[jferrl]

Summary

githubauth token needs to know which installation to mint for: --installation, --owner, --repos owner/repo, or $GITHUB_APP_INSTALLATION_ID. With none of them it exited 2. Run inside a clone, it now uses the repository the clone's origin remote names, on the same host, and scopes the token to that repository alone, the way actions/create-github-app-token defaults to the current repository. gh githubauth token --exec -- gh pr merge 7 then works in any repository the App is installed on.

What this does

Run with no installation named	Before	After
In a clone of acme/api on github.com	Exit 2	Token for acme's installation, scoped to api
In a clone whose origin is another host than the target	Exit 2	Exit 2
Outside any clone	Exit 2	Exit 2
With --owner "" (an unset script variable)	Exit 2	Exit 2

Changes

• token reads git remote get-url origin only when no --installation, --owner, --repos or $GITHUB_APP_INSTALLATION_ID is given, and only uses it when the remote's host is the target host. It accepts https, ssh://, git@host:owner/repo, and ssh.github.com on port 443.
• The --base-url/--enterprise-url checks run before the installation checks, since the default needs the target host.
• The CLI tests run from an empty directory with GIT_DIR, GIT_WORK_TREE and the caller's git config cleared.

Rationale

Only an error turns into a success, so no invocation that worked changes, and the token covers one repository, the narrowest scope. GIT_DIR is honoured because the git push under --exec honours it too, so both act on the same repository.

An adversarial Codex review found three defects, all fixed: --owner "" fell back to the clone, ssh.github.com:443 was not recognised, and the tests could add a remote to the real repository when GIT_DIR was set. Writing the tests also caught that, run from this clone, the old suite reached api.github.com through its origin.

Migration Notes

None. Tested against a real App: in a clone of gopherguru/test with no installation named, the token came back scoped to test; outside a clone the CLI exits 2.

Also in this PR

An Unreleased section in CHANGELOG.md collecting #87-#92, so cutting v1.12.0 is a date and a tag. A Codex review of it against the code added a third entry under Changed: InstallationPermissions is no longer comparable now that Other is a map (#88).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.93%. Comparing base (ac2c2f6) to head (86747bf).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #92      +/-   ##
==========================================
+ Coverage   97.86%   97.93%   +0.06%     
==========================================
  Files           8        8              
  Lines         845      871      +26     
==========================================
+ Hits          827      853      +26     
  Misses         18       18              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.