance/testdata/secret/secret-org.txtar
index 2bc6a845b..7d383009c 100644
--- a/acceptance/testdata/secret/secret-org.txtar
+++ b/acceptance/testdata/secret/secret-org.txtar
@@ -1,6 +1,6 @@
 # Setup environment variables used for testscript
-env REPO=$SCRIPT_NAME-$RANDOM_STRING
-env2upper SECRET_NAME=$SCRIPT_NAME_$RANDOM_STRING
+env REPO=${SCRIPT_NAME}-${RANDOM_STRING}
+env2upper SECRET_NAME=${SCRIPT_NAME}_${RANDOM_STRING}
 
 # Use gh as a credential helper
 exec gh auth setup-git

From efc1c97cf1f1933ac762567f6834ef1f3925ff6f Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Mon, 21 Oct 2024 12:10:18 -0400
Subject: [PATCH 242/301] Added constant backoff retry to getAttestations.

---
 pkg/cmd/attestation/api/client.go      | 40 ++++++++++++++++++++++++--
 pkg/cmd/attestation/api/client_test.go |  5 ++++
 2 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/api/client.go b/pkg/cmd/attestation/api/client.go
index 460ae3aad..fb9caf246 100644
--- a/pkg/cmd/attestation/api/client.go
+++ b/pkg/cmd/attestation/api/client.go
@@ -1,11 +1,14 @@
 package api
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"strings"
+	"time"
 
+	"github.com/cenkalti/backoff/v4"
 	"github.com/cli/cli/v2/api"
 	ioconfig "github.com/cli/cli/v2/pkg/cmd/attestation/io"
 )
@@ -69,6 +72,9 @@ func (c *LiveClient) GetTrustDomain() (string, error) {
 	return c.getTrustDomain(MetaPath)
 }
 
+// Allow injecting backoff interval in tests.
+var getAttestationRetryInterval = time.Millisecond * 200
+
 func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*Attestation, error) {
 	c.logger.VerbosePrintf("Fetching attestations for artifact digest %s\n\n", digest)
 
@@ -87,14 +93,31 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 	var attestations []*Attestation
 	var resp AttestationsResponse
 	var err error
+	bo := backoff.NewConstantBackOff(getAttestationRetryInterval)
+
 	// if no attestation or less than limit, then keep fetching
 	for url != "" && len(attestations) < limit {
-		url, err = c.api.RESTWithNext(c.host, http.MethodGet, url, nil, &resp)
+		err = backoff.Retry(func() error {
+			newURL, err := c.api.RESTWithNext(c.host, http.MethodGet, url, nil, &resp)
+
+			if err != nil {
+				if shouldRetry(err) {
+					return err
+				} else {
+					return backoff.Permanent(err)
+				}
+			}
+
+			url = newURL
+			attestations = append(attestations, resp.Attestations...)
+
+			return nil
+		}, backoff.WithMaxRetries(bo, 3))
+
+		// bail if RESTWithNext errored out
 		if err != nil {
 			return nil, err
 		}
-
-		attestations = append(attestations, resp.Attestations...)
 	}
 
 	if len(attestations) == 0 {
@@ -108,6 +131,17 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 	return attestations, nil
 }
 
+func shouldRetry(err error) bool {
+	var httpError api.HTTPError
+	if errors.As(err, &httpError) {
+		if httpError.StatusCode >= 500 && httpError.StatusCode <= 599 {
+			return true
+		}
+	}
+
+	return false
+}
+
 func (c *LiveClient) getTrustDomain(url string) (string, error) {
 	var resp MetaResponse
 
diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index 5544f7476..4751a3ea8 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -206,6 +206,9 @@ func TestGetTrustDomain(t *testing.T) {
 }
 
 func TestGetAttestationsRetries(t *testing.T) {
+	oldInterval := getAttestationRetryInterval
+	getAttestationRetryInterval = 0
+
 	fetcher := mockDataGenerator{
 		NumAttestations: 5,
 	}
@@ -229,4 +232,6 @@ func TestGetAttestationsRetries(t *testing.T) {
 	require.Equal(t, 10, len(attestations))
 	bundle := (attestations)[0].Bundle
 	require.Equal(t, bundle.GetMediaType(), "application/vnd.dev.sigstore.bundle.v0.3+json")
+
+	getAttestationRetryInterval = oldInterval
 }

From 1736de2cd10f5c3da582edc789cbbcd213cb989b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 21 Oct 2024 10:20:37 -0600
Subject: [PATCH 243/301] Fix single quote not expanding vars

---
 acceptance/testdata/search/search-issues.txtar | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/acceptance/testdata/search/search-issues.txtar b/acceptance/testdata/search/search-issues.txtar
index e41bc1eb6..82184f3f1 100644
--- a/acceptance/testdata/search/search-issues.txtar
+++ b/acceptance/testdata/search/search-issues.txtar
@@ -9,11 +9,12 @@ exec gh repo clone $ORG/$SCRIPT_NAME-$RANDOM_STRING
 
 # Create an issue in the repo
 cd $SCRIPT_NAME-$RANDOM_STRING
-exec gh issue create --title 'Feature Request' --body 'Feature Body $RANDOM_STRING'
+
+exec gh issue create --title 'Feature Request' --body $RANDOM_STRING
 
 # It takes some time for the issue to be created and indexed
 sleep 5
 
 # Search for the issue
-exec gh search issues 'Feature Body $RANDOM_STRING' -R $ORG/$SCRIPT_NAME-$RANDOM_STRING
-stdout 'Feature Request'
\ No newline at end of file
+exec gh search issues $RANDOM_STRING -R $ORG/$SCRIPT_NAME-$RANDOM_STRING
+stdout $RANDOM_STRING
\ No newline at end of file

From fafda48905d0a1cbcef19ffcf0c2e2f1679546e2 Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Mon, 21 Oct 2024 12:32:57 -0400
Subject: [PATCH 244/301] added test for verifying we do 3 retries when
 fetching attestations.

---
 pkg/cmd/attestation/api/client_test.go        | 39 +++++++++++++++++--
 .../attestation/api/mock_apiClient_test.go    | 10 +++++
 2 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index 4751a3ea8..e6bca4406 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -212,13 +212,12 @@ func TestGetAttestationsRetries(t *testing.T) {
 	fetcher := mockDataGenerator{
 		NumAttestations: 5,
 	}
-	l := io.NewTestHandler()
 
 	c := &LiveClient{
 		api: mockAPIClient{
 			OnRESTWithNext: fetcher.FlakyOnRESTSuccessWithNextPageHandler(),
 		},
-		logger: l,
+		logger: io.NewTestHandler(),
 	}
 
 	attestations, err := c.GetByRepoAndDigest(testRepo, testDigest, DefaultLimit)
@@ -229,9 +228,43 @@ func TestGetAttestationsRetries(t *testing.T) {
 	fetcher.AssertNumberOfCalls(t, "FlakyOnRESTSuccessWithNextPage:error", 2)
 
 	// but we still successfully got the right data
-	require.Equal(t, 10, len(attestations))
+	require.Equal(t, len(attestations), 10)
 	bundle := (attestations)[0].Bundle
 	require.Equal(t, bundle.GetMediaType(), "application/vnd.dev.sigstore.bundle.v0.3+json")
 
+	// same test as above, but for GetByOwnerAndDigest:
+	attestations, err = c.GetByOwnerAndDigest(testOwner, testDigest, DefaultLimit)
+	require.NoError(t, err)
+
+	// because we haven't reset the mock, we have added 2 more failed requests
+	fetcher.AssertNumberOfCalls(t, "FlakyOnRESTSuccessWithNextPage:error", 4)
+
+	require.Equal(t, len(attestations), 10)
+	bundle = (attestations)[0].Bundle
+	require.Equal(t, bundle.GetMediaType(), "application/vnd.dev.sigstore.bundle.v0.3+json")
+
+	getAttestationRetryInterval = oldInterval
+}
+
+// test total retries
+func TestGetAttestationsMaxRetries(t *testing.T) {
+	oldInterval := getAttestationRetryInterval
+	getAttestationRetryInterval = 0
+
+	fetcher := mockDataGenerator{
+		NumAttestations: 5,
+	}
+
+	c := &LiveClient{
+		api: mockAPIClient{
+			OnRESTWithNext: fetcher.OnREST500ErrorHandler(),
+		},
+		logger: io.NewTestHandler(),
+	}
+
+	_, err := c.GetByRepoAndDigest(testRepo, testDigest, DefaultLimit)
+	require.Error(t, err)
+
+	fetcher.AssertNumberOfCalls(t, "OnREST500Error", 4)
 	getAttestationRetryInterval = oldInterval
 }
diff --git a/pkg/cmd/attestation/api/mock_apiClient_test.go b/pkg/cmd/attestation/api/mock_apiClient_test.go
index e2364f048..0add67b75 100644
--- a/pkg/cmd/attestation/api/mock_apiClient_test.go
+++ b/pkg/cmd/attestation/api/mock_apiClient_test.go
@@ -65,6 +65,16 @@ func (m *mockDataGenerator) FlakyOnRESTSuccessWithNextPageHandler() func(hostnam
 	}
 }
 
+// always returns a 500
+func (m *mockDataGenerator) OnREST500ErrorHandler() func(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+	m.On("OnREST500Error").Return()
+	return func(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+		m.MethodCalled("OnREST500Error")
+
+		return "", cliAPI.HTTPError{HTTPError: &ghAPI.HTTPError{StatusCode: 500}}
+	}
+}
+
 func (m mockDataGenerator) OnRESTWithNextSuccessHelper(hostname, method, p string, body io.Reader, data interface{}, hasNext bool) (string, error) {
 	atts := make([]*Attestation, m.NumAttestations)
 	for j := 0; j < m.NumAttestations; j++ {

From e7446676b601f0d7a721c97d8e8fcc4138af313d Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Mon, 21 Oct 2024 12:44:51 -0400
Subject: [PATCH 245/301] Minor tweaks, added backoff to getTrustDomain

---
 pkg/cmd/attestation/api/client.go      | 28 ++++++++++++++++++--------
 pkg/cmd/attestation/api/client_test.go |  5 -----
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/pkg/cmd/attestation/api/client.go b/pkg/cmd/attestation/api/client.go
index fb9caf246..f47b5f759 100644
--- a/pkg/cmd/attestation/api/client.go
+++ b/pkg/cmd/attestation/api/client.go
@@ -92,19 +92,18 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 
 	var attestations []*Attestation
 	var resp AttestationsResponse
-	var err error
 	bo := backoff.NewConstantBackOff(getAttestationRetryInterval)
 
 	// if no attestation or less than limit, then keep fetching
 	for url != "" && len(attestations) < limit {
-		err = backoff.Retry(func() error {
-			newURL, err := c.api.RESTWithNext(c.host, http.MethodGet, url, nil, &resp)
+		err := backoff.Retry(func() error {
+			newURL, restErr := c.api.RESTWithNext(c.host, http.MethodGet, url, nil, &resp)
 
-			if err != nil {
-				if shouldRetry(err) {
-					return err
+			if restErr != nil {
+				if shouldRetry(restErr) {
+					return restErr
 				} else {
-					return backoff.Permanent(err)
+					return backoff.Permanent(restErr)
 				}
 			}
 
@@ -145,7 +144,20 @@ func shouldRetry(err error) bool {
 func (c *LiveClient) getTrustDomain(url string) (string, error) {
 	var resp MetaResponse
 
-	err := c.api.REST(c.host, http.MethodGet, url, nil, &resp)
+	bo := backoff.NewConstantBackOff(getAttestationRetryInterval)
+	err := backoff.Retry(func() error {
+		restErr := c.api.REST(c.host, http.MethodGet, url, nil, &resp)
+		if restErr != nil {
+			if shouldRetry(restErr) {
+				return restErr
+			} else {
+				return backoff.Permanent(restErr)
+			}
+		}
+
+		return nil
+	}, backoff.WithMaxRetries(bo, 3))
+
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index e6bca4406..adac00598 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -206,7 +206,6 @@ func TestGetTrustDomain(t *testing.T) {
 }
 
 func TestGetAttestationsRetries(t *testing.T) {
-	oldInterval := getAttestationRetryInterval
 	getAttestationRetryInterval = 0
 
 	fetcher := mockDataGenerator{
@@ -242,13 +241,10 @@ func TestGetAttestationsRetries(t *testing.T) {
 	require.Equal(t, len(attestations), 10)
 	bundle = (attestations)[0].Bundle
 	require.Equal(t, bundle.GetMediaType(), "application/vnd.dev.sigstore.bundle.v0.3+json")
-
-	getAttestationRetryInterval = oldInterval
 }
 
 // test total retries
 func TestGetAttestationsMaxRetries(t *testing.T) {
-	oldInterval := getAttestationRetryInterval
 	getAttestationRetryInterval = 0
 
 	fetcher := mockDataGenerator{
@@ -266,5 +262,4 @@ func TestGetAttestationsMaxRetries(t *testing.T) {
 	require.Error(t, err)
 
 	fetcher.AssertNumberOfCalls(t, "OnREST500Error", 4)
-	getAttestationRetryInterval = oldInterval
 }

From de4c05fb61c4aec921feb0e09a395eccfaee9ebc Mon Sep 17 00:00:00 2001
From: Phill MV <phillmv@github.com>
Date: Mon, 21 Oct 2024 14:32:32 -0400
Subject: [PATCH 246/301] Linting: now that mockDataGenerator has an embedded
 mock, we ought to have pointer receivers in its funcs.

---
 pkg/cmd/attestation/api/mock_apiClient_test.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/attestation/api/mock_apiClient_test.go b/pkg/cmd/attestation/api/mock_apiClient_test.go
index 0add67b75..e1654bd3f 100644
--- a/pkg/cmd/attestation/api/mock_apiClient_test.go
+++ b/pkg/cmd/attestation/api/mock_apiClient_test.go
@@ -30,11 +30,11 @@ type mockDataGenerator struct {
 	NumAttestations int
 }
 
-func (m mockDataGenerator) OnRESTSuccess(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+func (m *mockDataGenerator) OnRESTSuccess(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return m.OnRESTWithNextSuccessHelper(hostname, method, p, body, data, false)
 }
 
-func (m mockDataGenerator) OnRESTSuccessWithNextPage(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+func (m *mockDataGenerator) OnRESTSuccessWithNextPage(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	// if path doesn't contain after, it means first time hitting the mock server
 	// so return the first page and return the link header in the response
 	if !strings.Contains(p, "after") {
@@ -75,7 +75,7 @@ func (m *mockDataGenerator) OnREST500ErrorHandler() func(hostname, method, p str
 	}
 }
 
-func (m mockDataGenerator) OnRESTWithNextSuccessHelper(hostname, method, p string, body io.Reader, data interface{}, hasNext bool) (string, error) {
+func (m *mockDataGenerator) OnRESTWithNextSuccessHelper(hostname, method, p string, body io.Reader, data interface{}, hasNext bool) (string, error) {
 	atts := make([]*Attestation, m.NumAttestations)
 	for j := 0; j < m.NumAttestations; j++ {
 		att := makeTestAttestation()
@@ -105,7 +105,7 @@ func (m mockDataGenerator) OnRESTWithNextSuccessHelper(hostname, method, p strin
 	return "", nil
 }
 
-func (m mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+func (m *mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	resp := AttestationsResponse{
 		Attestations: make([]*Attestation, 0),
 	}
@@ -124,7 +124,7 @@ func (m mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p stri
 	return "", nil
 }
 
-func (m mockDataGenerator) OnRESTWithNextError(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
+func (m *mockDataGenerator) OnRESTWithNextError(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return "", errors.New("failed to get attestations")
 }
 

From cc32f3358346a65c3fd2d4a1f23a96c586fef476 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 21 Oct 2024 12:37:27 -0600
Subject: [PATCH 247/301] Refactor to remove code duplication

---
 pkg/cmd/extension/command.go      | 26 +++-----------------------
 pkg/cmd/extension/command_test.go |  6 +++---
 2 files changed, 6 insertions(+), 26 deletions(-)

diff --git a/pkg/cmd/extension/command.go b/pkg/cmd/extension/command.go
index 43e9957fb..ded90cbe4 100644
--- a/pkg/cmd/extension/command.go
+++ b/pkg/cmd/extension/command.go
@@ -318,7 +318,7 @@ func NewCmdExtension(f *cmdutil.Factory) *cobra.Command {
 						if err != nil {
 							return err
 						}
-						err = checkValidLocalExtension(cmd.Root(), m, wd)
+						_, err = checkValidExtension(cmd.Root(), m, filepath.Base(wd), "")
 						if err != nil {
 							return err
 						}
@@ -644,29 +644,9 @@ func NewCmdExtension(f *cmdutil.Factory) *cobra.Command {
 	return &extCmd
 }
 
-func checkValidLocalExtension(rootCmd *cobra.Command, m extensions.ExtensionManager, extDir string) error {
-	extName := filepath.Base(extDir)
-	if !strings.HasPrefix(extName, "gh-") {
-		return errors.New("extension directory name must start with `gh-`")
-	}
-
-	commandName := strings.TrimPrefix(extName, "gh-")
-	if c, _, _ := rootCmd.Find([]string{commandName}); c != rootCmd && c.GroupID != "extension" {
-		return fmt.Errorf("%q matches the name of a built-in command or alias", commandName)
-	}
-
-	for _, ext := range m.List() {
-		if ext.Name() == commandName {
-			return fmt.Errorf("there is already an installed extension that provides the %q command", commandName)
-		}
-	}
-
-	return nil
-}
-
 func checkValidExtension(rootCmd *cobra.Command, m extensions.ExtensionManager, extName, extOwner string) (extensions.Extension, error) {
 	if !strings.HasPrefix(extName, "gh-") {
-		return nil, errors.New("extension repository name must start with `gh-`")
+		return nil, errors.New("extension name must start with `gh-`")
 	}
 
 	commandName := strings.TrimPrefix(extName, "gh-")
@@ -676,7 +656,7 @@ func checkValidExtension(rootCmd *cobra.Command, m extensions.ExtensionManager,
 
 	for _, ext := range m.List() {
 		if ext.Name() == commandName {
-			if ext.Owner() == extOwner {
+			if ext.Owner() != "" && ext.Owner() == extOwner {
 				return ext, alreadyInstalledError
 			}
 			return ext, fmt.Errorf("there is already an installed extension that provides the %q command", commandName)
diff --git a/pkg/cmd/extension/command_test.go b/pkg/cmd/extension/command_test.go
index bddfdb93d..28364a685 100644
--- a/pkg/cmd/extension/command_test.go
+++ b/pkg/cmd/extension/command_test.go
@@ -1030,7 +1030,7 @@ func Test_checkValidExtension(t *testing.T) {
 	}
 }
 
