From 9b6efcfc84c77c9db8c3430640ccfd47695e7c79 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 03:52:15 +0000
Subject: [PATCH 1/4] Initial plan


From 04558a6a9385fe69efe50ccc22a83208188e3941 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 04:07:28 +0000
Subject: [PATCH 2/4] =?UTF-8?q?fix:=20configure=5Fgh=5Ffor=5Fghe.sh=20?=
 =?UTF-8?q?=E2=80=94=20skip=20gh=20auth=20login=20when=20GH=5FTOKEN=20is?=
 =?UTF-8?q?=20set,=20use=20GH=5FHOST=20instead?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When GH_TOKEN is already in the environment, `gh auth login` fails with:
  "The value of the GH_TOKEN environment variable is being used for authentication."

The fix: when GH_TOKEN is set, skip gh auth login and only export GH_HOST to
GITHUB_ENV. The token already handles authentication; GH_HOST is all that is
needed to target the correct GitHub Enterprise host.

Also fixes tests 3 & 4 to not rely on sourcing the full script while GH_TOKEN
is set, and adds tests 6 & 7 for the new GH_TOKEN / no-GH_TOKEN code paths.

Closes #21407

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
---
 ...patch-fix-configure-gh-for-ghe-gh-token.md |  5 ++
 actions/setup/sh/configure_gh_for_ghe.sh      | 45 ++++-------
 actions/setup/sh/configure_gh_for_ghe_test.sh | 77 +++++++++++++++++--
 3 files changed, 88 insertions(+), 39 deletions(-)
 create mode 100644 .changeset/patch-fix-configure-gh-for-ghe-gh-token.md

diff --git a/.changeset/patch-fix-configure-gh-for-ghe-gh-token.md b/.changeset/patch-fix-configure-gh-for-ghe-gh-token.md
new file mode 100644
index 00000000000..f22c4a03376
--- /dev/null
+++ b/.changeset/patch-fix-configure-gh-for-ghe-gh-token.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Fix `configure_gh_for_ghe.sh` failing when `GH_TOKEN` is set. Previously the script always ran `gh auth login --with-token`, which the `gh` CLI rejects when `GH_TOKEN` is already in the environment. Now, when `GH_TOKEN` is present, the script skips `gh auth login` and only exports `GH_HOST` to `GITHUB_ENV` — the token already handles authentication and `GH_HOST` is all that is needed to point `gh` at the correct GitHub Enterprise host.
diff --git a/actions/setup/sh/configure_gh_for_ghe.sh b/actions/setup/sh/configure_gh_for_ghe.sh
index e61fc924d35..d5b5a4250ed 100755
--- a/actions/setup/sh/configure_gh_for_ghe.sh
+++ b/actions/setup/sh/configure_gh_for_ghe.sh
@@ -76,40 +76,23 @@ main() {
     exit 1
   fi
 
-  # Check if GH_TOKEN is set
-  if [ -z "${GH_TOKEN}" ]; then
-    echo "::error::GH_TOKEN environment variable is not set. gh CLI requires authentication."
-    exit 1
-  fi
-
-  # Configure gh to use the enterprise host
-  # We use 'gh auth login' with the token to configure the host
-  echo "Authenticating gh CLI with host: ${github_host}"
-
-  # Use gh auth login with --with-token to configure the host
-  # This sets up gh to use the correct API endpoint for the enterprise host
-  echo "${GH_TOKEN}" | gh auth login --hostname "${github_host}" --with-token
-
-  if [ $? -eq 0 ]; then
-    echo "✓ Successfully configured gh CLI for ${github_host}"
-
-    # Verify the configuration
-    if gh auth status --hostname "${github_host}" &> /dev/null; then
-      echo "✓ Verified gh CLI authentication for ${github_host}"
-    else
-      echo "::warning::gh CLI configured but authentication verification failed"
+  # When GH_TOKEN is already set in the environment, running 'gh auth login' fails with:
+  #   "The value of the GH_TOKEN environment variable is being used for authentication.
+  #    To have GitHub CLI store credentials instead, first clear the value from the environment."
+  # In this case, gh CLI already authenticates via GH_TOKEN — we only need to set GH_HOST so
+  # gh knows which host to target.
+  if [ -n "${GH_TOKEN}" ]; then
+    echo "GH_TOKEN is set — skipping gh auth login and exporting GH_HOST only"
+    export GH_HOST="${github_host}"
+    if [ -n "${GITHUB_ENV:-}" ]; then
+      echo "GH_HOST=${github_host}" >> "${GITHUB_ENV}"
     fi
-  else
-    echo "::error::Failed to configure gh CLI for ${github_host}"
-    exit 1
+    echo "✓ Set GH_HOST=${github_host}"
+    return 0
   fi
 
