Skip to content

issue create: avoid querying default branch when checking issue availability#12873

Closed
SergioChan wants to merge 1 commit intocli:trunkfrom
SergioChan:fix-12798-issue-create-perms
Closed

issue create: avoid querying default branch when checking issue availability#12873
SergioChan wants to merge 1 commit intocli:trunkfrom
SergioChan:fix-12798-issue-create-perms

Conversation

@SergioChan
Copy link
Copy Markdown

@SergioChan SergioChan commented Mar 8, 2026 •
edited
Loading

Summary

  • switch gh issue create to fetch only hasIssuesEnabled instead of the full GitHubRepo payload
  • remove the unnecessary defaultBranchRef GraphQL field access from the issue-create path
  • keep permission scope aligned with issue creation so fine-grained PATs without Contents: Read can still create issues

Testing

  • go test ./pkg/cmd/issue/create -run TestIssueCreate -count=1

Related

@github-actions github-actions bot added unmet-requirements external pull request originating outside of the CLI core team needs-triage needs to be reviewed labels Mar 8, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 8, 2026

Thanks for your pull request! Unfortunately, it doesn't meet the minimum requirements for review:

  • None of the referenced issues have the help wanted label

Please update your PR to address the above. Requirements:

  1. Include a detailed description of what this PR does
  2. Link to an issue with the help wanted label (use Fixes #123 or Closes #123 if it resolves the issue)

This PR will be automatically closed in 7 days if these requirements are not met.

Copilot AI reviewed Mar 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes issue #12798 where gh issue create fails with fine-grained PATs that have Issues: Write but not Contents: Read permissions. The root cause was that the GitHubRepo function fetches defaultBranchRef, which requires Contents: Read. The fix switches to FetchRepository to request only the minimal fields needed.

Changes:

  • Replaces api.GitHubRepo(...) with api.FetchRepository(..., []string{"hasIssuesEnabled"}) to avoid fetching defaultBranchRef and reduce the required PAT permissions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/cmd/issue/create/create.go
}

repo, err := api.GitHubRepo(apiClient, baseRepo)
repo, err := api.FetchRepository(apiClient, baseRepo, []string{"hasIssuesEnabled"})
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The call to FetchRepository requests only "hasIssuesEnabled", but the returned repo object is used in two additional places that depend on fields not included in the query:

  1. Line 378 – api.IssueCreate(apiClient, repo, params) reads repo.ID as the repositoryId mutation input (see api/queries_issue.go:286). Since "id" is not in the requested fields, repo.ID will be an empty string, causing the createIssue mutation to fail with an invalid/missing repository ID.

  2. Line 303 – repo.ViewerCanTriage() checks repo.ViewerPermission (see api/queries_repo.go:276-282). Since "viewerPermission" is not requested, it will always be empty, so ViewerCanTriage() will always return false in interactive mode, silently removing the "Add metadata" option from the prompt.

The fields list should be updated to []string{"hasIssuesEnabled", "id", "viewerPermission"} to include both required fields while still avoiding the defaultBranchRef fetch that requires Contents: Read.

Note: the existing tests pass because the mock HTTP responses happen to include an "id" field in their JSON payload, but the real GitHub API will only return fields that were explicitly requested in the GraphQL query.

Suggested change
repo, err := api.FetchRepository(apiClient, baseRepo, []string{"hasIssuesEnabled"})
repo, err := api.FetchRepository(apiClient, baseRepo, []string{"hasIssuesEnabled", "id", "viewerPermission"})

Copilot uses AI. Check for mistakes.
@SergioChan
Copy link
Copy Markdown
Author

SergioChan commented Mar 8, 2026

Thanks for the flag. I’ll retarget this work to an issue that is explicitly labeled help wanted and update/replace this PR accordingly so it meets the contribution requirements.

@babakks
Copy link
Copy Markdown
Member

babakks commented Mar 9, 2026

Thanks for the PR, @SergioChan! 🙏

The issue is not labeled as help wanted Contributions welcome , so I'd normally close it. However, I'll give it a second thought to see if the fix is as simple as this PR. If it was, I'll review/update/merge this one; otherwise I have to close this in favour of another.

That said, I'd appreciate it if you follow our contribution guideline. Please do not open PRs for issues that are not labeled as help wanted Contributions welcome , or issues that already have a PR opened for them.

@babakks babakks mentioned this pull request Mar 9, 2026
Merged
@babakks
Copy link
Copy Markdown
Member

babakks commented Mar 9, 2026

Closing this in favour of #12884.

Please check out the other PR description for the reasons on why we're rejecting this, @SergioChan.

@babakks babakks closed this Mar 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@babakks babakks Awaiting requested review from babakks babakks is a code owner automatically assigned from cli/code-reviewers

Assignees

No one assigned

Labels

external pull request originating outside of the CLI core team needs-triage needs to be reviewed unmet-requirements

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

gh issue create fails with fine-grained PAT that has Issues:Write but not Contents:Read

3 participants

@SergioChan @babakks