-func Test_checkValidLocalExtension(t *testing.T) {
+func Test_checkValidExtensionWithLocalExtension(t *testing.T) {
 	fakeRootCmd := &cobra.Command{}
 	fakeRootCmd.AddCommand(&cobra.Command{Use: "help"})
 	fakeRootCmd.AddCommand(&cobra.Command{Use: "auth"})
@@ -1077,7 +1077,7 @@ func Test_checkValidLocalExtension(t *testing.T) {
 				manager: m,
 				dir:     "some/install/dir/hello",
 			},
-			wantError: "extension directory name must start with `gh-`",
+			wantError: "extension name must start with `gh-`",
 		},
 		{
 			name: "clashes with built-in command",
@@ -1100,7 +1100,7 @@ func Test_checkValidLocalExtension(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := checkValidLocalExtension(tt.args.rootCmd, tt.args.manager, tt.args.dir)
+			_, err := checkValidExtension(tt.args.rootCmd, tt.args.manager, filepath.Base(tt.args.dir), "")
 			if tt.wantError == "" {
 				assert.NoError(t, err)
 			} else {

From 35aa8521c4db48ea74075a73b58018ce1caaff8b Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 21 Oct 2024 12:47:14 -0600
Subject: [PATCH 248/301] Fix tests for invalid extension name

---
 pkg/cmd/extension/command_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/extension/command_test.go b/pkg/cmd/extension/command_test.go
index 28364a685..e26e70690 100644
--- a/pkg/cmd/extension/command_test.go
+++ b/pkg/cmd/extension/command_test.go
@@ -985,7 +985,7 @@ func Test_checkValidExtension(t *testing.T) {
 				extOwner: "monalisa",
 				extName:  "gherkins",
 			},
-			wantError: "extension repository name must start with `gh-`",
+			wantError: "extension name must start with `gh-`",
 		},
 		{
 			name: "clashes with built-in command",

From daec7a0e0eadfee789b38e610bd73f781220043c Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Mon, 21 Oct 2024 13:28:37 -0600
Subject: [PATCH 249/301] Check extOwner for no value instead

---
 pkg/cmd/extension/command.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/extension/command.go b/pkg/cmd/extension/command.go
index ded90cbe4..30a7cb508 100644
--- a/pkg/cmd/extension/command.go
+++ b/pkg/cmd/extension/command.go
@@ -656,7 +656,7 @@ func checkValidExtension(rootCmd *cobra.Command, m extensions.ExtensionManager,
 
 	for _, ext := range m.List() {
 		if ext.Name() == commandName {
-			if ext.Owner() != "" && ext.Owner() == extOwner {
+			if extOwner != "" && ext.Owner() == extOwner {
 				return ext, alreadyInstalledError
 			}
 			return ext, fmt.Errorf("there is already an installed extension that provides the %q command", commandName)

From 6192ac74df5a583fb487f3f248064738e9fa9b32 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Mon, 21 Oct 2024 16:02:26 -0400
Subject: [PATCH 250/301] Update variable testscripts based on secret

This commit refactors a bit of the variable testscripts given the changes in the secret testscripts efforts, removing potentially unnecessary assertions and making these look more similar to other testscripts.
---
 .../testdata/variable/variable-org.txtar      | 20 +++++++--------
 .../testdata/variable/variable-repo-env.txtar | 25 +++++++++----------
 .../testdata/variable/variable-repo.txtar     | 17 ++++++-------
 3 files changed, 30 insertions(+), 32 deletions(-)

diff --git a/acceptance/testdata/variable/variable-org.txtar b/acceptance/testdata/variable/variable-org.txtar
index 370e63b0d..c09381b29 100644
--- a/acceptance/testdata/variable/variable-org.txtar
+++ b/acceptance/testdata/variable/variable-org.txtar
@@ -1,20 +1,20 @@
-# Prepare organization variable, GitHub Actions uppercases names
-env2upper ORG_VARIABLE_NAME=$RANDOM_STRING
+# Setup environment variables used for testscript
+env2upper VAR_NAME=${SCRIPT_NAME}_${RANDOM_STRING}
 
 # Confirm organization variable does not exist, will fail admin:org scope missing
-! exec gh variable get $ORG_VARIABLE_NAME --org $ORG
-stderr 'variable .+ was not found'
+exec gh variable list --org $ORG
+! stdout $VAR_NAME
 
 # Create an organization variable
-exec gh variable set $ORG_VARIABLE_NAME --org $ORG --body 'just an org variable'
+exec gh variable set $VAR_NAME --org $ORG --body 'just an org variable'
 
 # Defer organization variable cleanup
-defer gh variable delete $ORG_VARIABLE_NAME --org $ORG
+defer gh variable delete $VAR_NAME --org $ORG
 
-# Confirm organization variable exists
+# Verify new organization variable exists
 exec gh variable list --org $ORG
-stdout $ORG_VARIABLE_NAME
+stdout $VAR_NAME
 
-# Verify repository environment variable can be retrieved
-exec gh variable get $ORG_VARIABLE_NAME --org $ORG
+# Verify organization variable can be retrieved
+exec gh variable get $VAR_NAME --org $ORG
 stdout 'just an org variable'
diff --git a/acceptance/testdata/variable/variable-repo-env.txtar b/acceptance/testdata/variable/variable-repo-env.txtar
index f4b11c3dd..99dbb6b9f 100644
--- a/acceptance/testdata/variable/variable-repo-env.txtar
+++ b/acceptance/testdata/variable/variable-repo-env.txtar
@@ -1,6 +1,7 @@
-# Force GitHub CLI to treat testscript as TTY
-env GH_FORCE_TTY=80
-env REPO=$SCRIPT_NAME-$RANDOM_STRING
+# Setup environment variables used for testscript
+env REPO=${SCRIPT_NAME}-${RANDOM_STRING}
+env ENV_NAME=testscripts
+env VAR_NAME=TESTSCRIPTS_ENV
 
 # Create a repository where the variable will be registered
 exec gh repo create $ORG/$REPO --add-readme --private
@@ -13,21 +14,19 @@ exec gh repo clone $ORG/$REPO
 cd $REPO
 
 # Create a repository environment, will fail if organization does not have environment support
-exec gh api /repos/$ORG/$REPO/environments/testscripts -X PUT --jq '.name'
-stdout 'testscripts'
+exec gh api /repos/$ORG/$REPO/environments/$ENV_NAME -X PUT --jq '.name'
 
-# Verify no repository environment variables exist
-exec gh variable list --env testscripts
-stderr 'no variables found'
+# Verify repository environment variable does not exist
+exec gh variable list --env $ENV_NAME
+! stdout $VAR_NAME
 
 # Create a repository environment variable
-exec gh variable set TESTSCRIPTS_ENV --env testscripts --body 'just a repo env variable'
-stdout 'Created variable TESTSCRIPTS_ENV for'
+exec gh variable set $VAR_NAME --env $ENV_NAME --body 'just a repo env variable'
 
 # Verify new repository environment variable exists
-exec gh variable list --env testscripts
-stdout 'TESTSCRIPTS_ENV\s+just a repo env variable\s+less than a minute ago'
+exec gh variable list --env $ENV_NAME
+stdout $VAR_NAME
 
 # Verify repository environment variable can be retrieved
-exec gh variable get TESTSCRIPTS_ENV --env testscripts
+exec gh variable get $VAR_NAME --env $ENV_NAME
 stdout 'just a repo env variable'
diff --git a/acceptance/testdata/variable/variable-repo.txtar b/acceptance/testdata/variable/variable-repo.txtar
index f6295b566..9ff64db0f 100644
--- a/acceptance/testdata/variable/variable-repo.txtar
+++ b/acceptance/testdata/variable/variable-repo.txtar
@@ -1,6 +1,6 @@
-# Setup environment variables to force TTY
-env GH_FORCE_TTY=80
-env REPO=$SCRIPT_NAME-$RANDOM_STRING
+# Setup environment variables used for testscript
+env REPO=${SCRIPT_NAME}-${RANDOM_STRING}
+env VAR_NAME=TESTSCRIPTS
 
 # Create a repository where the variable will be registered
 exec gh repo create $ORG/$REPO --add-readme --private
@@ -12,18 +12,17 @@ defer gh repo delete --yes $ORG/$REPO
 exec gh repo clone $ORG/$REPO
 cd $REPO
 
-# Verify no repository variables exist
+# Verify repository variable does not exist
 exec gh variable list
-stderr 'no variables found'
+! stdout $VAR_NAME
 
 # Create a repository variable
-exec gh variable set TESTSCRIPTS --body 'just a repo variable'
-stdout 'Created variable TESTSCRIPTS for'
+exec gh variable set $VAR_NAME --body 'just a repo variable'
 
 # Verify new repository variable exists
 exec gh variable list
-stdout 'TESTSCRIPTS\s+just a repo variable\s+less than a minute ago'
+stdout $VAR_NAME
 
 # Verify repository variable can be retrieved
-exec gh variable get TESTSCRIPTS
+exec gh variable get $VAR_NAME
 stdout 'just a repo variable'

From 665e814c5d17d21ce35dec1074081b6c14fb2136 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 12:58:00 -0700
Subject: [PATCH 251/301] Setup acceptance testing for auth and tests for
 auth-token and auth-status

---
 acceptance/acceptance_test.go              | 9 +++++++++
 acceptance/testdata/auth/auth-status.txtar | 3 +++
 acceptance/testdata/auth/auth-token.txtar  | 3 +++
 3 files changed, 15 insertions(+)
 create mode 100644 acceptance/testdata/auth/auth-status.txtar
 create mode 100644 acceptance/testdata/auth/auth-token.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 017e6e62b..8804b1534 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -63,6 +63,15 @@ func TestAPI(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "api"))
 }
 
+func TestAuth(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "auth"))
+}
+
 func TestReleases(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
diff --git a/acceptance/testdata/auth/auth-status.txtar b/acceptance/testdata/auth/auth-status.txtar
new file mode 100644
index 000000000..da3011d1a
--- /dev/null
+++ b/acceptance/testdata/auth/auth-status.txtar
@@ -0,0 +1,3 @@
+# Check the authentication status
+exec gh auth status --hostname $GH_HOST
+stdout $GH_HOST
\ No newline at end of file
diff --git a/acceptance/testdata/auth/auth-token.txtar b/acceptance/testdata/auth/auth-token.txtar
new file mode 100644
index 000000000..614d11817
--- /dev/null
+++ b/acceptance/testdata/auth/auth-token.txtar
@@ -0,0 +1,3 @@
+# Check authentication token
+exec gh auth token --hostname $GH_HOST
+stdout $GH_TOKEN
\ No newline at end of file

From 52daa9cf7d6f446726e11061e0525377d50d3843 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 18 Oct 2024 14:59:15 -0700
Subject: [PATCH 252/301] Add --token flag to `gh auth login` to accept a PAT
 as a flag

Additionally, this commit adds acceptance testing for `gh auth login` and
`gh auth logout`.

The --token flag was necessary for adding testing for `gh auth login`
because the current implementation with `--with-token` appears to be
broken. It hangs, waiting for user input, but user input doesn't exit it.

Additionally, it appears that `--with-token` is intended to allow for TTY
input of an auth token, but it isn't implemented.

`--with-token` does work when used with the redirect operator `<` when the
token is saved in a file. However, due to limitations of testscripts, I
could not use a file for saving the token in a repeatable manner. Thus,
implementing the `--token` flag seemed like a quick solution to validate
that the direction I was going during testing was valid.

Whether the flag stays or not is up for discussion, and I'd love to get
input on that from the team.
---
 acceptance/acceptance_test.go                 | 26 ++++++++++++++++-
 .../testdata/auth/auth-login-logout.txtar     | 29 +++++++++++++++++++
 pkg/cmd/auth/login/login.go                   | 15 ++++++----
 pkg/cmd/auth/logout/logout.go                 |  1 +
 4 files changed, 65 insertions(+), 6 deletions(-)
 create mode 100644 acceptance/testdata/auth/auth-login-logout.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 8804b1534..3c2b3358b 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -95,7 +95,7 @@ func TestRepo(t *testing.T) {
 	if err := tsEnv.fromEnv(); err != nil {
 		t.Fatal(err)
 	}
-  
+
 	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
 }
 
@@ -240,6 +240,30 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 
 			ts.Check(os.WriteFile(src, data, mode))
 		},
+		// perhaps these need to be extracted to different files, soon?
+		// I'm prompted to ask because "deleteEnvVar" could just be
+		// syntactic sugar for setEnvVar with an empty value. Can't do that
+		// with the current implementation
+		"deleteEnvVar": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! deleteEnvVar")
+			}
+			if len(args) != 1 {
+				ts.Fatalf("usage: deleteEnvVar name")
+			}
+
+			ts.Setenv(args[0], "")
+		},
+		"setEnvVar": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! setEnvVar")
+			}
+			if len(args) != 2 {
+				ts.Fatalf("usage: setEnvVar name value")
+			}
+
+			ts.Setenv(args[0], args[1])
+		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! stdout2env")
diff --git a/acceptance/testdata/auth/auth-login-logout.txtar b/acceptance/testdata/auth/auth-login-logout.txtar
new file mode 100644
index 000000000..3e46d4a0f
--- /dev/null
+++ b/acceptance/testdata/auth/auth-login-logout.txtar
@@ -0,0 +1,29 @@
+# We aren't logged in at the moment, but GH_HOST will override the
+# need to login. We are going to clear GH_HOST first to ensure no
+# overrides are happening
+
+# Copy $GH_TOKEN to a new env var
+setEnvVar LOGIN_TOKEN $GH_TOKEN
+exec echo $LOGIN_TOKEN
+stdout $GH_TOKEN
+
+# Remove GH_TOKEN env var so we don't fall back to it
+deleteEnvVar GH_TOKEN
+
+# Ensure the token was deleted
+exec echo $GH_TOKEN
+! stdout '.'
+
+# Login to the host
+exec gh auth login --hostname=$GH_HOST --with-token --token=$LOGIN_TOKEN --insecure-storage
+
+# Check that we are logged in
+exec gh auth status --hostname $GH_HOST
+stdout $GH_HOST
+
+# Logout of the host
+exec gh auth logout --hostname $GH_HOST
+stderr 'Logged out of'
+
+# Check that we are logged out
+! exec gh auth status --hostname $GH_HOST
diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index 653c9e6c0..eb0b2e1c4 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -104,14 +104,18 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 			}
 
 			if tokenStdin {
-				defer opts.IO.In.Close()
-				token, err := io.ReadAll(opts.IO.In)
-				if err != nil {
-					return fmt.Errorf("failed to read token from standard input: %w", err)
+				if opts.Token == "" {
+					defer opts.IO.In.Close()
+					token, err := io.ReadAll(opts.IO.In)
+					if err != nil {
+						return fmt.Errorf("failed to read token from standard input: %w", err)
+					}
+					opts.Token = strings.TrimSpace(string(token))
 				}
-				opts.Token = strings.TrimSpace(string(token))
 			}
 
+			// I think this is dead code because the token will always be set if we make it past
+			// the conditional above (lines 106-115)
 			if opts.IO.CanPrompt() && opts.Token == "" {
 				opts.Interactive = true
 			}
@@ -139,6 +143,7 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 	cmd.Flags().StringSliceVarP(&opts.Scopes, "scopes", "s", nil, "Additional authentication scopes to request")
 	cmd.Flags().BoolVar(&tokenStdin, "with-token", false, "Read token from standard input")
 	cmd.Flags().BoolVarP(&opts.Web, "web", "w", false, "Open a browser to authenticate")
+	cmd.Flags().StringVarP(&opts.Token, "token", "t", "", "Authenticate using a personal access token")
 	cmdutil.StringEnumFlag(cmd, &opts.GitProtocol, "git-protocol", "p", "", []string{"ssh", "https"}, "The protocol to use for git operations on this host")
 
 	// secure storage became the default on 2023/4/04; this flag is left as a no-op for backwards compatibility
diff --git a/pkg/cmd/auth/logout/logout.go b/pkg/cmd/auth/logout/logout.go
index ef978ebac..f1eaa4e24 100644
--- a/pkg/cmd/auth/logout/logout.go
+++ b/pkg/cmd/auth/logout/logout.go
@@ -58,6 +58,7 @@ func NewCmdLogout(f *cmdutil.Factory, runF func(*LogoutOptions) error) *cobra.Co
 	}
 
 	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "The hostname of the GitHub instance to log out of")
+	// This flag doesn't seem to be working with --user but it is working with -u in acceptance testing
 	cmd.Flags().StringVarP(&opts.Username, "user", "u", "", "The account to log out of")
 
 	return cmd

From aaf4c4e4e3a3c91f5d7a5f87e197bf0de4b59476 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 21 Oct 2024 09:22:27 -0700
Subject: [PATCH 253/301] Clean up auth-login-logout acceptance test with
 native functionality

The previous commit introduced two new functions, setEnvVar and
deleteEnvVar that are duplicative of functionality native to testscripts.
This commit switches to the native functionality and removes the
duplicative functions introduced in the previous commit.