-  # Set GH_HOST environment variable to ensure gh uses the correct host for subsequent commands
-  export GH_HOST="${github_host}"
-  if [ -n "${GITHUB_ENV:-}" ]; then
-    echo "GH_HOST=${github_host}" >> "${GITHUB_ENV}"
-  fi
-  echo "✓ Set GH_HOST environment variable to ${github_host}"
+  echo "::error::GH_TOKEN environment variable is not set. gh CLI requires authentication."
+  exit 1
 }
 
 # Run main function
diff --git a/actions/setup/sh/configure_gh_for_ghe_test.sh b/actions/setup/sh/configure_gh_for_ghe_test.sh
index 2de3fec3151..1a8e67fbf77 100755
--- a/actions/setup/sh/configure_gh_for_ghe_test.sh
+++ b/actions/setup/sh/configure_gh_for_ghe_test.sh
@@ -39,10 +39,12 @@ fi
 # Test 3: Test host detection from GITHUB_SERVER_URL
 echo ""
 echo "Test 3: Testing host detection from GITHUB_SERVER_URL..."
-export GITHUB_SERVER_URL="https://myorg.ghe.com"
-export GH_TOKEN="test-token"
-# Use the real detect_github_host implementation from configure_gh_for_ghe.sh
-output=$(bash -c "source '${CONFIGURE_GH_SCRIPT}'; detect_github_host" 2>&1)
+# Source with no GHE vars (so main is a no-op), then call detect_github_host directly.
+unset GITHUB_SERVER_URL GITHUB_ENTERPRISE_HOST GITHUB_HOST GH_HOST GH_TOKEN
+output=$(bash -c "
+  source '${CONFIGURE_GH_SCRIPT}' >/dev/null 2>&1
+  GITHUB_SERVER_URL='https://myorg.ghe.com' detect_github_host
+" 2>/dev/null)
 if [ "$output" = "myorg.ghe.com" ]; then
   echo "PASS: Correctly extracted host from GITHUB_SERVER_URL"
 else
@@ -53,10 +55,11 @@ fi
 # Test 4: Test host detection from GITHUB_ENTERPRISE_HOST
 echo ""
 echo "Test 4: Testing host detection from GITHUB_ENTERPRISE_HOST..."
-unset GITHUB_SERVER_URL
-export GITHUB_ENTERPRISE_HOST="enterprise.github.com"
-# Use the real detect_github_host implementation from configure_gh_for_ghe.sh
-output=$(bash -c "source '${CONFIGURE_GH_SCRIPT}'; detect_github_host" 2>&1)
+unset GITHUB_SERVER_URL GITHUB_ENTERPRISE_HOST GITHUB_HOST GH_HOST GH_TOKEN
+output=$(bash -c "
+  source '${CONFIGURE_GH_SCRIPT}' >/dev/null 2>&1
+  GITHUB_ENTERPRISE_HOST='enterprise.github.com' detect_github_host
+" 2>/dev/null)
 if [ "$output" = "enterprise.github.com" ]; then
   echo "PASS: Correctly extracted host from GITHUB_ENTERPRISE_HOST"
 else
@@ -99,6 +102,64 @@ for input in "${!test_cases[@]}"; do
   fi
 done
 
