Local extensions can override core commands #9699
Description
Describe the bug
- Local extensions (
gh ext install .) with the same name as core commands can be installed. - Once installed, if the evaluation order of commands and alias happens to result in the selection of the extension, the extension overrides the core commands.
Extensions installed from a remote GitHub repository do not exhibit this same behavior and are properly validated.
Steps to reproduce the behavior
This reproduces better from a clean installation with no aliases or extensions installed.
This can be reproduced in a cli/cli codespace to avoid mucking with your local gh installation:
# build the CLI or install it from elsewhere
make
# For convenience:
gh_path="/workspaces/cli/bin/gh"
# We need to delete any default aliases to reproduce core command overriding
$gh_path alias delete co
# Create an extension, install it, then run it to demonstrate command overriding
$gh_path ext create pr && cd gh-pr && $gh_path ext install . && $gh_path prExpected vs actual behavior
Current behavior:
- Extension that overrides a core command or alias can be installed
- Extension can then be executed instead of a core command in certain conditions
$gh_path ext create pr && cd gh-pr && $gh_path ext install . && $gh_path pr
✓ Created directory gh-pr
✓ Initialized git repository
✓ Made initial commit
✓ Set up extension scaffolding
gh-pr is ready for development!
Next Steps
- run 'cd gh-pr; gh extension install .; gh pr' to see your new extension in action
- run 'gh repo create' to share your extension with others
For more information on writing extensions:
https://docs.github.com/github-cli/github-cli/creating-github-cli-extensions
# < --------- No complaints from installation command
Hello gh-pr! # < --------- Core command has been overriddenExpected behavior:
- Fail to install extension that overrides a core command or alias.
"pr" matches the name of a built-in command or alias