Additionally, it removes the `--token` flag that was added to
`gh auth login`
---
 acceptance/acceptance_test.go                 | 24 -------------------
 .../testdata/auth/auth-login-logout.txtar     | 10 ++++----
 pkg/cmd/auth/login/login.go                   | 15 ++++--------
 3 files changed, 11 insertions(+), 38 deletions(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 3c2b3358b..dd5b8b0d1 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -240,30 +240,6 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 
 			ts.Check(os.WriteFile(src, data, mode))
 		},
-		// perhaps these need to be extracted to different files, soon?
-		// I'm prompted to ask because "deleteEnvVar" could just be
-		// syntactic sugar for setEnvVar with an empty value. Can't do that
-		// with the current implementation
-		"deleteEnvVar": func(ts *testscript.TestScript, neg bool, args []string) {
-			if neg {
-				ts.Fatalf("unsupported: ! deleteEnvVar")
-			}
-			if len(args) != 1 {
-				ts.Fatalf("usage: deleteEnvVar name")
-			}
-
-			ts.Setenv(args[0], "")
-		},
-		"setEnvVar": func(ts *testscript.TestScript, neg bool, args []string) {
-			if neg {
-				ts.Fatalf("unsupported: ! setEnvVar")
-			}
-			if len(args) != 2 {
-				ts.Fatalf("usage: setEnvVar name value")
-			}
-
-			ts.Setenv(args[0], args[1])
-		},
 		"stdout2env": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! stdout2env")
diff --git a/acceptance/testdata/auth/auth-login-logout.txtar b/acceptance/testdata/auth/auth-login-logout.txtar
index 3e46d4a0f..3933ce1da 100644
--- a/acceptance/testdata/auth/auth-login-logout.txtar
+++ b/acceptance/testdata/auth/auth-login-logout.txtar
@@ -3,19 +3,21 @@
 # overrides are happening
 
 # Copy $GH_TOKEN to a new env var
-setEnvVar LOGIN_TOKEN $GH_TOKEN
+env LOGIN_TOKEN=$GH_TOKEN
 exec echo $LOGIN_TOKEN
 stdout $GH_TOKEN
 
 # Remove GH_TOKEN env var so we don't fall back to it
-deleteEnvVar GH_TOKEN
+env GH_TOKEN=''
 
 # Ensure the token was deleted
 exec echo $GH_TOKEN
 ! stdout '.'
 
-# Login to the host
-exec gh auth login --hostname=$GH_HOST --with-token --token=$LOGIN_TOKEN --insecure-storage
+# Login to the host by feeding the token to stdin
+exec echo $LOGIN_TOKEN
+stdin stdout
+exec gh auth login --hostname=$GH_HOST --with-token --insecure-storage
 
 # Check that we are logged in
 exec gh auth status --hostname $GH_HOST
diff --git a/pkg/cmd/auth/login/login.go b/pkg/cmd/auth/login/login.go
index eb0b2e1c4..653c9e6c0 100644
--- a/pkg/cmd/auth/login/login.go
+++ b/pkg/cmd/auth/login/login.go
@@ -104,18 +104,14 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 			}
 
 			if tokenStdin {
-				if opts.Token == "" {
-					defer opts.IO.In.Close()
-					token, err := io.ReadAll(opts.IO.In)
-					if err != nil {
-						return fmt.Errorf("failed to read token from standard input: %w", err)
-					}
-					opts.Token = strings.TrimSpace(string(token))
+				defer opts.IO.In.Close()
+				token, err := io.ReadAll(opts.IO.In)
+				if err != nil {
+					return fmt.Errorf("failed to read token from standard input: %w", err)
 				}
+				opts.Token = strings.TrimSpace(string(token))
 			}
 
-			// I think this is dead code because the token will always be set if we make it past
-			// the conditional above (lines 106-115)
 			if opts.IO.CanPrompt() && opts.Token == "" {
 				opts.Interactive = true
 			}
@@ -143,7 +139,6 @@ func NewCmdLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Comm
 	cmd.Flags().StringSliceVarP(&opts.Scopes, "scopes", "s", nil, "Additional authentication scopes to request")
 	cmd.Flags().BoolVar(&tokenStdin, "with-token", false, "Read token from standard input")
 	cmd.Flags().BoolVarP(&opts.Web, "web", "w", false, "Open a browser to authenticate")
-	cmd.Flags().StringVarP(&opts.Token, "token", "t", "", "Authenticate using a personal access token")
 	cmdutil.StringEnumFlag(cmd, &opts.GitProtocol, "git-protocol", "p", "", []string{"ssh", "https"}, "The protocol to use for git operations on this host")
 
 	// secure storage became the default on 2023/4/04; this flag is left as a no-op for backwards compatibility

From a923e33421c03115202bd79ab1d942ff2c228a69 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Tue, 22 Oct 2024 13:38:51 +0200
Subject: [PATCH 254/301] Test json flags for repo view and list

---
 pkg/cmd/repo/list/list_test.go | 73 ++++++++++++++++++++++++++++++++++
 pkg/cmd/repo/view/view_test.go | 73 ++++++++++++++++++++++++++++++++++
 2 files changed, 146 insertions(+)

diff --git a/pkg/cmd/repo/list/list_test.go b/pkg/cmd/repo/list/list_test.go
index bd51cadfc..93b5a7ed7 100644
--- a/pkg/cmd/repo/list/list_test.go
+++ b/pkg/cmd/repo/list/list_test.go
@@ -19,9 +19,82 @@ import (
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/httpmock"
 	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/cli/cli/v2/pkg/jsonfieldstest"
 	"github.com/cli/cli/v2/test"
 )
 
+func TestJSONFields(t *testing.T) {
+	jsonfieldstest.ExpectCommandToSupportJSONFields(t, NewCmdList, []string{
+		"archivedAt",
+		"assignableUsers",
+		"codeOfConduct",
+		"contactLinks",
+		"createdAt",
+		"defaultBranchRef",
+		"deleteBranchOnMerge",
+		"description",
+		"diskUsage",
+		"forkCount",
+		"fundingLinks",
+		"hasDiscussionsEnabled",
+		"hasIssuesEnabled",
+		"hasProjectsEnabled",
+		"hasWikiEnabled",
+		"homepageUrl",
+		"id",
+		"isArchived",
+		"isBlankIssuesEnabled",
+		"isEmpty",
+		"isFork",
+		"isInOrganization",
+		"isMirror",
+		"isPrivate",
+		"isSecurityPolicyEnabled",
+		"isTemplate",
+		"isUserConfigurationRepository",
+		"issueTemplates",
+		"issues",
+		"labels",
+		"languages",
+		"latestRelease",
+		"licenseInfo",
+		"mentionableUsers",
+		"mergeCommitAllowed",
+		"milestones",
+		"mirrorUrl",
+		"name",
+		"nameWithOwner",
+		"openGraphImageUrl",
+		"owner",
+		"parent",
+		"primaryLanguage",
+		"projects",
+		"projectsV2",
+		"pullRequestTemplates",
+		"pullRequests",
+		"pushedAt",
+		"rebaseMergeAllowed",
+		"repositoryTopics",
+		"securityPolicyUrl",
+		"sshUrl",
+		"squashMergeAllowed",
+		"stargazerCount",
+		"templateRepository",
+		"updatedAt",
+		"url",
+		"usesCustomOpenGraphImage",
+		"viewerCanAdminister",
+		"viewerDefaultCommitEmail",
+		"viewerDefaultMergeMethod",
+		"viewerHasStarred",
+		"viewerPermission",
+		"viewerPossibleCommitEmails",
+		"viewerSubscription",
+		"visibility",
+		"watchers",
+	})
+}
+
 func TestNewCmdList(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/pkg/cmd/repo/view/view_test.go b/pkg/cmd/repo/view/view_test.go
index 53ec93d13..f07f9de18 100644
--- a/pkg/cmd/repo/view/view_test.go
+++ b/pkg/cmd/repo/view/view_test.go
@@ -16,10 +16,83 @@ import (
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/httpmock"
 	"github.com/cli/cli/v2/pkg/iostreams"
+	"github.com/cli/cli/v2/pkg/jsonfieldstest"
 	"github.com/google/shlex"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestJSONFields(t *testing.T) {
+	jsonfieldstest.ExpectCommandToSupportJSONFields(t, NewCmdView, []string{
+		"archivedAt",
+		"assignableUsers",
+		"codeOfConduct",
+		"contactLinks",
+		"createdAt",
+		"defaultBranchRef",
+		"deleteBranchOnMerge",
+		"description",
+		"diskUsage",
+		"forkCount",
+		"fundingLinks",
+		"hasDiscussionsEnabled",
+		"hasIssuesEnabled",
+		"hasProjectsEnabled",
+		"hasWikiEnabled",
+		"homepageUrl",
+		"id",
+		"isArchived",
+		"isBlankIssuesEnabled",
+		"isEmpty",
+		"isFork",
+		"isInOrganization",
+		"isMirror",
+		"isPrivate",
+		"isSecurityPolicyEnabled",
+		"isTemplate",
+		"isUserConfigurationRepository",
+		"issueTemplates",
+		"issues",
+		"labels",
+		"languages",
+		"latestRelease",
+		"licenseInfo",
+		"mentionableUsers",
+		"mergeCommitAllowed",
+		"milestones",
+		"mirrorUrl",
+		"name",
+		"nameWithOwner",
+		"openGraphImageUrl",
+		"owner",
+		"parent",
+		"primaryLanguage",
+		"projects",
+		"projectsV2",
+		"pullRequestTemplates",
+		"pullRequests",
+		"pushedAt",
+		"rebaseMergeAllowed",
+		"repositoryTopics",
+		"securityPolicyUrl",
+		"sshUrl",
+		"squashMergeAllowed",
+		"stargazerCount",
+		"templateRepository",
+		"updatedAt",
+		"url",
+		"usesCustomOpenGraphImage",
+		"viewerCanAdminister",
+		"viewerDefaultCommitEmail",
+		"viewerDefaultMergeMethod",
+		"viewerHasStarred",
+		"viewerPermission",
+		"viewerPossibleCommitEmails",
+		"viewerSubscription",
+		"visibility",
+		"watchers",
+	})
+}
+
 func TestNewCmdView(t *testing.T) {
 	tests := []struct {
 		name     string

From 04add8d68fed057dafdb12f66de421be0d674fef Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 22 Oct 2024 10:50:00 -0600
Subject: [PATCH 255/301] Use new GitHub previews terminology in attestation

Update attestations commands to align with new GitHub previews terminology, replacing `beta` with `public preview`.

https://github.blog/changelog/2024-10-18-new-terminology-for-github-previews/
---
 pkg/cmd/attestation/download/download.go       | 2 +-
 pkg/cmd/attestation/inspect/inspect.go         | 2 +-
 pkg/cmd/attestation/trustedroot/trustedroot.go | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/download/download.go b/pkg/cmd/attestation/download/download.go
index 770fa442b..77c928093 100644
--- a/pkg/cmd/attestation/download/download.go
+++ b/pkg/cmd/attestation/download/download.go
@@ -24,7 +24,7 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 		Args:  cmdutil.ExactArgs(1, "must specify file path or container image URI, as well as one of --owner or --repo"),
 		Short: "Download an artifact's attestations for offline use",
 		Long: heredoc.Docf(`
-			### NOTE: This feature is currently in beta, and subject to change.
+			### NOTE: This feature is currently in public preview, and subject to change.
 
 			Download attestations associated with an artifact for offline use.
 
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index c548b2ec7..c139a5af2 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -26,7 +26,7 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 		Hidden: true,
 		Short:  "Inspect a sigstore bundle",
 		Long: heredoc.Docf(`
-			### NOTE: This feature is currently in beta, and subject to change.
+			### NOTE: This feature is currently in public preview, and subject to change.
 
 			Inspect a downloaded Sigstore bundle for a given artifact.
 
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index c092b81ec..1a40aae3f 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -35,7 +35,7 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 		Args:  cobra.ExactArgs(0),
 		Short: "Output trusted_root.jsonl contents, likely for offline verification",
 		Long: heredoc.Docf(`
-			### NOTE: This feature is currently in beta, and subject to change.
+			### NOTE: This feature is currently in public preview, and subject to change.
 
 			Output contents for a trusted_root.jsonl file, likely for offline verification.
 

From abb2772696499340ba6aa0dee0ef0d1a0db053ae Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 22 Oct 2024 10:56:39 -0600
Subject: [PATCH 256/301] Use new GitHub preview terms in working-with-us.md

Update the "working with us" docs to align with new GitHub previews terminology, replacing `beta` with `public preview`.

https://github.blog/changelog/2024-10-18-new-terminology-for-github-previews/
---
 docs/working-with-us.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/working-with-us.md b/docs/working-with-us.md
index 38326921e..fefacf103 100644
--- a/docs/working-with-us.md
+++ b/docs/working-with-us.md
@@ -25,13 +25,13 @@ Describe how your new command would be used. Include mock-up examples, including
 
 We take this step seriously because we believe in keeping `gh`'s interface consistent and intuitive.
 
-## Step 2: Beta
+## Step 2: Public Preview
 
-Once we've signed off on the proposed UX on the issue opened in step 1, develop your extension to at least beta quality. It's up to you if you actually want to go through a beta release phase with real users or not.
+Once we've signed off on the proposed UX on the issue opened in step 1, develop your extension to at least public preview quality. It's up to you if you actually want to go through a public preview release phase with real users or not.
 
 ## Step 3: Merge or no merge
 
-With a beta in hand it's time to decide whether or not to mainline your extension into the `trunk` of `gh`. Some questions to consider:
+With a public preview in hand it's time to decide whether or not to mainline your extension into the `trunk` of `gh`. Some questions to consider:
 
 - How complex is the support burden for your feature?
 

From 2433475d3fe0d5d9460e3d66715647cbfa06ef1d Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Wed, 23 Oct 2024 14:13:26 +0200
Subject: [PATCH 257/301] Use forked testscript for token redaction

---
 go.mod |  6 ++++--
 go.sum | 12 ++++++------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/go.mod b/go.mod
index 76a7818f8..423a1581d 100644
--- a/go.mod
+++ b/go.mod
@@ -158,12 +158,14 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
-	golang.org/x/mod v0.20.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
 	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/tools v0.22.0 // indirect
+	golang.org/x/tools v0.26.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
+
+replace github.com/rogpeppe/go-internal => github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e
diff --git a/go.sum b/go.sum
index 848747498..e7c2df3de 100644
--- a/go.sum
+++ b/go.sum
@@ -97,6 +97,8 @@ github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cli/go-gh/v2 v2.11.0 h1:TERLYMMWderKBO3lBff/JIu2+eSly2oFRgN2WvO+3eA=
 github.com/cli/go-gh/v2 v2.11.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
+github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e h1:cBNrtspNE3osGbSV9TSdG0KzHKt0lpv+J+GQN5SYdYk=
+github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e/go.mod h1:S8kfXMp+yh77OxPD4fdM6YUknrZpQxLhvxzS4gDHENY=
 github.com/cli/oauth v1.1.1 h1:459gD3hSjlKX9B1uXBuiAMdpXBUQ9QGf/NDcCpoQxPs=
 github.com/cli/oauth v1.1.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
@@ -366,8 +368,6 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rodaine/table v1.0.1 h1:U/VwCnUxlVYxw8+NJiLIuCxA/xa6jL38MY3FYysVWWQ=
 github.com/rodaine/table v1.0.1/go.mod h1:UVEtfBsflpeEcD56nF4F5AocNFta0ZuolpSVdPtlmP4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
@@ -491,8 +491,8 @@ golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
-golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -533,8 +533,8 @@ golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
-golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.172.0 h1:/1OcMZGPmW1rX2LCu2CmGUD1KXK1+pfzxotxyRUCCdk=
 google.golang.org/api v0.172.0/go.mod h1:+fJZq6QXWfa9pXhnIzsjx4yI22d4aI9ZpLb58gvXjis=

From 0614d85027c0b05f2c2a37a2f88352d9c51bda8d Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 21 Oct 2024 15:21:47 -0700
Subject: [PATCH 258/301] Add acceptance tests for auth-setup-git and
 formattedStringToEnv helper func

To test this, I decided to look into the .gitconfig used for the test and
examine the credential helpers. However, the format of the git command is

`git config --get credential.<URL>.helper`

What's awkward about this is that the <URL> depends on the host the user
specified when running the tests, meaning I'd need to create a key like
credential.https://github.com.helper to access what I need while setting
this up.

There was no functionality for string formatting before, so I added the
command formattedStringToEnv which essentially wraps fmt.Sprintf() and
saves the string to an environment variable.

This allowed me to dynamically create the config key in the test.
---
 acceptance/acceptance_test.go                 | 19 +++++++++++++++++++
 acceptance/testdata/auth/auth-setup-git.txtar | 13 +++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 acceptance/testdata/auth/auth-setup-git.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index dd5b8b0d1..ace985af6 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -203,6 +203,17 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				ts.Setenv(env[:i], strings.ToUpper(env[i+1:]))
 			}
 		},
+		// Creates a formatted string using standard fmt.Sprintf syntax
+		// and sets it as an environment variable of the given name.
+		"formattedStringToEnv": func(ts *testscript.TestScript, neg bool, args []string) {
+			if neg {
+				ts.Fatalf("unsupported: ! formattedStringToEnv")
+			}
+			if len(args) < 3 {
+				ts.Fatalf("usage: formattedStringToEnv name string args...")
+			}
+			ts.Setenv(args[0], fmt.Sprintf(args[1], toAnySlice(args[2:])...))
+		},
 		"replace": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! replace")
@@ -270,6 +281,14 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 	}
 }
 
+func toAnySlice(strings []string) []any {
+	anys := make([]any, len(strings))
+	for i, s := range strings {
+		anys[i] = s
+	}
+	return anys
+}
+
 var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
 
 func randomString(n int) string {
diff --git a/acceptance/testdata/auth/auth-setup-git.txtar b/acceptance/testdata/auth/auth-setup-git.txtar
new file mode 100644
index 000000000..84794ae8f
--- /dev/null
+++ b/acceptance/testdata/auth/auth-setup-git.txtar
@@ -0,0 +1,13 @@
+# Setup the credential key name string
+formattedStringToEnv CREDENTIAL_HELPER_KEY 'credential.https://%s.helper' $GH_HOST
+
+# Check that the credential helper is unset for the host. This command is
+# expected to fail before gh auth setup-git is run.
+! exec git config --get $CREDENTIAL_HELPER_KEY
+
+# Run the setup-git command
+exec gh auth setup-git
+
+# Check that the credential helper is set to gh
+exec git config --get $CREDENTIAL_HELPER_KEY
+stdout gh

From 59aedc4e89c4aa359c87c55ad17b2a38233bb008 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Mon, 21 Oct 2024 16:09:58 -0700
Subject: [PATCH 259/301] Remove comment from gh auth logout

---
 pkg/cmd/auth/logout/logout.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/cmd/auth/logout/logout.go b/pkg/cmd/auth/logout/logout.go
index f1eaa4e24..ef978ebac 100644
--- a/pkg/cmd/auth/logout/logout.go
+++ b/pkg/cmd/auth/logout/logout.go
@@ -58,7 +58,6 @@ func NewCmdLogout(f *cmdutil.Factory, runF func(*LogoutOptions) error) *cobra.Co
 	}
 
 	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "The hostname of the GitHub instance to log out of")
-	// This flag doesn't seem to be working with --user but it is working with -u in acceptance testing
 	cmd.Flags().StringVarP(&opts.Username, "user", "u", "", "The account to log out of")
 
 	return cmd

From 15d86bbdf847955fe6ccd89f4f7844ab1b17cd75 Mon Sep 17 00:00:00 2001
From: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:44:13 -0600
Subject: [PATCH 260/301] Clarify `gh` is available for GitHub Enterprise Cloud

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 1ddeb1dfe..064008e3b 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 ![screenshot of gh pr status](https://user-images.githubusercontent.com/98482/84171218-327e7a80-aa40-11ea-8cd1-5177fc2d0e72.png)
 
-GitHub CLI is supported for users on GitHub.com and GitHub Enterprise Server 2.20+ with support for macOS, Windows, and Linux.
+GitHub CLI is supported for users on GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server 2.20+ with support for macOS, Windows, and Linux.
 