+# Test 6: GHE host + GH_TOKEN set — must skip gh auth login and only export GH_HOST
+echo ""
+echo "Test 6: Testing GHE host with GH_TOKEN set (should skip gh auth login)..."
+unset GITHUB_SERVER_URL GITHUB_ENTERPRISE_HOST GITHUB_HOST GH_HOST
+export GITHUB_SERVER_URL="https://myorg.ghe.com"
+export GH_TOKEN="test-token"
+FAKE_GITHUB_ENV=$(mktemp)
+output=$(bash -c "
+  GITHUB_ENV='${FAKE_GITHUB_ENV}' \
+  GITHUB_SERVER_URL='https://myorg.ghe.com' \
+  GH_TOKEN='test-token' \
+  source '${CONFIGURE_GH_SCRIPT}'
+" 2>&1)
+exit_code=$?
+
+if [ $exit_code -ne 0 ]; then
+  echo "FAIL: Script exited with code $exit_code"
+  echo "Output: $output"
+  rm -f "${FAKE_GITHUB_ENV}"
+  exit 1
+fi
+
+if ! echo "$output" | grep -q "GH_TOKEN is set"; then
+  echo "FAIL: Expected 'GH_TOKEN is set' message. Output: $output"
+  rm -f "${FAKE_GITHUB_ENV}"
+  exit 1
+fi
+
+if ! grep -q "GH_HOST=myorg.ghe.com" "${FAKE_GITHUB_ENV}"; then
+  echo "FAIL: GH_HOST=myorg.ghe.com was not written to GITHUB_ENV"
+  cat "${FAKE_GITHUB_ENV}"
+  rm -f "${FAKE_GITHUB_ENV}"
+  exit 1
+fi
+rm -f "${FAKE_GITHUB_ENV}"
+echo "PASS: Skipped gh auth login and exported GH_HOST when GH_TOKEN is set"
+
+# Test 7: GHE host without GH_TOKEN set — must error
+echo ""
+echo "Test 7: Testing GHE host without GH_TOKEN set (should error)..."
+unset GITHUB_SERVER_URL GITHUB_ENTERPRISE_HOST GITHUB_HOST GH_HOST GH_TOKEN
+exit_code=0
+output=$(bash -c "
+  GITHUB_SERVER_URL='https://myorg.ghe.com' \
+  source '${CONFIGURE_GH_SCRIPT}'
+" 2>&1) || exit_code=$?
+
+if [ $exit_code -eq 0 ]; then
+  echo "FAIL: Script should have failed but exited with 0"
+  exit 1
+fi
+
+if ! echo "$output" | grep -q "GH_TOKEN environment variable is not set"; then
+  echo "FAIL: Expected 'GH_TOKEN environment variable is not set' error. Output: $output"
+  exit 1
+fi
+echo "PASS: Correctly errors when GH_TOKEN is not set for GHE host"
+
 echo ""
 echo "================================"
 echo "All tests passed!"

From 2e410e17ccd98c20306b65cdfec101dd58e13520 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 17 Mar 2026 21:12:19 -0700
Subject: [PATCH 3/4] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 actions/setup/sh/configure_gh_for_ghe.sh | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/actions/setup/sh/configure_gh_for_ghe.sh b/actions/setup/sh/configure_gh_for_ghe.sh
index d5b5a4250ed..88e90b6e954 100755
--- a/actions/setup/sh/configure_gh_for_ghe.sh
+++ b/actions/setup/sh/configure_gh_for_ghe.sh
@@ -76,13 +76,14 @@ main() {
     exit 1
   fi
 
-  # When GH_TOKEN is already set in the environment, running 'gh auth login' fails with:
+  # When GH_TOKEN is already set in the environment, running 'gh auth login' would fail with:
   #   "The value of the GH_TOKEN environment variable is being used for authentication.
   #    To have GitHub CLI store credentials instead, first clear the value from the environment."
-  # In this case, gh CLI already authenticates via GH_TOKEN — we only need to set GH_HOST so
-  # gh knows which host to target.
+  # In this case, gh CLI will already authenticate via GH_TOKEN. This script still requires gh
+  # to be installed (checked above); here we only need to set GH_HOST so gh knows which host
+  # to target.
   if [ -n "${GH_TOKEN}" ]; then
-    echo "GH_TOKEN is set — skipping gh auth login and exporting GH_HOST only"
+    echo "GH_TOKEN is set — skipping gh auth login and exporting GH_HOST (gh CLI must already be installed)"
     export GH_HOST="${github_host}"
     if [ -n "${GITHUB_ENV:-}" ]; then
       echo "GH_HOST=${github_host}" >> "${GITHUB_ENV}"