 ## Documentation
 

From 2b480daf7abba51332ef1493a6d19120bc4c9ddd Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Wed, 23 Oct 2024 13:56:09 -0700
Subject: [PATCH 261/301] Address PR feedback

---
 acceptance/acceptance_test.go                 | 19 -------------------
 .../testdata/auth/auth-login-logout.txtar     | 10 ++--------
 acceptance/testdata/auth/auth-setup-git.txtar |  9 +++------
 acceptance/testdata/auth/auth-status.txtar    |  2 +-
 4 files changed, 6 insertions(+), 34 deletions(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index ace985af6..dd5b8b0d1 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -203,17 +203,6 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 				ts.Setenv(env[:i], strings.ToUpper(env[i+1:]))
 			}
 		},
-		// Creates a formatted string using standard fmt.Sprintf syntax
-		// and sets it as an environment variable of the given name.
-		"formattedStringToEnv": func(ts *testscript.TestScript, neg bool, args []string) {
-			if neg {
-				ts.Fatalf("unsupported: ! formattedStringToEnv")
-			}
-			if len(args) < 3 {
-				ts.Fatalf("usage: formattedStringToEnv name string args...")
-			}
-			ts.Setenv(args[0], fmt.Sprintf(args[1], toAnySlice(args[2:])...))
-		},
 		"replace": func(ts *testscript.TestScript, neg bool, args []string) {
 			if neg {
 				ts.Fatalf("unsupported: ! replace")
@@ -281,14 +270,6 @@ func sharedCmds(tsEnv testScriptEnv) map[string]func(ts *testscript.TestScript,
 	}
 }
 
-func toAnySlice(strings []string) []any {
-	anys := make([]any, len(strings))
-	for i, s := range strings {
-		anys[i] = s
-	}
-	return anys
-}
-
 var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
 
 func randomString(n int) string {
diff --git a/acceptance/testdata/auth/auth-login-logout.txtar b/acceptance/testdata/auth/auth-login-logout.txtar
index 3933ce1da..fb25f9eb5 100644
--- a/acceptance/testdata/auth/auth-login-logout.txtar
+++ b/acceptance/testdata/auth/auth-login-logout.txtar
@@ -1,19 +1,13 @@
-# We aren't logged in at the moment, but GH_HOST will override the
-# need to login. We are going to clear GH_HOST first to ensure no
+# We aren't logged in at the moment, but GH_TOKEN will override the
+# need to login. We are going to clear GH_TOKEN first to ensure no
 # overrides are happening
 
 # Copy $GH_TOKEN to a new env var
 env LOGIN_TOKEN=$GH_TOKEN
-exec echo $LOGIN_TOKEN
-stdout $GH_TOKEN
 
 # Remove GH_TOKEN env var so we don't fall back to it
 env GH_TOKEN=''
 
-# Ensure the token was deleted
-exec echo $GH_TOKEN
-! stdout '.'
-
 # Login to the host by feeding the token to stdin
 exec echo $LOGIN_TOKEN
 stdin stdout
diff --git a/acceptance/testdata/auth/auth-setup-git.txtar b/acceptance/testdata/auth/auth-setup-git.txtar
index 84794ae8f..e3be28cd5 100644
--- a/acceptance/testdata/auth/auth-setup-git.txtar
+++ b/acceptance/testdata/auth/auth-setup-git.txtar
@@ -1,13 +1,10 @@
-# Setup the credential key name string
-formattedStringToEnv CREDENTIAL_HELPER_KEY 'credential.https://%s.helper' $GH_HOST
-
 # Check that the credential helper is unset for the host. This command is
 # expected to fail before gh auth setup-git is run.
-! exec git config --get $CREDENTIAL_HELPER_KEY
+! exec git config --get credential.https://${GH_HOST}.helper
 
 # Run the setup-git command
 exec gh auth setup-git
 
 # Check that the credential helper is set to gh
-exec git config --get $CREDENTIAL_HELPER_KEY
-stdout gh
+exec git config --get credential.https://${GH_HOST}.helper
+stdout '^.*gh auth git-credential$'
diff --git a/acceptance/testdata/auth/auth-status.txtar b/acceptance/testdata/auth/auth-status.txtar
index da3011d1a..2afee1eb6 100644
--- a/acceptance/testdata/auth/auth-status.txtar
+++ b/acceptance/testdata/auth/auth-status.txtar
@@ -1,3 +1,3 @@
 # Check the authentication status
 exec gh auth status --hostname $GH_HOST
-stdout $GH_HOST
\ No newline at end of file
+stdout '✓ Logged in to '
\ No newline at end of file

From 787a243323e779b9fecb385feb3859e4d2f0d744 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 24 Oct 2024 15:14:51 +0200
Subject: [PATCH 262/301] Update go-internal to redact more token types in
 Acceptance tests

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 423a1581d..138ef8b60 100644
--- a/go.mod
+++ b/go.mod
@@ -168,4 +168,4 @@ require (
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
 
-replace github.com/rogpeppe/go-internal => github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e
+replace github.com/rogpeppe/go-internal => github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b
diff --git a/go.sum b/go.sum
index e7c2df3de..d23e604f0 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cli/go-gh/v2 v2.11.0 h1:TERLYMMWderKBO3lBff/JIu2+eSly2oFRgN2WvO+3eA=
 github.com/cli/go-gh/v2 v2.11.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
-github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e h1:cBNrtspNE3osGbSV9TSdG0KzHKt0lpv+J+GQN5SYdYk=
-github.com/cli/go-internal v0.0.0-20241023114740-7e305b22223e/go.mod h1:S8kfXMp+yh77OxPD4fdM6YUknrZpQxLhvxzS4gDHENY=
+github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b h1:ogNz+pm9aI2Zn58V+WTMzPViN2fRVq/h2H9gwdvM09k=
+github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b/go.mod h1:S8kfXMp+yh77OxPD4fdM6YUknrZpQxLhvxzS4gDHENY=
 github.com/cli/oauth v1.1.1 h1:459gD3hSjlKX9B1uXBuiAMdpXBUQ9QGf/NDcCpoQxPs=
 github.com/cli/oauth v1.1.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=

From f27cddcb9279f0d1840b221af476a87a890c7460 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Thu, 24 Oct 2024 08:43:40 -0600
Subject: [PATCH 263/301] Add acceptance test for gpg-key

---
 acceptance/acceptance_test.go             | 11 +++++++-
 acceptance/testdata/gpg-key/gpg-key.txtar | 32 +++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 acceptance/testdata/gpg-key/gpg-key.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index bdd631703..2d9e8aeb0 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -86,7 +86,7 @@ func TestRepo(t *testing.T) {
 	if err := tsEnv.fromEnv(); err != nil {
 		t.Fatal(err)
 	}
-  
+
 	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
 }
 
@@ -108,6 +108,15 @@ func TestVariables(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "variable"))
 }
 
+func TestGPGKeys(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "gpg-key"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/gpg-key/gpg-key.txtar b/acceptance/testdata/gpg-key/gpg-key.txtar
new file mode 100644
index 000000000..dff028bab
--- /dev/null
+++ b/acceptance/testdata/gpg-key/gpg-key.txtar
@@ -0,0 +1,32 @@
+skip 'it modifies the user''s personal GitHub account GPG keys'
+
+# This test requires the admin:gpg_key scope to add and delete GPG keys to and
+# from the user's personal GitHub account. 
+# This test uses a GPG key that generated for this test only. The private key
+# has been deleted
+
+# Add the gpg key to GH account
+exec gh gpg-key add gpg-key.pub
+
+# Defer deleting the gpg key from GH account
+defer gh gpg-key delete --yes 24C30F9C9115E747
+
+# Verify the gpg key was added to GH account
+exec gh gpg-key list
+stdout 24C30F9C9115E747
+
+-- gpg-key.pub --
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEZxpWhhYJKwYBBAHaRw8BAQdAmYiobR2ai/lVWOBtlAPRG1ZEMG5Effavpt5w
+n+wQ//W0R0dIIENMSSBhY2NlcHRhbmNlIHRlc3QgKGZvciBHSCBDTEkgYWNjZXB0
+YW5jZSB0ZXN0aW5nKSA8Y2xpQGdpdGh1Yi5jb20+iJkEExYKAEEWIQTEAQLLUl1x
+MDSmbL0kww+ckRXnRwUCZxpWhgIbAwUJAAFRgAULCQgHAgIiAgYVCgkICwIEFgID
+AQIeBwIXgAAKCRAkww+ckRXnRxkuAP9GiFi/etWxRjnkomdTaOU8Ccd6oHspuEzB
+PFxOJdYslQD+MXgY5UhM/q2iEVj0tiVsfRzDqB+g2weaF5EpqIwWcQ+4OARnGlaG
+EgorBgEEAZdVAQUBAQdA3D1vnVTc9URDQw/oAd1mG/zRX7vF4QrjFqFIt7uMf2gD
+AQgHiH4EGBYKACYWIQTEAQLLUl1xMDSmbL0kww+ckRXnRwUCZxpWhgIbDAUJAAFR
+gAAKCRAkww+ckRXnRxVuAQCngnR11jh2mob0FN0rPWce2juoJsh5gPB2d7LS4r5P
+VwEA6F2FeetcP51EyKyQGTp3GpmZgk0uCGJa1G5uqT+9mgc=
+=RLWi
+-----END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file

From 4100992d4004b28c507fe638a5ef3782a9a9d22e Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 24 Oct 2024 17:00:54 +0200
Subject: [PATCH 264/301] Add Acceptance test for label command

---
 acceptance/acceptance_test.go         |  9 +++++++++
 acceptance/testdata/label/label.txtar | 25 +++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 acceptance/testdata/label/label.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 2d9e8aeb0..70ddbe4dc 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -117,6 +117,15 @@ func TestGPGKeys(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "gpg-key"))
 }
 
+func TestLabels(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "label"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/label/label.txtar b/acceptance/testdata/label/label.txtar
new file mode 100644
index 000000000..dd72133da
--- /dev/null
+++ b/acceptance/testdata/label/label.txtar
@@ -0,0 +1,25 @@
+# Setup useful env vars
+env REPO=${SCRIPT_NAME}-${RANDOM_STRING}
+
+# Create a repository
+exec gh repo create ${ORG}/${REPO} --private
+
+# Defer repo cleanup
+defer gh repo delete --yes ${ORG}/${REPO}
+
+# Set the GH_REPO env var to reduce redunant flags
+env GH_REPO=${ORG}/${REPO}
+
+# Create a custom label
+exec gh label create 'acceptance-test' --description 'First Description'
+
+# List the labels and check our custom label is there
+exec gh label list
+stdout 'acceptance-test\tFirst Description'
+
+# Edit the label
+exec gh label edit 'acceptance-test' --description 'Edited Description'
+
+# List the labels and check our custom label has been updated
+exec gh label list
+stdout 'acceptance-test\tEdited Description'

From 76e6fbba366b2e99f7841e92d6f6cc38c7226d6c Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 24 Oct 2024 17:46:17 +0200
Subject: [PATCH 265/301] Add SSH Key Acceptance test

---
 acceptance/acceptance_test.go             |  9 +++++++++
 acceptance/testdata/ssh-key/ssh-key.txtar | 24 +++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 acceptance/testdata/ssh-key/ssh-key.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 70ddbe4dc..18a3f0cef 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -126,6 +126,15 @@ func TestLabels(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "label"))
 }
 
+func TestSSHKeys(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "ssh-key"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/ssh-key/ssh-key.txtar b/acceptance/testdata/ssh-key/ssh-key.txtar
new file mode 100644
index 000000000..4ba8643bb
--- /dev/null
+++ b/acceptance/testdata/ssh-key/ssh-key.txtar
@@ -0,0 +1,24 @@
+skip 'it modifies the user''s personal GitHub account SSH keys'
+
+# scopes admin:ssh_signing_key,admin:public_key
+
+# Add an SSH key to the account
+exec gh ssh-key add sshKey.pub --title 'acceptance-test-key'
+
+# List the SSH keys
+exec gh ssh-key list
+stdout 'acceptance-test-key'
+
+# Get the ID of the key we created
+exec gh api /user/keys --jq '.[] | select(.title == "acceptance-test-key") | .id'
+stdout2env SSH_KEY_ID
+
+# Delete the SSH key
+exec gh ssh-key delete --yes ${SSH_KEY_ID}
+
+# Check the key is deleted
+exec gh ssh-key list
+! stdout 'acceptance-test-key'
+
+-- sshKey.pub --
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZmdeRNskfpvYL5YHB/YJaW8hTEXpnvPMkx5Ri+YwUr acceptance

From d4c70009bffb0e7cb4521f56fa0d7d55de9ee299 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 24 Oct 2024 17:54:27 +0200
Subject: [PATCH 266/301] Adjust environment help for host and tokens (#9809)

---
 pkg/cmd/root/help_topic.go | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/pkg/cmd/root/help_topic.go b/pkg/cmd/root/help_topic.go
index e76dd2271..6d22b6ae7 100644
--- a/pkg/cmd/root/help_topic.go
+++ b/pkg/cmd/root/help_topic.go
@@ -41,17 +41,18 @@ var HelpTopics = []helpTopic{
 	{
 		name:  "environment",
 		short: "Environment variables that can be used with gh",
-		long: heredoc.Docf(`
-			%[1]sGH_TOKEN%[1]s, %[1]sGITHUB_TOKEN%[1]s (in order of precedence): an authentication token for github.com
-			API requests. Setting this avoids being prompted to authenticate and takes precedence over
-			previously stored credentials.
+		long: heredoc.Docf(`	
+			%[1]sGH_TOKEN%[1]s, %[1]sGITHUB_TOKEN%[1]s (in order of precedence): an authentication token that will be used when
+			a command targets either github.com or a subdomain of ghe.com. Setting this avoids being prompted to
+			authenticate and takes precedence over previously stored credentials.
 
-			%[1]sGH_ENTERPRISE_TOKEN%[1]s, %[1]sGITHUB_ENTERPRISE_TOKEN%[1]s (in order of precedence): an authentication
-			token for API requests to GitHub Enterprise. When setting this, also set %[1]sGH_HOST%[1]s.
+			%[1]sGH_ENTERPRISE_TOKEN%[1]s, %[1]sGITHUB_ENTERPRISE_TOKEN%[1]s (in order of precedence): an authentication 
+			token that will be used when a command targets a GitHub Enterprise Server host.
 
-			%[1]sGH_HOST%[1]s: specify the GitHub hostname for commands that would otherwise assume the
-			"github.com" host when not in a context of an existing repository. When setting this, 
-			also set %[1]sGH_ENTERPRISE_TOKEN%[1]s.
+			%[1]sGH_HOST%[1]s: specify the GitHub hostname for commands where a hostname has not been provided, or
+			cannot be inferred from the context of a local Git repository. If this host was previously
+			authenticated with, the stored credentials will be used. Otherwise, setting %[1]sGH_TOKEN%[1]s or
+			%[1]sGH_ENTERPRISE_TOKEN%[1]s is required, depending on the targeted host.
 
 			%[1]sGH_REPO%[1]s: specify the GitHub repository in the %[1]s[HOST/]OWNER/REPO%[1]s format for commands
 			that otherwise operate on a local repository.

From 2f849f03ff426233e2847e5e7d55c1925078ed73 Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Thu, 24 Oct 2024 09:58:06 -0600
Subject: [PATCH 267/301] Add acceptance tests for org command

---
 acceptance/acceptance_test.go          | 9 +++++++++
 acceptance/testdata/org/org-list.txtar | 6 ++++++
 2 files changed, 15 insertions(+)
 create mode 100644 acceptance/testdata/org/org-list.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 18a3f0cef..56d7bf455 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -135,6 +135,15 @@ func TestSSHKeys(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "ssh-key"))
 }
 
+func TestOrg(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "org"))
+}
+
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {
 	var files []string
 	if tsEnv.script != "" {
diff --git a/acceptance/testdata/org/org-list.txtar b/acceptance/testdata/org/org-list.txtar
new file mode 100644
index 000000000..ca114babe
--- /dev/null
+++ b/acceptance/testdata/org/org-list.txtar
@@ -0,0 +1,6 @@
+# This test could fail if the user is a member of more than 30 organizations because
+# the `gh org list` command only returns the first 30 organizations the user is a member of
+
+# List organizations the user is a member of
+exec gh org list
+stdout ${GH_ACCEPTANCE_ORG}
\ No newline at end of file

From f72a82db99909239b127cadcd3c39d67caec90ff Mon Sep 17 00:00:00 2001
From: bagtoad <47394200+BagToad@users.noreply.github.com>
Date: Thu, 24 Oct 2024 09:59:02 -0600
Subject: [PATCH 268/301] Refactor gpg-key delete to align with ssh-key delete

---
 acceptance/testdata/gpg-key/gpg-key.txtar | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/acceptance/testdata/gpg-key/gpg-key.txtar b/acceptance/testdata/gpg-key/gpg-key.txtar
index dff028bab..8f0d71545 100644
--- a/acceptance/testdata/gpg-key/gpg-key.txtar
+++ b/acceptance/testdata/gpg-key/gpg-key.txtar
@@ -8,12 +8,16 @@ skip 'it modifies the user''s personal GitHub account GPG keys'
 # Add the gpg key to GH account
 exec gh gpg-key add gpg-key.pub
 
-# Defer deleting the gpg key from GH account
-defer gh gpg-key delete --yes 24C30F9C9115E747
-
 # Verify the gpg key was added to GH account
 exec gh gpg-key list
-stdout 24C30F9C9115E747
+stdout '24C30F9C9115E747'
+
+# Delete the gpg key from GH account
+exec gh gpg-key delete --yes '24C30F9C9115E747'
+
+# Check the key is deleted
+exec gh gpg-key list
+! stdout '24C30F9C9115E747'
 
 -- gpg-key.pub --
 -----BEGIN PGP PUBLIC KEY BLOCK-----

From 366aea95ebb4e76c1bc4b32dc4ed245492e83340 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Thu, 24 Oct 2024 18:35:30 +0200
Subject: [PATCH 269/301] Note token redaction in Acceptance test README

---
 acceptance/README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/acceptance/README.md b/acceptance/README.md
index 750cb75d1..8e8d7838e 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -159,7 +159,9 @@ When tests fail they fail like this:
 This is generally enough information to understand why a test has failed. However, we can get more information by providing the `-v` flag to `go test`, which turns on verbose mode and shows each command and any associated `stdio`.
 
 > [!WARNING]
-> Verbose mode dumps the `testscript` environment variables, including the `GH_TOKEN`, so be careful.
+> Verbose mode dumps the `testscript` environment variables, so make sure there is nothing sensitive in there.
+> We have taken steps to [redact tokens](https://github.com/cli/cli/pull/9804) in log output but there's no
+> guarantee it's comprehensive.
 
 By default `testscript` removes the directory in which it was running the script, and if you've been a conscientious engineer, you should be cleaning up resources using the `defer` statement. However, this can be an impediment to debugging. As such you can set `GH_ACCEPTANCE_PRESERVE_WORK_DIR=true` and `GH_ACCEPTANCE_SKIP_DEFER=true` to skip these cleanup steps.
 

From 31e8a87598baa60b590d93f5ea7bfac95a516f3b Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 24 Oct 2024 10:01:39 -0700
Subject: [PATCH 270/301] Alphabetize test functions

While swarming on this, I've encountered many merge conflicts based on
where folks have introduced new test functions. Alphabetizing them should
reduce the number of merge conflicts we encounter while introducing more
of these tests moving forward
---
 acceptance/acceptance_test.go | 148 +++++++++++++++++-----------------
 1 file changed, 74 insertions(+), 74 deletions(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index e764abbbc..ede3fc191 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -27,33 +27,6 @@ func TestMain(m *testing.M) {
 	}))
 }
 
-func TestPullRequests(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
-}
-
-func TestIssues(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
-}
-
-func TestWorkflows(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
-}
-
 func TestAPI(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
@@ -72,51 +45,6 @@ func TestAuth(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "auth"))
 }
 
-func TestReleases(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
-}
-
-func TestSearches(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "search"))
-}
-
-func TestRepo(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
-}
-
-func TestSecrets(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "secret"))
-}
-
-func TestVariables(t *testing.T) {
-	var tsEnv testScriptEnv
-	if err := tsEnv.fromEnv(); err != nil {
-		t.Fatal(err)
-	}
-
-	testscript.Run(t, testScriptParamsFor(tsEnv, "variable"))
-}
-
 func TestGPGKeys(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
@@ -126,6 +54,15 @@ func TestGPGKeys(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "gpg-key"))
 }
 
+func TestIssues(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
+}
+
 func TestLabels(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
@@ -135,6 +72,60 @@ func TestLabels(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "label"))
 }
 
+func TestOrg(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "org"))
+}
+
+func TestPullRequests(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "pr"))
+}
+
+func TestReleases(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "release"))
+}
+
+func TestRepo(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
+}
+
+func TestSearches(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "search"))
+}
+
+func TestSecrets(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "secret"))
+}
+
 func TestSSHKeys(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
@@ -144,13 +135,22 @@ func TestSSHKeys(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "ssh-key"))
 }
 
-func TestOrg(t *testing.T) {
+func TestVariables(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
 		t.Fatal(err)
 	}
 
-	testscript.Run(t, testScriptParamsFor(tsEnv, "org"))
+	testscript.Run(t, testScriptParamsFor(tsEnv, "variable"))
+}
+
+func TestWorkflows(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "workflow"))
 }
 
 func testScriptParamsFor(tsEnv testScriptEnv, command string) testscript.Params {

From 4d57c79770dba9b03d24732cc8407789b3cc9047 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Thu, 24 Oct 2024 11:40:55 -0600
Subject: [PATCH 271/301] set provenance predicate type as default for
 predicate-type flag

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 .../attestation/verification/attestation.go   |  2 +
 .../attestation/verification/mock_verifier.go |  2 -
 pkg/cmd/attestation/verification/sigstore.go  |  2 +-
 pkg/cmd/attestation/verify/verify.go          |  2 +-
 pkg/cmd/attestation/verify/verify_test.go     | 59 ++++++++++++++-----
 5 files changed, 48 insertions(+), 19 deletions(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 50542a6b3..5c126fc8e 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -15,6 +15,8 @@ import (
 	"github.com/sigstore/sigstore-go/pkg/bundle"
 )
 
+const SLSAPredicateType = "https://slsa.dev/provenance/v1"
+
 var ErrUnrecognisedBundleExtension = errors.New("bundle file extension not supported, must be json or jsonl")
 var ErrEmptyBundleFile = errors.New("provided bundle file is empty")
 
diff --git a/pkg/cmd/attestation/verification/mock_verifier.go b/pkg/cmd/attestation/verification/mock_verifier.go
index cb3a4c061..c5560743b 100644
--- a/pkg/cmd/attestation/verification/mock_verifier.go
+++ b/pkg/cmd/attestation/verification/mock_verifier.go
@@ -12,8 +12,6 @@ import (
 	"github.com/sigstore/sigstore-go/pkg/verify"
 )
 
-const SLSAPredicateType = "https://slsa.dev/provenance/v1"
-
 type MockSigstoreVerifier struct {
 	t *testing.T
 }
diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index e237a3eb9..5b4f4a79b 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -113,7 +113,7 @@ func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.Bundle) (*verify.SignedE
 					// issuer. We *must* use the trusted root provided.
 					if issuer == PublicGoodIssuerOrg {
 						if v.config.NoPublicGood {
-							return nil, "", fmt.Errorf("Detected public good instance but requested verification without public good instance")
+							return nil, "", fmt.Errorf("detected public good instance but requested verification without public good instance")
 						}
 						verifier, err := newPublicGoodVerifierWithTrustedRoot(trustedRoot)
 						if err != nil {
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index d14081dd8..f41a31aab 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -179,7 +179,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")
 	verifyCmd.MarkFlagsMutuallyExclusive("owner", "repo")
 	verifyCmd.MarkFlagsOneRequired("owner", "repo")
-	verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", "", "Filter attestations by provided predicate type")
+	verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", verification.SLSAPredicateType, "Filter attestations by provided predicate type")
 	verifyCmd.Flags().BoolVarP(&opts.NoPublicGood, "no-public-good", "", false, "Do not verify attestations signed with Sigstore public good instance")
 	verifyCmd.Flags().StringVarP(&opts.TrustedRoot, "custom-trusted-root", "", "", "Path to a trusted_root.jsonl file; likely for offline verification")
 	verifyCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 306ff8b35..2ad15ce7c 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -70,11 +70,12 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha384",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -85,12 +86,13 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -101,12 +103,13 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
+				Hostname:         "foo.ghe.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://foo.ghe.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "foo.ghe.com",
 			},
 			wantsErr: false,
 		},
@@ -117,12 +120,13 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha256",
+				Hostname:         "foo.ghe.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "foo.ghe.com",
 			},
 			wantsErr: true,
 		},
@@ -133,12 +137,13 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
 				DigestAlgorithm:  "sha512",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -148,12 +153,13 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
+				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				Limit:            30,
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -163,12 +169,13 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
+				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				Repo:             "sigstore/sigstore-js",
-				Limit:            30,
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -178,12 +185,13 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -193,12 +201,13 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
+				Limit:            101,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				Limit:            101,
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -208,12 +217,13 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
+				Limit:            0,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				Limit:            0,
+				PredicateType:    verification.SLSAPredicateType,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -223,13 +233,14 @@ func TestNewVerifyCmd(t *testing.T) {
 			wants: Options{
 				ArtifactPath:     artifactPath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
 				SAN:              "https://github.com/sigstore/",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -240,9 +251,27 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     artifactPath,
 				BundlePath:       bundlePath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
+				PredicateType:    verification.SLSAPredicateType,
+				SANRegex:         "(?i)^https://github.com/sigstore/",
+				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
+			},
+			wantsExporter: true,
+		},
+		{
+			name: "Use specified predicate type",
+			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --predicate-type https://spdx.dev/Document/v2.3 --format json", artifactPath, bundlePath),
+			wants: Options{
+				ArtifactPath:     artifactPath,
+				BundlePath:       bundlePath,
+				DigestAlgorithm:  "sha256",
+				Limit:            30,
+				OIDCIssuer:       verification.GitHubOIDCIssuer,
+				Owner:            "sigstore",
+				PredicateType:    "https://spdx.dev/Document/v2.3",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 				Hostname:         "github.com",

From 8b5c5385c7748d52fda541e4ce064c00f120f4a6 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 24 Oct 2024 12:18:56 -0700
Subject: [PATCH 272/301] Add TestProject to acceptance_test.go

---
 acceptance/acceptance_test.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index ede3fc191..dc4eb514a 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -81,6 +81,15 @@ func TestOrg(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "org"))
 }
 
+func TestProject(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "project"))
+}
+
 func TestPullRequests(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {

From 714830434485612cdfc379c58401e1daa7de7546 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Thu, 24 Oct 2024 12:53:52 -0700
Subject: [PATCH 273/301] Add acceptance test for project-create and
 project-delete

---
 .../testdata/project/project-create-delete.txtar     | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 acceptance/testdata/project/project-create-delete.txtar

diff --git a/acceptance/testdata/project/project-create-delete.txtar b/acceptance/testdata/project/project-create-delete.txtar
new file mode 100644
index 000000000..fe5ca41cf
--- /dev/null
+++ b/acceptance/testdata/project/project-create-delete.txtar
@@ -0,0 +1,12 @@
+# Create a project
+exec gh project create --owner=$ORG --title='acceptance-test-project-title'
+
+# Confirm the project has been created and get the project number
+exec gh project list --owner=$ORG --format=json --jq='.projects[] | select(.title == "acceptance-test-project-title") | .number'
+stdout2env PROJECT_NUMBER
+
+# Delete the project
+exec gh project delete --owner=$ORG $PROJECT_NUMBER
+
+# Confirm the project has been deleted
+! exec gh project view --owner=$ORG $PROJECT_NUMBER
\ No newline at end of file

From 30d9fc53d1c4e2262e840dab0d9743bcc6931f81 Mon Sep 17 00:00:00 2001
From: William Martin <williammartin@github.com>
Date: Fri, 25 Oct 2024 16:29:23 +0200
Subject: [PATCH 274/301] Update testscript to use hard fork

---
 acceptance/acceptance_test.go | 2 +-
 go.mod                        | 4 +---
 go.sum                        | 6 ++++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index e764abbbc..6efa4864e 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -14,7 +14,7 @@ import (
 	"math/rand"
 
 	"github.com/cli/cli/v2/internal/ghcmd"
-	"github.com/rogpeppe/go-internal/testscript"
+	"github.com/cli/go-internal/testscript"
 )
 
 func ghMain() int {
diff --git a/go.mod b/go.mod
index 138ef8b60..77be0c19d 100644
--- a/go.mod
+++ b/go.mod
@@ -12,6 +12,7 @@ require (
 	github.com/charmbracelet/glamour v0.7.0
 	github.com/charmbracelet/lipgloss v0.10.1-0.20240413172830-d0be07ea6b9c
 	github.com/cli/go-gh/v2 v2.11.0
+	github.com/cli/go-internal v0.0.0-20241025142207-6c48bcd5ce24
 	github.com/cli/oauth v1.1.1
 	github.com/cli/safeexec v1.0.1
 	github.com/cpuguy83/go-md2man/v2 v2.0.5
@@ -125,7 +126,6 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rodaine/table v1.0.1 // indirect
-	github.com/rogpeppe/go-internal v1.13.1
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
@@ -167,5 +167,3 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
-
-replace github.com/rogpeppe/go-internal => github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b
diff --git a/go.sum b/go.sum
index d23e604f0..fe7adc3e7 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cli/go-gh/v2 v2.11.0 h1:TERLYMMWderKBO3lBff/JIu2+eSly2oFRgN2WvO+3eA=
 github.com/cli/go-gh/v2 v2.11.0/go.mod h1:MeRoKzXff3ygHu7zP+NVTT+imcHW6p3tpuxHAzRM2xE=
-github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b h1:ogNz+pm9aI2Zn58V+WTMzPViN2fRVq/h2H9gwdvM09k=
-github.com/cli/go-internal v0.0.0-20241024130215-fa3c22e38b9b/go.mod h1:S8kfXMp+yh77OxPD4fdM6YUknrZpQxLhvxzS4gDHENY=
+github.com/cli/go-internal v0.0.0-20241025142207-6c48bcd5ce24 h1:QDrhR4JA2n3ij9YQN0u5ZeuvRIIvsUGmf5yPlTS0w8E=
+github.com/cli/go-internal v0.0.0-20241025142207-6c48bcd5ce24/go.mod h1:rr9GNING0onuVw8MnracQHn7PcchnFlP882Y0II2KZk=
 github.com/cli/oauth v1.1.1 h1:459gD3hSjlKX9B1uXBuiAMdpXBUQ9QGf/NDcCpoQxPs=
 github.com/cli/oauth v1.1.1/go.mod h1:qd/FX8ZBD6n1sVNQO3aIdRxeu5LGw9WhKnYhIIoC2A4=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
@@ -368,6 +368,8 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rodaine/table v1.0.1 h1:U/VwCnUxlVYxw8+NJiLIuCxA/xa6jL38MY3FYysVWWQ=
 github.com/rodaine/table v1.0.1/go.mod h1:UVEtfBsflpeEcD56nF4F5AocNFta0ZuolpSVdPtlmP4=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=

From 7a5dc5032475ef192d301015c3c56bca11fd7110 Mon Sep 17 00:00:00 2001
From: Tyler McGoffin <jtmcg@github.com>
Date: Fri, 25 Oct 2024 09:03:09 -0700
Subject: [PATCH 275/301] Modify script to use the project number returned by
 the api upon creation

---
 .../testdata/project/project-create-delete.txtar      | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/acceptance/testdata/project/project-create-delete.txtar b/acceptance/testdata/project/project-create-delete.txtar
index fe5ca41cf..115253669 100644
--- a/acceptance/testdata/project/project-create-delete.txtar
+++ b/acceptance/testdata/project/project-create-delete.txtar
@@ -1,10 +1,11 @@
-# Create a project
-exec gh project create --owner=$ORG --title='acceptance-test-project-title'
-
-# Confirm the project has been created and get the project number
-exec gh project list --owner=$ORG --format=json --jq='.projects[] | select(.title == "acceptance-test-project-title") | .number'
+# Create a project and get the project number
+env PROJECT_TITLE=$SCRIPT_NAME-$RANDOM_STRING
+exec gh project create --owner=$ORG --title=$PROJECT_TITLE --format='json' --jq='.number'
 stdout2env PROJECT_NUMBER
 
+# Confirm the project has been created
+exec gh project view --owner=$ORG $PROJECT_NUMBER
+
 # Delete the project
 exec gh project delete --owner=$ORG $PROJECT_NUMBER
 

From e8013c077808af0e3c69bdcfd84a4ca43011312f Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Fri, 25 Oct 2024 14:04:54 -0600
Subject: [PATCH 276/301] update documentation to indclude predicate-type
 information

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index f41a31aab..014ffdbe0 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -55,7 +55,9 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			By default, the verify command will attempt to fetch attestations associated
 			with the provided artifact from the GitHub API. If you would prefer to verify
 			the artifact using attestations stored on disk (c.f. the %[1]sdownload%[1]s command),
-			provide a path to the %[1]s--bundle%[1]s flag.
+			provide a path to the %[1]s--bundle%[1]s flag. Additionally, the command
+			will only verify provenance attestations by default. To verify
+			other types of attestations, use the %[1]s--predicate-type%[1]s flag.
 
 			To see the full results that are generated upon successful verification, i.e.
 			for use with a policy engine, provide the %[1]s--format=json%[1]s flag.

From fa6536493f9334e37a9474264ebc356c422fee1d Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Fri, 25 Oct 2024 14:54:52 -0600
Subject: [PATCH 277/301] predicate-type is no longer empty

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 014ffdbe0..7107cd93b 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -246,16 +246,12 @@ func runVerify(opts *Options) error {
 	}
 
 	// Apply predicate type filter to returned attestations
-	if opts.PredicateType != "" {
-		filteredAttestations := verification.FilterAttestations(opts.PredicateType, attestations)
-
-		if len(filteredAttestations) == 0 {
-			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ No attestations found with predicate type: %s\n"), opts.PredicateType)
-			return err
-		}
-
-		attestations = filteredAttestations
+	filteredAttestations := verification.FilterAttestations(opts.PredicateType, attestations)
+	if len(filteredAttestations) == 0 {
+		opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ No attestations found with predicate type: %s\n"), opts.PredicateType)
+		return err
 	}
+	attestations = filteredAttestations
 
 	policy, err := buildVerifyPolicy(opts, *artifact)
 	if err != nil {
@@ -263,6 +259,8 @@ func runVerify(opts *Options) error {
 		return err
 	}
 
+	opts.Logger.VerbosePrintf("Verifying attestations with the predicate type %s\n", opts.PredicateType)
+
 	sigstoreRes := opts.SigstoreVerifier.Verify(attestations, policy)
 	if sigstoreRes.Error != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))

From 28fa42a324deb4db869f83a3b0c2d0a1eaa266e9 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Fri, 25 Oct 2024 15:00:11 -0600
Subject: [PATCH 278/301] message formatting

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 7107cd93b..7be4a3a20 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -259,7 +259,7 @@ func runVerify(opts *Options) error {
 		return err
 	}
 
-	opts.Logger.VerbosePrintf("Verifying attestations with the predicate type %s\n", opts.PredicateType)
+	opts.Logger.VerbosePrintf("Verifying attestations with predicate type: %s\n", opts.PredicateType)
 
 	sigstoreRes := opts.SigstoreVerifier.Verify(attestations, policy)
 	if sigstoreRes.Error != nil {

From cef335c698b03fba80aa8d3122e27ec51e722667 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Fri, 25 Oct 2024 15:26:32 -0600
Subject: [PATCH 279/301] update tests to include predicate type

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify_test.go | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 2ad15ce7c..69acb91e1 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -302,17 +302,18 @@ func TestNewVerifyCmd(t *testing.T) {
 
 			assert.Equal(t, tc.wants.ArtifactPath, opts.ArtifactPath)
 			assert.Equal(t, tc.wants.BundlePath, opts.BundlePath)
-			assert.Equal(t, tc.wants.TrustedRoot, opts.TrustedRoot)
 			assert.Equal(t, tc.wants.DenySelfHostedRunner, opts.DenySelfHostedRunner)
 			assert.Equal(t, tc.wants.DigestAlgorithm, opts.DigestAlgorithm)
+			assert.Equal(t, tc.wants.Hostname, opts.Hostname)
 			assert.Equal(t, tc.wants.Limit, opts.Limit)
 			assert.Equal(t, tc.wants.NoPublicGood, opts.NoPublicGood)
 			assert.Equal(t, tc.wants.OIDCIssuer, opts.OIDCIssuer)
 			assert.Equal(t, tc.wants.Owner, opts.Owner)
+			assert.Equal(t, tc.wants.PredicateType, opts.PredicateType)
 			assert.Equal(t, tc.wants.Repo, opts.Repo)
 			assert.Equal(t, tc.wants.SAN, opts.SAN)
 			assert.Equal(t, tc.wants.SANRegex, opts.SANRegex)
-			assert.Equal(t, tc.wants.Hostname, opts.Hostname)
+			assert.Equal(t, tc.wants.TrustedRoot, opts.TrustedRoot)
 			assert.NotNil(t, opts.APIClient)
 			assert.NotNil(t, opts.Logger)
 			assert.NotNil(t, opts.OCIClient)
@@ -362,11 +363,12 @@ func TestJSONOutput(t *testing.T) {
 		OCIClient:        oci.MockClient{},
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
+		PredicateType:    verification.SLSAPredicateType,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 		exporter:         cmdutil.NewJSONExporter(),
 	}
-	require.Nil(t, runVerify(&opts))
+	require.NoError(t, runVerify(&opts))
 
 	var target []*verification.AttestationProcessingResult
 	err := json.Unmarshal(out.Bytes(), &target)
@@ -385,12 +387,13 @@ func TestRunVerify(t *testing.T) {
 		OCIClient:        oci.MockClient{},
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
+		PredicateType:    verification.SLSAPredicateType,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 	}
 
 	t.Run("with valid artifact and bundle", func(t *testing.T) {
-		require.Nil(t, runVerify(&publicGoodOpts))
+		require.NoError(t, runVerify(&publicGoodOpts))
 	})
 
 	t.Run("with failing OCI artifact fetch", func(t *testing.T) {

From 9ddaf13ef534797f6280a44f0d9bad3d302b7390 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Fri, 25 Oct 2024 15:32:16 -0600
Subject: [PATCH 280/301] add predicate type to integration tests