From 99718404250f30fefa92cd58ac78489bc2ebfbb7 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 17 Mar 2026 21:12:37 -0700
Subject: [PATCH 4/4] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 actions/setup/sh/configure_gh_for_ghe_test.sh | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/actions/setup/sh/configure_gh_for_ghe_test.sh b/actions/setup/sh/configure_gh_for_ghe_test.sh
index 1a8e67fbf77..d834bcd979c 100755
--- a/actions/setup/sh/configure_gh_for_ghe_test.sh
+++ b/actions/setup/sh/configure_gh_for_ghe_test.sh
@@ -108,6 +108,17 @@ echo "Test 6: Testing GHE host with GH_TOKEN set (should skip gh auth login)..."
 unset GITHUB_SERVER_URL GITHUB_ENTERPRISE_HOST GITHUB_HOST GH_HOST
 export GITHUB_SERVER_URL="https://myorg.ghe.com"
 export GH_TOKEN="test-token"
+
+# Stub a fake gh binary so configure_gh_for_ghe.sh can find it via command -v gh
+FAKE_GH_DIR=$(mktemp -d)
+FAKE_GH="${FAKE_GH_DIR}/gh"
+cat > "${FAKE_GH}" << 'EOF'
+#!/usr/bin/env bash
+exit 0
+EOF
+chmod +x "${FAKE_GH}"
+export PATH="${FAKE_GH_DIR}:${PATH}"
+
 FAKE_GITHUB_ENV=$(mktemp)
 output=$(bash -c "
   GITHUB_ENV='${FAKE_GITHUB_ENV}' \
@@ -121,12 +132,14 @@ if [ $exit_code -ne 0 ]; then
   echo "FAIL: Script exited with code $exit_code"
   echo "Output: $output"
   rm -f "${FAKE_GITHUB_ENV}"
+  rm -rf "${FAKE_GH_DIR}"
   exit 1
 fi
 
 if ! echo "$output" | grep -q "GH_TOKEN is set"; then
   echo "FAIL: Expected 'GH_TOKEN is set' message. Output: $output"
   rm -f "${FAKE_GITHUB_ENV}"
+  rm -rf "${FAKE_GH_DIR}"
   exit 1
 fi
 
@@ -134,6 +147,7 @@ if ! grep -q "GH_HOST=myorg.ghe.com" "${FAKE_GITHUB_ENV}"; then
   echo "FAIL: GH_HOST=myorg.ghe.com was not written to GITHUB_ENV"
   cat "${FAKE_GITHUB_ENV}"
   rm -f "${FAKE_GITHUB_ENV}"
+  rm -rf "${FAKE_GH_DIR}"
   exit 1
 fi
 rm -f "${FAKE_GITHUB_ENV}"
@@ -151,15 +165,20 @@ output=$(bash -c "
 
 if [ $exit_code -eq 0 ]; then
   echo "FAIL: Script should have failed but exited with 0"
+  rm -rf "${FAKE_GH_DIR}"
   exit 1
 fi
 
 if ! echo "$output" | grep -q "GH_TOKEN environment variable is not set"; then
   echo "FAIL: Expected 'GH_TOKEN environment variable is not set' error. Output: $output"
+  rm -rf "${FAKE_GH_DIR}"
   exit 1
 fi
 echo "PASS: Correctly errors when GH_TOKEN is not set for GHE host"
 
+# Clean up fake gh directory
+rm -rf "${FAKE_GH_DIR}"
+
 echo ""
 echo "================================"
 echo "All tests passed!"