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify_integration_test.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index 4b0f0adfb..3a9a8185f 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -40,6 +40,7 @@ func TestVerifyIntegration(t *testing.T) {
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
+		PredicateType:    verification.SLSAPredicateType,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
@@ -112,6 +113,7 @@ func TestVerifyIntegrationCustomIssuer(t *testing.T) {
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       "https://token.actions.githubusercontent.com/hammer-time",
+		PredicateType:    verification.SLSAPredicateType,
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
 
@@ -181,6 +183,7 @@ func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
+		PredicateType:    verification.SLSAPredicateType,
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
 
@@ -271,6 +274,7 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "malancas",
+		PredicateType:    verification.SLSAPredicateType,
 		Repo:             "malancas/attest-demo",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}

From c27677bda67bf97810bd06a12e863a3da458c3eb Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 24 Oct 2024 15:21:59 -0400
Subject: [PATCH 281/301] Add comprehensive testscript for `gh ruleset`

---
 acceptance/acceptance_test.go                |  9 +++
 acceptance/testdata/ruleset/commandset.txtar | 62 ++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 acceptance/testdata/ruleset/commandset.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 25ae91d77..24cb083c9 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -117,6 +117,15 @@ func TestRepo(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "repo"))
 }
 
+func TestRulesets(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "ruleset"))
+}
+
 func TestSearches(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
diff --git a/acceptance/testdata/ruleset/commandset.txtar b/acceptance/testdata/ruleset/commandset.txtar
new file mode 100644
index 000000000..99be3683c
--- /dev/null
+++ b/acceptance/testdata/ruleset/commandset.txtar
@@ -0,0 +1,62 @@
+# Setup environment variables used for testscript
+env REPO=${SCRIPT_NAME}-${RANDOM_STRING}
+
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create a repository with a file so it has a default branch
+exec gh repo create $ORG/$REPO --add-readme --private
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$REPO
+
+# Clone the repo
+exec gh repo clone $ORG/$REPO
+cd $REPO
+
+# Verify repository ruleset does not exist
+env LIST_MATCH=testscript\s+$ORG/$REPO (repo)
+exec gh ruleset list
+! stdout $LIST_MATCH
+
+# Verify no repository ruleset applies to default branch
+exec gh ruleset check
+stdout '0 rules apply'
+
+# Create a repository ruleset
+exec gh api /repos/{owner}/{repo}/rulesets -X POST --input ../create-repo-ruleset.json
+
+# Verify repository ruleset does exist
+exec gh ruleset list
+stdout $LIST_MATCH
+
+# Verify repository ruleset associated with branch
+exec gh ruleset check
+stdout '- pull_request:.+dismiss_stale_reviews_on_push: false.+require_code_owner_review: true.+require_last_push_approval: false.+required_approving_review_count: 1.+required_review_thread_resolution: false'
+
+-- create-repo-ruleset.json --
+{
+    "name": "testscript",
+    "target": "branch",
+    "enforcement": "active",
+    "conditions": {
+        "ref_name": {
+            "include": [
+                "~DEFAULT_BRANCH"
+            ],
+            "exclude": []
+        }
+    },
+    "rules": [
+        {
+            "type": "pull_request",
+            "parameters": {
+                "dismiss_stale_reviews_on_push": false,
+                "require_code_owner_review": true,
+                "require_last_push_approval": false,
+                "required_approving_review_count": 1,
+                "required_review_thread_resolution": false
+            }
+        }
+    ]
+}

From 6dc86e5f40c5b4ee55f5675398ed54c17ac3f4ed Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 25 Oct 2024 08:58:16 -0400
Subject: [PATCH 282/301] Rename testscript for consistency

Similar to `gpg-key`, `label`, `ssh-key`, this coarse grained testscript should be named after the commandset given it isn't a collection of targeted scenarios.
---
 acceptance/testdata/ruleset/{commandset.txtar => ruleset.txtar} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename acceptance/testdata/ruleset/{commandset.txtar => ruleset.txtar} (100%)

diff --git a/acceptance/testdata/ruleset/commandset.txtar b/acceptance/testdata/ruleset/ruleset.txtar
similarity index 100%
rename from acceptance/testdata/ruleset/commandset.txtar
rename to acceptance/testdata/ruleset/ruleset.txtar

From ed24477fd3e4eb7837a05d644052322b50ee2496 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Thu, 24 Oct 2024 10:19:50 -0400
Subject: [PATCH 283/301] Add comprehensive testscript for gh ext commandset

Rather than multiple separate testscripts per `gh ext` subcommand, this commit adds a comprehensive test around `gh extension` commandset.
---
 acceptance/acceptance_test.go                 |  9 +++
 .../testdata/extension/commandset.txtar       | 66 +++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 acceptance/testdata/extension/commandset.txtar

diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 24cb083c9..b22929ed5 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -54,6 +54,15 @@ func TestGPGKeys(t *testing.T) {
 	testscript.Run(t, testScriptParamsFor(tsEnv, "gpg-key"))
 }
 
+func TestExtensions(t *testing.T) {
+	var tsEnv testScriptEnv
+	if err := tsEnv.fromEnv(); err != nil {
+		t.Fatal(err)
+	}
+
+	testscript.Run(t, testScriptParamsFor(tsEnv, "extension"))
+}
+
 func TestIssues(t *testing.T) {
 	var tsEnv testScriptEnv
 	if err := tsEnv.fromEnv(); err != nil {
diff --git a/acceptance/testdata/extension/commandset.txtar b/acceptance/testdata/extension/commandset.txtar
new file mode 100644
index 000000000..e994ec3b0
--- /dev/null
+++ b/acceptance/testdata/extension/commandset.txtar
@@ -0,0 +1,66 @@
+# Setup environment variables used for testscript
+env EXT_NAME=${SCRIPT_NAME}-${RANDOM_STRING}
+env EXT_SCRIPT=gh-${EXT_NAME}
+env REPO=gh-${EXT_NAME}
+
+# Use gh as a credential helper
+exec gh auth setup-git
+
+# Create local repository for extension
+exec gh extension create $EXT_NAME
+cd $REPO
+
+# Setup v1 executable baseline for extension
+mv ../v1.sh $EXT_SCRIPT
+chmod 777 $EXT_SCRIPT
+exec git add $EXT_SCRIPT
+exec git commit -m 'Setup extension as v1'
+
+# Upload local extension repository
+exec gh repo create $ORG/$REPO --private --source . --push
+
+# Defer repo cleanup
+defer gh repo delete --yes $ORG/$REPO
+
+# Verify extension shows up in search, sleep for indexing
+exec gh repo edit --add-topic gh-extension
+sleep 10
+exec gh extension search --owner $ORG $EXT_NAME
+stdout ${ORG}/${REPO}
+
+# Verify repository can be installed as extension
+exec gh extension install $ORG/$REPO
+exec gh extension list
+stdout ${ORG}/${REPO}
+
+# Verify v1 extension behavior before upgrade
+exec gh extension exec $EXT_NAME
+stdout 'gh ext create v1'
+
+# Setup v2 executable upgrade for extension
+mv ../v2.sh $EXT_SCRIPT
+chmod 777 $EXT_SCRIPT
+exec git add $EXT_SCRIPT
+exec git commit -m 'Upgrade extension to v2'
+exec git push -u origin
+
+# Verify v2 extension upgrade
+exec gh extension upgrade $EXT_NAME
+exec gh extension exec $EXT_NAME
+stdout 'gh ext upgrade v2'
+
+# Verify extension can be removed
+exec gh extension remove $EXT_NAME
+! stdout ${ORG}/${REPO}
+
+-- v1.sh --
+#!/usr/bin/env bash
+set -e
+
+echo "gh ext create v1"
+
+-- v2.sh --
+#!/usr/bin/env bash
+set -e
+
+echo "gh ext upgrade v2"

From 911f07093621711131f29f061fe2ef565ff54dd3 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 25 Oct 2024 08:40:31 -0400
Subject: [PATCH 284/301] Skip extension testscript if bash isn't available

As this testscript creates a Bash-based script extension, the testscript should be skipped if it isn't on the path and executable.

Ideally, we would refactor this test to isolate that portion of the tests OR switch to a Go-based extension that can be compiled and run everywhere.
---
 acceptance/testdata/extension/commandset.txtar | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/acceptance/testdata/extension/commandset.txtar b/acceptance/testdata/extension/commandset.txtar
index e994ec3b0..a4d194757 100644
--- a/acceptance/testdata/extension/commandset.txtar
+++ b/acceptance/testdata/extension/commandset.txtar
@@ -1,3 +1,6 @@
+# Skip if Bash is not available given script extension
+[!exec:bash] skip
+
 # Setup environment variables used for testscript
 env EXT_NAME=${SCRIPT_NAME}-${RANDOM_STRING}
 env EXT_SCRIPT=gh-${EXT_NAME}

From 37da12a9d28a24678723cd0d463f034b1c4c3c2e Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Fri, 25 Oct 2024 08:56:02 -0400
Subject: [PATCH 285/301] Rename similar to other coarse commandset tests

Based on insights gained from reviewing conventions in #9815 with @jtmcg, I'm renaming this testscript to keep consistent with `gpg-key`, `label`, `ssh-key`, etc.
---
 .../testdata/extension/{commandset.txtar => extension.txtar}      | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename acceptance/testdata/extension/{commandset.txtar => extension.txtar} (100%)

diff --git a/acceptance/testdata/extension/commandset.txtar b/acceptance/testdata/extension/extension.txtar
similarity index 100%
rename from acceptance/testdata/extension/commandset.txtar
rename to acceptance/testdata/extension/extension.txtar

From a820457b098ea3843f976f9ca39849fbf9461a98 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 11:47:31 -0600
Subject: [PATCH 286/301] clean up skipped online tests

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 .../verify/verify_integration_test.go         | 27 ++++++++
 pkg/cmd/attestation/verify/verify_test.go     | 69 -------------------
 2 files changed, 27 insertions(+), 69 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index 4b0f0adfb..0b15e823e 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -83,6 +83,33 @@ func TestVerifyIntegration(t *testing.T) {
 		require.Error(t, err)
 		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://github.com/fakeowner/fakerepo, got https://github.com/sigstore/sigstore-js")
 	})
+
+	t.Run("with no matching OIDC issuer", func(t *testing.T) {
+		opts := publicGoodOpts
+		opts.OIDCIssuer = "some-other-issuer"
+
+		err := runVerify(&opts)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "expected Issuer to be some-other-issuer, got https://token.actions.githubusercontent.com")
+	})
+
+	t.Run("with invalid SAN", func(t *testing.T) {
+		opts := publicGoodOpts
+		opts.SAN = "fake san"
+
+		err := runVerify(&opts)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "verifying with issuer \"sigstore.dev\"")
+	})
+
+	t.Run("with invalid SAN regex", func(t *testing.T) {
+		opts := publicGoodOpts
+		opts.SANRegex = "^https://github.com/sigstore/not-real/"
+
+		err := runVerify(&opts)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "verifying with issuer \"sigstore.dev\"")
+	})
 }
 
 func TestVerifyIntegrationCustomIssuer(t *testing.T) {
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 306ff8b35..93ad4bdbc 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -453,75 +453,6 @@ func TestRunVerify(t *testing.T) {
 		require.ErrorContains(t, err, "failed to fetch attestations from wrong-owner")
 	})
 
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with invalid OIDC issuer", func(t *testing.T) {
-		t.Skip()
-		opts := publicGoodOpts
-		opts.OIDCIssuer = "not-a-real-issuer"
-		require.Error(t, runVerify(&opts))
-	})
-
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with SAN enforcement", func(t *testing.T) {
-		t.Skip()
-		opts := Options{
-			ArtifactPath:     artifactPath,
-			BundlePath:       bundlePath,
-			APIClient:        api.NewTestClient(),
-			DigestAlgorithm:  "sha512",
-			Logger:           logger,
-			OIDCIssuer:       verification.GitHubOIDCIssuer,
-			Owner:            "sigstore",
-			SAN:              SigstoreSanValue,
-			SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-		}
-		require.Nil(t, runVerify(&opts))
-	})
-
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with invalid SAN", func(t *testing.T) {
-		t.Skip()
-		opts := publicGoodOpts
-		opts.SAN = "fake san"
-		require.Error(t, runVerify(&opts))
-	})
-
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with SAN regex enforcement", func(t *testing.T) {
-		t.Skip()
-		opts := publicGoodOpts
-		opts.SANRegex = SigstoreSanRegex
-		require.Nil(t, runVerify(&opts))
-	})
-
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with invalid SAN regex", func(t *testing.T) {
-		t.Skip()
-		opts := publicGoodOpts
-		opts.SANRegex = "^https://github.com/sigstore/not-real/"
-		require.Error(t, runVerify(&opts))
-	})
-
-	// TODO: this test can only be tested with a live SigstoreVerifier
-	// add integration tests or HTTP mocked sigstore verifier tests
-	// to test this case
-	t.Run("with no matching OIDC issuer", func(t *testing.T) {
-		t.Skip()
-		opts := publicGoodOpts
-		opts.OIDCIssuer = "some-other-issuer"
-		require.Error(t, runVerify(&opts))
-	})
-
 	t.Run("with missing API client", func(t *testing.T) {
 		customOpts := publicGoodOpts
 		customOpts.APIClient = nil

From ce5bde4379e4ce7c9ba3ba520e39d7b14258c98d Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 12:59:04 -0600
Subject: [PATCH 287/301] simplify signer workflow validation tests

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/policy_test.go | 46 ++++++++++-------------
 1 file changed, 19 insertions(+), 27 deletions(-)

diff --git a/pkg/cmd/attestation/verify/policy_test.go b/pkg/cmd/attestation/verify/policy_test.go
index ae1e52955..bc831e46d 100644
--- a/pkg/cmd/attestation/verify/policy_test.go
+++ b/pkg/cmd/attestation/verify/policy_test.go
@@ -36,18 +36,28 @@ func TestValidateSignerWorkflow(t *testing.T) {
 		providedSignerWorkflow string
 		expectedWorkflowRegex  string
 		host                   string
+		expectErr              bool
+		errContains            string
 	}
 
 	testcases := []testcase{
 		{
 			name:                   "workflow with no host specified",
 			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			expectedWorkflowRegex:  "^https://github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			expectErr:              true,
+			errContains:            "unknown host",
 		},
 		{
-			name:                   "workflow with host specified",
+			name:                   "workflow with default host",
+			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			expectedWorkflowRegex:  "^https://github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			host:                   "github.com",
+		},
+		{
+			name:                   "workflow with workflow URL included",
 			providedSignerWorkflow: "github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectedWorkflowRegex:  "^https://github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
+			host:                   "github.com",
 		},
 		{
 			name:                   "workflow with GH_HOST set",
@@ -61,12 +71,6 @@ func TestValidateSignerWorkflow(t *testing.T) {
 			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			host:                   "authedhost.github.com",
 		},
-		{
-			name:                   "workflow with authenticated host",
-			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			host:                   "authedhost.github.com",
-		},
 	}
 
 	for _, tc := range testcases {
@@ -78,28 +82,16 @@ func TestValidateSignerWorkflow(t *testing.T) {
 		}
 
 		// All host resolution is done verify.go:RunE
-		if tc.host == "" {
-			// Set to default host
-			tc.host = "github.com"
-		}
 		opts.Hostname = tc.host
-
 		workflowRegex, err := validateSignerWorkflow(opts)
-		require.NoError(t, err)
 		require.Equal(t, tc.expectedWorkflowRegex, workflowRegex)
 
+		if tc.expectErr {
+			require.Error(t, err)
+			require.ErrorContains(t, err, tc.errContains)
+		} else {
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedWorkflowRegex, workflowRegex)
+		}
 	}
 }
-
-func TestValidateSignerWorkflowNoHost(t *testing.T) {
-	cmdFactory := factory.New("test")
-	opts := &Options{
-		Config:         cmdFactory.Config,
-		SignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
-	}
-
-	workflowRegex, err := validateSignerWorkflow(opts)
-	require.Error(t, err)
-	require.ErrorContains(t, err, "unknown host")
-	require.Equal(t, "", workflowRegex)
-}

From f8b0f5e68738623a0bf3dc31718adb1be3a3cd58 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 13:02:12 -0600
Subject: [PATCH 288/301] clean up test

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/policy_test.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/cmd/attestation/verify/policy_test.go b/pkg/cmd/attestation/verify/policy_test.go
index bc831e46d..39e5d3707 100644
--- a/pkg/cmd/attestation/verify/policy_test.go
+++ b/pkg/cmd/attestation/verify/policy_test.go
@@ -74,10 +74,8 @@ func TestValidateSignerWorkflow(t *testing.T) {
 	}
 
 	for _, tc := range testcases {
-		cmdFactory := factory.New("test")
-
 		opts := &Options{
-			Config:         cmdFactory.Config,
+			Config:         factory.New("test").Config,
 			SignerWorkflow: tc.providedSignerWorkflow,
 		}
 

From 502856082e7a1afda89b57da8040ce5d31cbba27 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 13:40:23 -0600
Subject: [PATCH 289/301] table tests

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 .../verification/sigstore_integration_test.go | 88 +++++++++----------
 1 file changed, 40 insertions(+), 48 deletions(-)

diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go
index 1d3ec2d75..d4a92c541 100644
--- a/pkg/cmd/attestation/verification/sigstore_integration_test.go
+++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go
@@ -15,32 +15,52 @@ import (
 )
 
 func TestLiveSigstoreVerifier(t *testing.T) {
-	t.Run("with invalid signature", func(t *testing.T) {
-		attestations := getAttestationsFor(t, "../test/data/sigstoreBundle-invalid-signature.json")
-		require.NotNil(t, attestations)
+	type testcase struct {
+		name         string
+		attestations []*api.Attestation
+		expectErr    bool
+		errContains  string
+	}
 
+	testcases := []testcase{
+		{
+			name:         "with invalid signature",
+			attestations: getAttestationsFor(t, "../test/data/sigstoreBundle-invalid-signature.json"),
+			expectErr:    true,
+			errContains:  "verifying with issuer \"sigstore.dev\"",
+		},
+		{
+			name:         "with valid artifact and JSON lines file containing multiple Sigstore bundles",
+			attestations: getAttestationsFor(t, "../test/data/sigstore-js-2.1.0_with_2_bundles.jsonl"),
+		},
+		{
+			name:         "with invalid bundle version",
+			attestations: getAttestationsFor(t, "../test/data/sigstore-js-2.1.0-bundle-v0.1.json"),
+			expectErr:    true,
+			errContains:  "unsupported bundle version",
+		},
+		{
+			name:         "with no attestations",
+			attestations: []*api.Attestation{},
+		},
+	}
+
+	for _, tc := range testcases {
 		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
 			Logger: io.NewTestHandler(),
 		})
 
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Error(t, res.Error)
-		require.ErrorContains(t, res.Error, "verifying with issuer \"sigstore.dev\"")
-		require.Nil(t, res.VerifyResults)
-	})
+		res := verifier.Verify(tc.attestations, publicGoodPolicy(t))
 
-	t.Run("with valid artifact and JSON lines file containing multiple Sigstore bundles", func(t *testing.T) {
-		attestations := getAttestationsFor(t, "../test/data/sigstore-js-2.1.0_with_2_bundles.jsonl")
-		require.Len(t, attestations, 2)
-
-		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
-			Logger: io.NewTestHandler(),
-		})
-
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Len(t, res.VerifyResults, 2)
-		require.NoError(t, res.Error)
-	})
+		if tc.expectErr {
+			require.Error(t, res.Error)
+			require.ErrorContains(t, res.Error, "verifying with issuer \"sigstore.dev\"")
+			require.Nil(t, res.VerifyResults)
+		} else {
+			require.Len(t, len(tc.attestations), len(res.VerifyResults))
+			require.NoError(t, res.Error)
+		}
+	}
 
 	t.Run("with GitHub Sigstore artifact", func(t *testing.T) {
 		githubArtifactPath := test.NormalizeRelativePath("../test/data/github_provenance_demo-0.0.12-py3-none-any.whl")
@@ -72,34 +92,6 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 		require.Len(t, res.VerifyResults, 2)
 		require.NoError(t, res.Error)
 	})
-
-	t.Run("with invalid bundle version", func(t *testing.T) {
-		attestations := getAttestationsFor(t, "../test/data/sigstore-js-2.1.0-bundle-v0.1.json")
-		require.Len(t, attestations, 1)
-
-		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
-			Logger: io.NewTestHandler(),
-		})
-
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Len(t, res.VerifyResults, 0)
-		require.ErrorContains(t, res.Error, "unsupported bundle version")
-	})
-
-	t.Run("with no attestations", func(t *testing.T) {
-		attestations := []*api.Attestation{}
-		require.Len(t, attestations, 0)
-
-		verifier := NewLiveSigstoreVerifier(SigstoreConfig{
-			Logger:      io.NewTestHandler(),
-			TrustedRoot: test.NormalizeRelativePath("../test/data/trusted_root.json"),
-		})
-
-		res := verifier.Verify(attestations, publicGoodPolicy(t))
-		require.Len(t, res.VerifyResults, 0)
-		require.NotNil(t, res.Error)
-	})
-
 }
 
 func publicGoodPolicy(t *testing.T) verify.PolicyBuilder {

From 4ec696dacd7a387f658c139a538ac414f2379033 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 13:40:48 -0600
Subject: [PATCH 290/301] create common test fixture, organize tests

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/options_test.go | 112 +++++++++------------
 1 file changed, 46 insertions(+), 66 deletions(-)

diff --git a/pkg/cmd/attestation/verify/options_test.go b/pkg/cmd/attestation/verify/options_test.go
index b9be054a5..77c0e3b23 100644
--- a/pkg/cmd/attestation/verify/options_test.go
+++ b/pkg/cmd/attestation/verify/options_test.go
@@ -13,29 +13,28 @@ var (
 	publicGoodBundlePath   = test.NormalizeRelativePath("../test/data/psigstore-js-2.1.0-bundle.json")
 )
 
+var baseOptions = Options{
+	ArtifactPath:    publicGoodArtifactPath,
+	BundlePath:      publicGoodBundlePath,
+	DigestAlgorithm: "sha512",
+	Limit:           1,
+	Owner:           "sigstore",
+	OIDCIssuer:      "some issuer",
+}
+
 func TestAreFlagsValid(t *testing.T) {
 	t.Run("has invalid Repo value", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:    publicGoodArtifactPath,
-			DigestAlgorithm: "sha512",
-			OIDCIssuer:      "some issuer",
-			Repo:            "sigstoresigstore-js",
-		}
+		opts := baseOptions
+		opts.Repo = "sigstoresigstore-js"
 
 		err := opts.AreFlagsValid()
 		require.Error(t, err)
 		require.ErrorContains(t, err, "invalid value provided for repo")
 	})
 
-	t.Run("invalid limit < 0", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:    publicGoodArtifactPath,
-			BundlePath:      publicGoodBundlePath,
-			DigestAlgorithm: "sha512",
-			Owner:           "sigstore",
-			OIDCIssuer:      "some issuer",
-			Limit:           0,
-		}
+	t.Run("invalid limit == 0", func(t *testing.T) {
+		opts := baseOptions
+		opts.Limit = 0
 
 		err := opts.AreFlagsValid()
 		require.Error(t, err)
@@ -43,19 +42,43 @@ func TestAreFlagsValid(t *testing.T) {
 	})
 
 	t.Run("invalid limit > 1000", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:    publicGoodArtifactPath,
-			BundlePath:      publicGoodBundlePath,
-			DigestAlgorithm: "sha512",
-			Owner:           "sigstore",
-			OIDCIssuer:      "some issuer",
-			Limit:           1001,
-		}
+		opts := baseOptions
+		opts.Limit = 1001
 
 		err := opts.AreFlagsValid()
 		require.Error(t, err)
 		require.ErrorContains(t, err, "limit 1001 not allowed, must be between 1 and 1000")
 	})
+
+	t.Run("returns error when UseBundleFromRegistry is true and ArtifactPath is not an OCI path", func(t *testing.T) {
+		opts := baseOptions
+		opts.BundlePath = ""
+		opts.UseBundleFromRegistry = true
+
+		err := opts.AreFlagsValid()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "bundle-from-oci flag can only be used with OCI artifact paths")
+	})
+
+	t.Run("does not return error when UseBundleFromRegistry is true and ArtifactPath is an OCI path", func(t *testing.T) {
+		opts := baseOptions
+		opts.ArtifactPath = "oci://sigstore/sigstore-js:2.1.0"
+		opts.BundlePath = ""
+		opts.UseBundleFromRegistry = true
+
+		err := opts.AreFlagsValid()
+		require.NoError(t, err)
+	})
+
+	t.Run("returns error when UseBundleFromRegistry is true and BundlePath is provided", func(t *testing.T) {
+		opts := baseOptions
+		opts.ArtifactPath = "oci://sigstore/sigstore-js:2.1.0"
+		opts.UseBundleFromRegistry = true
+
+		err := opts.AreFlagsValid()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "bundle-from-oci flag cannot be used with bundle-path flag")
+	})
 }
 
 func TestSetPolicyFlags(t *testing.T) {
@@ -116,47 +139,4 @@ func TestSetPolicyFlags(t *testing.T) {
 		require.Equal(t, "sigstore", opts.Owner)
 		require.Equal(t, "^https://github/foo", opts.SANRegex)
 	})
-
-	t.Run("returns error when UseBundleFromRegistry is true and ArtifactPath is not an OCI path", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:          publicGoodArtifactPath,
-			DigestAlgorithm:       "sha512",
-			Owner:                 "sigstore",
-			UseBundleFromRegistry: true,
-			Limit:                 1,
-		}
-
-		err := opts.AreFlagsValid()
-		require.Error(t, err)
-		require.ErrorContains(t, err, "bundle-from-oci flag can only be used with OCI artifact paths")
-	})
-
-	t.Run("does not return error when UseBundleFromRegistry is true and ArtifactPath is an OCI path", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:          "oci://sigstore/sigstore-js:2.1.0",
-			DigestAlgorithm:       "sha512",
-			OIDCIssuer:            "some issuer",
-			Owner:                 "sigstore",
-			UseBundleFromRegistry: true,
-			Limit:                 1,
-		}
-
-		err := opts.AreFlagsValid()
-		require.NoError(t, err)
-	})
-
-	t.Run("returns error when UseBundleFromRegistry is true and BundlePath is provided", func(t *testing.T) {
-		opts := Options{
-			ArtifactPath:          "oci://sigstore/sigstore-js:2.1.0",
-			BundlePath:            publicGoodBundlePath,
-			DigestAlgorithm:       "sha512",
-			Owner:                 "sigstore",
-			UseBundleFromRegistry: true,
-			Limit:                 1,
-		}
-
-		err := opts.AreFlagsValid()
-		require.Error(t, err)
-		require.ErrorContains(t, err, "bundle-from-oci flag cannot be used with bundle-path flag")
-	})
 }

From 8a8f224a7ae36e01f15c48898f0f7be7625ba621 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 15:28:00 -0600
Subject: [PATCH 291/301] fix test

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 .../verification/sigstore_integration_test.go        | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go
index d4a92c541..b7057505e 100644
--- a/pkg/cmd/attestation/verification/sigstore_integration_test.go
+++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go
@@ -42,6 +42,8 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 		{
 			name:         "with no attestations",
 			attestations: []*api.Attestation{},
+			expectErr:    true,
+			errContains:  "no attestations were verified",
 		},
 	}
 
@@ -53,12 +55,12 @@ func TestLiveSigstoreVerifier(t *testing.T) {
 		res := verifier.Verify(tc.attestations, publicGoodPolicy(t))
 
 		if tc.expectErr {
-			require.Error(t, res.Error)
-			require.ErrorContains(t, res.Error, "verifying with issuer \"sigstore.dev\"")
-			require.Nil(t, res.VerifyResults)
+			require.Error(t, res.Error, "test case: %s", tc.name)
+			require.ErrorContains(t, res.Error, tc.errContains, "test case: %s", tc.name)
+			require.Nil(t, res.VerifyResults, "test case: %s", tc.name)
 		} else {
-			require.Len(t, len(tc.attestations), len(res.VerifyResults))
-			require.NoError(t, res.Error)
+			require.Equal(t, len(tc.attestations), len(res.VerifyResults), "test case: %s", tc.name)
+			require.NoError(t, res.Error, "test case: %s", tc.name)
 		}
 	}
 

From f8f3502cac92b5104ed81b2c2c29ce10c5ad8837 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 15:37:58 -0600
Subject: [PATCH 292/301] doc updates

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 7be4a3a20..fbe4591cc 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -52,12 +52,15 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			The %[1]s--owner%[1]s flag value must match the name of the GitHub organization
 			that the artifact's linked repository belongs to.
 
-			By default, the verify command will attempt to fetch attestations associated
-			with the provided artifact from the GitHub API. If you would prefer to verify
-			the artifact using attestations stored on disk (c.f. the %[1]sdownload%[1]s command),
-			provide a path to the %[1]s--bundle%[1]s flag. Additionally, the command
-			will only verify provenance attestations by default. To verify
-			other types of attestations, use the %[1]s--predicate-type%[1]s flag.
+			By default, the verify command will:
+			- only verify provenance attestations
+			- attempt to fetch relevant attestations via the GitHub API.
+
+			To verify other types of attestations, use the predicate-type flag.
+
+			To use your artifact's OCI registry instead of GitHub's API, use the
+			--bundle-from-oci flag. For offline verification, using attestations
+			stored on desk (c.f. the download command), provide a path to the --bundle flag.
 
 			To see the full results that are generated upon successful verification, i.e.
 			for use with a policy engine, provide the %[1]s--format=json%[1]s flag.

From 7598c4a58f70b25d3e8583cc6b3a28f696ab8bb5 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Mon, 28 Oct 2024 15:38:06 -0600
Subject: [PATCH 293/301] organize

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 69acb91e1..f2627120d 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -268,13 +268,13 @@ func TestNewVerifyCmd(t *testing.T) {
 				ArtifactPath:     artifactPath,
 				BundlePath:       bundlePath,
 				DigestAlgorithm:  "sha256",
+				Hostname:         "github.com",
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				PredicateType:    "https://spdx.dev/Document/v2.3",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsExporter: true,
 		},

From a3f353d2f7f942e2c83aeae73529dcd054e5a443 Mon Sep 17 00:00:00 2001
From: Miroma <136986257+its-miroma@users.noreply.github.com>
Date: Tue, 29 Oct 2024 09:47:45 +0100
Subject: [PATCH 294/301] Set `dnf5` commands as default

Fedora 41 is now stable! :tada:

Closes #9840

Co-authored-by: Melamit64 <151834564+melamit@users.noreply.github.com>
---
 docs/install_linux.md | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/docs/install_linux.md b/docs/install_linux.md
index 9be6aed9b..5943bba24 100644
--- a/docs/install_linux.md
+++ b/docs/install_linux.md
@@ -33,39 +33,37 @@ sudo apt install gh
 > [!NOTE]
 > If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
 
-### Fedora, CentOS, Red Hat Enterprise Linux (dnf)
+### Fedora, CentOS, Red Hat Enterprise Linux (dnf5)
 
 Install from our package repository for immediate access to latest releases:
 
 ```bash
-sudo dnf install 'dnf-command(config-manager)'
-sudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
+sudo dnf install dnf5-plugins
+sudo dnf config-manager addrepo --from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo
 sudo dnf install gh --repo gh-cli
 ```
 
-<details>
-<summary>Show dnf5 commands</summary>
+These commands apply for `dnf5`. If you're using `dnf4`, commands will vary slightly.
 
-If you're using `dnf5`, commands will vary slightly:
+<details>
+<summary>Show dnf4 commands</summary>
 
 ```bash
-sudo dnf5 install dnf5-plugins
-sudo dnf5 config-manager addrepo --from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo
-sudo dnf5 install gh --repo gh-cli
+sudo dnf4 install 'dnf-command(config-manager)'
+sudo dnf4 config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
+sudo dnf4 install gh --repo gh-cli
 ```
-
-For more details, check out the [`dnf5 config-manager` documentation](https://dnf5.readthedocs.io/en/latest/dnf5_plugins/config-manager.8.html).
 </details>
 
+> [!NOTE]
+> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
+
 Alternatively, install from the [community repository](https://packages.fedoraproject.org/pkgs/gh/gh/):
 
 ```bash
 sudo dnf install gh
 ```
 
-> [!NOTE]
-> If errors regarding GPG signatures occur, see [cli/cli#9569](https://github.com/cli/cli/issues/9569) for steps to fix this.
-
 Upgrade:
 
 ```bash

From efa6fafc4780a7f6886f29a523f066968619d903 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@users.noreply.github.com>
Date: Tue, 29 Oct 2024 07:06:23 -0600
Subject: [PATCH 295/301] Update
 pkg/cmd/attestation/verification/attestation.go

Co-authored-by: Phill MV <phillmv@github.com>
---
 pkg/cmd/attestation/verification/attestation.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verification/attestation.go b/pkg/cmd/attestation/verification/attestation.go
index 5c126fc8e..0ea91c2f7 100644
--- a/pkg/cmd/attestation/verification/attestation.go
+++ b/pkg/cmd/attestation/verification/attestation.go
@@ -15,7 +15,7 @@ import (
 	"github.com/sigstore/sigstore-go/pkg/bundle"
 )
 
-const SLSAPredicateType = "https://slsa.dev/provenance/v1"
+const SLSAPredicateV1 = "https://slsa.dev/provenance/v1"
 
 var ErrUnrecognisedBundleExtension = errors.New("bundle file extension not supported, must be json or jsonl")
 var ErrEmptyBundleFile = errors.New("provided bundle file is empty")

From 7bfddec046372e7732a8078130a194aee9fc3571 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 29 Oct 2024 07:09:45 -0600
Subject: [PATCH 296/301] fix references

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 .../attestation/verification/mock_verifier.go |  2 +-
 pkg/cmd/attestation/verify/verify.go          |  2 +-
 pkg/cmd/attestation/verify/verify_test.go     | 28 +++++++++----------
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkg/cmd/attestation/verification/mock_verifier.go b/pkg/cmd/attestation/verification/mock_verifier.go
index c5560743b..e22142ed5 100644
--- a/pkg/cmd/attestation/verification/mock_verifier.go
+++ b/pkg/cmd/attestation/verification/mock_verifier.go
@@ -18,7 +18,7 @@ type MockSigstoreVerifier struct {
 
 func (v *MockSigstoreVerifier) Verify(attestations []*api.Attestation, policy verify.PolicyBuilder) *SigstoreResults {
 	statement := &in_toto.Statement{}
-	statement.PredicateType = SLSAPredicateType
+	statement.PredicateType = SLSAPredicateV1
 
 	result := AttestationProcessingResult{
 		Attestation: &api.Attestation{
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index fbe4591cc..bf0f6191d 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -184,7 +184,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")
 	verifyCmd.MarkFlagsMutuallyExclusive("owner", "repo")
 	verifyCmd.MarkFlagsOneRequired("owner", "repo")
-	verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", verification.SLSAPredicateType, "Filter attestations by provided predicate type")
+	verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", verification.SLSAPredicateV1, "Filter attestations by provided predicate type")
 	verifyCmd.Flags().BoolVarP(&opts.NoPublicGood, "no-public-good", "", false, "Do not verify attestations signed with Sigstore public good instance")
 	verifyCmd.Flags().StringVarP(&opts.TrustedRoot, "custom-trusted-root", "", "", "Path to a trusted_root.jsonl file; likely for offline verification")
 	verifyCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index f2627120d..1a787ccf4 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -74,7 +74,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
 			wantsErr: true,
@@ -90,7 +90,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -107,7 +107,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://foo.ghe.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -124,7 +124,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -141,7 +141,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -157,7 +157,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -173,7 +173,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				Repo:             "sigstore/sigstore-js",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -189,7 +189,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -205,7 +205,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            101,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -221,7 +221,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            0,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -237,7 +237,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SAN:              "https://github.com/sigstore/",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
@@ -255,7 +255,7 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				OIDCIssuer:       verification.GitHubOIDCIssuer,
 				Owner:            "sigstore",
-				PredicateType:    verification.SLSAPredicateType,
+				PredicateType:    verification.SLSAPredicateV1,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 			},
@@ -363,7 +363,7 @@ func TestJSONOutput(t *testing.T) {
 		OCIClient:        oci.MockClient{},
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 		exporter:         cmdutil.NewJSONExporter(),
@@ -387,7 +387,7 @@ func TestRunVerify(t *testing.T) {
 		OCIClient:        oci.MockClient{},
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
 	}

From 15d7e33ddb82204ab1d7a9828c442a3cdbd996a6 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 29 Oct 2024 07:11:51 -0600
Subject: [PATCH 297/301] update references

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify_integration_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index 3a9a8185f..e7a3ca3fa 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -40,7 +40,7 @@ func TestVerifyIntegration(t *testing.T) {
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "sigstore",
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		SANRegex:         "^https://github.com/sigstore/",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
@@ -113,7 +113,7 @@ func TestVerifyIntegrationCustomIssuer(t *testing.T) {
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       "https://token.actions.githubusercontent.com/hammer-time",
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
 
@@ -183,7 +183,7 @@ func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 		Logger:           logger,
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}
 
@@ -274,7 +274,7 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		OCIClient:        oci.NewLiveClient(),
 		OIDCIssuer:       verification.GitHubOIDCIssuer,
 		Owner:            "malancas",
-		PredicateType:    verification.SLSAPredicateType,
+		PredicateType:    verification.SLSAPredicateV1,
 		Repo:             "malancas/attest-demo",
 		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
 	}

From 15b2db9277735c7cfd715db9c05134b7bb64d23c Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Tue, 29 Oct 2024 10:25:04 -0400
Subject: [PATCH 298/301] Require visibility confirmation in `gh repo edit`

This commit modifies interactive and non-interactive behaviors around `gh repo edit` as well as providing greater information about the impact.

1. `--help` usage is expanded to highlight the most significant consequences of changing visibility
1. `--help` usage and interactive experience call out GitHub Docs content that act as source of truth about full consequences of various changes
1. `gh repo edit` interactive experience will require confirmation for any visibility change
1. `gh repo edit` interactive experience will output potential stars and watchers lose regardless of visibility transition
1. `gh repo edit` will require `--visibility` flag to include new `--accept-visibility-change-consequences` flag regardless of interactivity
---
 pkg/cmd/repo/edit/edit.go      |  59 ++++++++----
 pkg/cmd/repo/edit/edit_test.go | 165 +++++++++++++++++++++++++++++++--
 2 files changed, 195 insertions(+), 29 deletions(-)

diff --git a/pkg/cmd/repo/edit/edit.go b/pkg/cmd/repo/edit/edit.go
index 508dea06c..29a149cf9 100644
--- a/pkg/cmd/repo/edit/edit.go
+++ b/pkg/cmd/repo/edit/edit.go
@@ -15,6 +15,7 @@ import (
 	fd "github.com/cli/cli/v2/internal/featuredetection"
 	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/ghrepo"
+	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/cli/cli/v2/pkg/set"
@@ -49,15 +50,16 @@ const (
 )
 
 type EditOptions struct {
-	HTTPClient      *http.Client
-	Repository      ghrepo.Interface
-	IO              *iostreams.IOStreams
-	Edits           EditRepositoryInput
-	AddTopics       []string
-	RemoveTopics    []string
-	InteractiveMode bool
-	Detector        fd.Detector
-	Prompter        iprompter
+	HTTPClient                         *http.Client
+	Repository                         ghrepo.Interface
+	IO                                 *iostreams.IOStreams
+	Edits                              EditRepositoryInput
+	AddTopics                          []string
+	RemoveTopics                       []string
+	AcceptVisibilityChangeConsequences bool
+	InteractiveMode                    bool
+	Detector                           fd.Detector
+	Prompter                           iprompter
 	// Cache of current repo topics to avoid retrieving them
 	// in multiple flows.
 	topicsCache []string
@@ -103,7 +105,16 @@ func NewCmdEdit(f *cmdutil.Factory, runF func(options *EditOptions) error) *cobr
 
 			To toggle a setting off, use the %[1]s--<flag>=false%[1]s syntax.
 
-			Note that changing repository visibility to private will cause loss of stars and watchers.
+			Changing repository visibility can have unexpected consequences including but not limited to:
+
+			- Losing stars and watchers, affecting repository ranking
+			- Detaching public forks from the network
+			- Disabling push rulesets
+			- Allowing access to GitHub Actions history and logs
+
+			When the %[1]s--visibility%[1]s flag is used, %[1]s--accept-visibility-change-consequences%[1]s flag is required.
+
+			For information on all the potential consequences, see <https://gh.io/setting-repository-visibility>
 		`, "`"),
 		Args: cobra.MaximumNArgs(1),
 		Example: heredoc.Doc(`
@@ -142,6 +153,10 @@ func NewCmdEdit(f *cmdutil.Factory, runF func(options *EditOptions) error) *cobr
 				return cmdutil.FlagErrorf("specify properties to edit when not running interactively")
 			}
 
+			if opts.Edits.Visibility != nil && !opts.AcceptVisibilityChangeConsequences {
+				return cmdutil.FlagErrorf("use of --visibility flag requires --accept-visibility-change-consequences flag")
+			}
+
 			if runF != nil {
 				return runF(opts)
 			}
@@ -167,6 +182,7 @@ func NewCmdEdit(f *cmdutil.Factory, runF func(options *EditOptions) error) *cobr
 	cmdutil.NilBoolFlag(cmd, &opts.Edits.AllowUpdateBranch, "allow-update-branch", "", "Allow a pull request head branch that is behind its base branch to be updated")
 	cmd.Flags().StringSliceVar(&opts.AddTopics, "add-topic", nil, "Add repository topic")
 	cmd.Flags().StringSliceVar(&opts.RemoveTopics, "remove-topic", nil, "Remove repository topic")
+	cmd.Flags().BoolVar(&opts.AcceptVisibilityChangeConsequences, "accept-visibility-change-consequences", false, "Accept the consequences of changing the repository visibility")
 
 	return cmd
 }
@@ -379,23 +395,26 @@ func interactiveRepoEdit(opts *EditOptions, r *api.Repository) error {
 			}
 			opts.Edits.EnableProjects = &a
 		case optionVisibility:
+			cs := opts.IO.ColorScheme()
+			fmt.Fprintf(opts.IO.ErrOut, "%s Danger zone: changing repository visibility can have unexpected consequences; consult https://gh.io/setting-repository-visibility before continuing.\n", cs.WarningIcon())
+
 			visibilityOptions := []string{"public", "private", "internal"}
 			selected, err := p.Select("Visibility", strings.ToLower(r.Visibility), visibilityOptions)
 			if err != nil {
 				return err
 			}
-			confirmed := true
-			if visibilityOptions[selected] == "private" &&
-				(r.StargazerCount > 0 || r.Watchers.TotalCount > 0) {
-				cs := opts.IO.ColorScheme()
-				fmt.Fprintf(opts.IO.ErrOut, "%s Changing the repository visibility to private will cause permanent loss of stars and watchers.\n", cs.WarningIcon())
-				confirmed, err = p.Confirm("Do you want to change visibility to private?", false)
-				if err != nil {
-					return err
-				}
+			selectedVisibility := visibilityOptions[selected]
+
+			if selectedVisibility != r.Visibility && (r.StargazerCount > 0 || r.Watchers.TotalCount > 0) {
+				fmt.Fprintf(opts.IO.ErrOut, "%s Changing the repository visibility to %s will cause permanent loss of %s and %s.\n", cs.WarningIcon(), selectedVisibility, text.Pluralize(r.StargazerCount, "star"), text.Pluralize(r.Watchers.TotalCount, "watcher"))
+			}
+
+			confirmed, err := p.Confirm(fmt.Sprintf("Do you want to change visibility to %s?", selectedVisibility), false)
+			if err != nil {
+				return err
 			}
 			if confirmed {
-				opts.Edits.Visibility = &visibilityOptions[selected]
+				opts.Edits.Visibility = &selectedVisibility
 			}
 		case optionMergeOptions:
 			var defaultMergeOptions []string
diff --git a/pkg/cmd/repo/edit/edit_test.go b/pkg/cmd/repo/edit/edit_test.go
index 07f7d4d55..728f19d45 100644
--- a/pkg/cmd/repo/edit/edit_test.go
+++ b/pkg/cmd/repo/edit/edit_test.go
@@ -34,6 +34,63 @@ func TestNewCmdEdit(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "deny public visibility change without accepting consequences",
+			args: "--visibility public",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits:      EditRepositoryInput{},
+			},
+			wantErr: "use of --visibility flag requires --accept-visibility-change-consequences flag",
+		},
+		{
+			name: "allow public visibility change with accepting consequences",
+			args: "--visibility public --accept-visibility-change-consequences",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits: EditRepositoryInput{
+					Visibility: sp("public"),
+				},
+			},
+		},
+		{
+			name: "deny private visibility change without accepting consequences",
+			args: "--visibility private",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits:      EditRepositoryInput{},
+			},
+			wantErr: "use of --visibility flag requires --accept-visibility-change-consequences flag",
+		},
+		{
+			name: "allow private visibility change with accepting consequences",
+			args: "--visibility private --accept-visibility-change-consequences",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits: EditRepositoryInput{
+					Visibility: sp("private"),
+				},
+			},
+		},
+		{
+			name: "deny internal visibility change without accepting consequences",
+			args: "--visibility internal",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits:      EditRepositoryInput{},
+			},
+			wantErr: "use of --visibility flag requires --accept-visibility-change-consequences flag",
+		},
+		{
+			name: "allow internal visibility change with accepting consequences",
+			args: "--visibility internal --accept-visibility-change-consequences",
+			wantOpts: EditOptions{
+				Repository: ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				Edits: EditRepositoryInput{
+					Visibility: sp("internal"),
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -241,6 +298,104 @@ func Test_editRun_interactive(t *testing.T) {
 					}))
 			},
 		},
+		{
+			name: "skipping visibility without confirmation",
+			opts: EditOptions{
+				Repository:      ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				InteractiveMode: true,
+			},
+			promptStubs: func(pm *prompter.MockPrompter) {
+				pm.RegisterMultiSelect("What do you want to edit?", nil, editList,
+					func(_ string, _, opts []string) ([]int, error) {
+						return []int{8}, nil
+					})
+				pm.RegisterSelect("Visibility", []string{"public", "private", "internal"},
+					func(_, _ string, opts []string) (int, error) {
+						return prompter.IndexFor(opts, "private")
+					})
+				pm.RegisterConfirm("Do you want to change visibility to private?", func(_ string, _ bool) (bool, error) {
+					return false, nil
+				})
+			},
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(`query RepositoryInfo\b`),
+					httpmock.StringResponse(`
+					{
+						"data": {
+							"repository": {
+								"visibility": "public",
+								"description": "description",
+								"homePageUrl": "https://url.com",
+								"defaultBranchRef": {
+									"name": "main"
+								},
+								"stargazerCount": 10,
+								"isInOrganization": false,
+								"repositoryTopics": {
+									"nodes": [{
+										"topic": {
+											"name": "x"
+										}
+									}]
+								}
+							}
+						}
+					}`))
+				reg.Exclude(t, httpmock.REST("PATCH", "repos/OWNER/REPO"))
+			},
+		},
+		{
+			name: "changing visibility with confirmation",
+			opts: EditOptions{
+				Repository:      ghrepo.NewWithHost("OWNER", "REPO", "github.com"),
+				InteractiveMode: true,
+			},
+			promptStubs: func(pm *prompter.MockPrompter) {
+				pm.RegisterMultiSelect("What do you want to edit?", nil, editList,
+					func(_ string, _, opts []string) ([]int, error) {
+						return []int{8}, nil
+					})
+				pm.RegisterSelect("Visibility", []string{"public", "private", "internal"},
+					func(_, _ string, opts []string) (int, error) {
+						return prompter.IndexFor(opts, "private")
+					})
+				pm.RegisterConfirm("Do you want to change visibility to private?", func(_ string, _ bool) (bool, error) {
+					return true, nil
+				})
+			},
+			httpStubs: func(t *testing.T, reg *httpmock.Registry) {
+				reg.Register(
+					httpmock.GraphQL(`query RepositoryInfo\b`),
+					httpmock.StringResponse(`
+					{
+						"data": {
+							"repository": {
+								"visibility": "public",
+								"description": "description",
+								"homePageUrl": "https://url.com",
+								"defaultBranchRef": {
+									"name": "main"
+								},
+								"stargazerCount": 10,
+								"isInOrganization": false,
+								"repositoryTopics": {
+									"nodes": [{
+										"topic": {
+											"name": "x"
+										}
+									}]
+								}
+							}
+						}
+					}`))
+				reg.Register(
+					httpmock.REST("PATCH", "repos/OWNER/REPO"),
+					httpmock.RESTPayload(200, `{}`, func(payload map[string]interface{}) {
+						assert.Equal(t, "private", payload["visibility"])
+					}))
+			},
+		},
 		{
 			name: "the rest",
 			opts: EditOptions{
@@ -250,7 +405,7 @@ func Test_editRun_interactive(t *testing.T) {
 			promptStubs: func(pm *prompter.MockPrompter) {
 				pm.RegisterMultiSelect("What do you want to edit?", nil, editList,
 					func(_ string, _, opts []string) ([]int, error) {
-						return []int{0, 2, 3, 5, 6, 8, 9}, nil
+						return []int{0, 2, 3, 5, 6, 9}, nil
 					})
 				pm.RegisterInput("Default branch name", func(_, _ string) (string, error) {
 					return "trunk", nil
@@ -267,13 +422,6 @@ func Test_editRun_interactive(t *testing.T) {
 				pm.RegisterConfirm("Convert into a template repository?", func(_ string, _ bool) (bool, error) {
 					return true, nil
 				})
-				pm.RegisterSelect("Visibility", []string{"public", "private", "internal"},
-					func(_, _ string, opts []string) (int, error) {
-						return prompter.IndexFor(opts, "private")
-					})
-				pm.RegisterConfirm("Do you want to change visibility to private?", func(_ string, _ bool) (bool, error) {
-					return true, nil
-				})
 				pm.RegisterConfirm("Enable Wikis?", func(_ string, _ bool) (bool, error) {
 					return true, nil
 				})
@@ -310,7 +458,6 @@ func Test_editRun_interactive(t *testing.T) {
 						assert.Equal(t, "https://zombo.com", payload["homepage"])
 						assert.Equal(t, true, payload["has_issues"])
 						assert.Equal(t, true, payload["has_projects"])
-						assert.Equal(t, "private", payload["visibility"])
 						assert.Equal(t, true, payload["is_template"])
 						assert.Equal(t, true, payload["has_wiki"])
 					}))

From 271450883ea14432162bf89cb28c3875159ac296 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@users.noreply.github.com>
Date: Tue, 29 Oct 2024 11:53:28 -0600
Subject: [PATCH 299/301] Update pkg/cmd/attestation/verify/verify.go

Co-authored-by: Phill MV <phillmv@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index bf0f6191d..b649f2083 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -56,7 +56,7 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			- only verify provenance attestations
 			- attempt to fetch relevant attestations via the GitHub API.
 
-			To verify other types of attestations, use the predicate-type flag.
+			To verify other types of attestations, use the %[1]s--predicate-type%[1]s flag.
 
 			To use your artifact's OCI registry instead of GitHub's API, use the
 			--bundle-from-oci flag. For offline verification, using attestations

From 384057c2e2c972652692bddd424dc5e3e8614a16 Mon Sep 17 00:00:00 2001
From: Meredith Lancaster <malancas@github.com>
Date: Tue, 29 Oct 2024 11:54:42 -0600
Subject: [PATCH 300/301] bold all flags in docs

Signed-off-by: Meredith Lancaster <malancas@github.com>
---
 pkg/cmd/attestation/verify/verify.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index b649f2083..206001f9b 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -59,8 +59,8 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			To verify other types of attestations, use the %[1]s--predicate-type%[1]s flag.
 
 			To use your artifact's OCI registry instead of GitHub's API, use the
-			--bundle-from-oci flag. For offline verification, using attestations
-			stored on desk (c.f. the download command), provide a path to the --bundle flag.
+			%[1]s--bundle-from-oci%[1]s flag. For offline verification, using attestations
+			stored on desk (c.f. the download command), provide a path to the %[1]s--bundle%[1]s flag.
 
 			To see the full results that are generated upon successful verification, i.e.
 			for use with a policy engine, provide the %[1]s--format=json%[1]s flag.

From 3f5fc85e41e8b664bed033cbf79e2c0104ffbff3 Mon Sep 17 00:00:00 2001
From: Andy Feller <andyfeller@github.com>
Date: Wed, 30 Oct 2024 13:31:00 -0400
Subject: [PATCH 301/301] Assert stderr for gh repo edit visibility tests

---
 pkg/cmd/repo/edit/edit_test.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/repo/edit/edit_test.go b/pkg/cmd/repo/edit/edit_test.go
index 728f19d45..217c1dce4 100644
--- a/pkg/cmd/repo/edit/edit_test.go
+++ b/pkg/cmd/repo/edit/edit_test.go
@@ -344,6 +344,7 @@ func Test_editRun_interactive(t *testing.T) {
 					}`))
 				reg.Exclude(t, httpmock.REST("PATCH", "repos/OWNER/REPO"))
 			},
+			wantsStderr: "Changing the repository visibility to private will cause permanent loss of 10 stars and 0 watchers.",
 		},
 		{
 			name: "changing visibility with confirmation",
@@ -378,6 +379,9 @@ func Test_editRun_interactive(t *testing.T) {
 									"name": "main"
 								},
 								"stargazerCount": 10,
+								"watchers": {
+									"totalCount": 15
+								},
 								"isInOrganization": false,
 								"repositoryTopics": {
 									"nodes": [{
@@ -395,6 +399,7 @@ func Test_editRun_interactive(t *testing.T) {
 						assert.Equal(t, "private", payload["visibility"])
 					}))
 			},
+			wantsStderr: "Changing the repository visibility to private will cause permanent loss of 10 stars and 15 watchers",
 		},
 		{
 			name: "the rest",
@@ -631,7 +636,7 @@ func Test_editRun_interactive(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ios, _, _, _ := iostreams.Test()
+			ios, _, _, stderr := iostreams.Test()
 			ios.SetStdoutTTY(true)
 			ios.SetStdinTTY(true)
 			ios.SetStderrTTY(true)
@@ -656,9 +661,11 @@ func Test_editRun_interactive(t *testing.T) {
 			if tt.wantsErr == "" {
 				require.NoError(t, err)
 			} else {
-				assert.EqualError(t, err, tt.wantsErr)
+				require.EqualError(t, err, tt.wantsErr)
 				return
 			}
+
+			assert.Contains(t, stderr.String(), tt.wantsStderr)
 		})
 	}
 }