1. If the command to be executed has the name help, auth check should be skipped. This would handle gh help <command>

gh help actions already skips authentication and returns the help page, even if you're logged out. gh returns false for cmdutil.IsAuthCheckEnabled().

2. If the command to be executed has a --help flag (as determined by cmd.Flags().Lookup("help")) and the flag is enabled, auth check should be skipped. This will transparently handle -h as well.

When I run gh actions --help with this code:

func IsAuthCheckEnabled(cmd *cobra.Command) bool {
	log.SetFlags(log.Llongfile)
	log.Printf("%+v", cmd.Flags().Lookup("help"))
	log.Printf("%+v", cmd.Flags())
...

I get:

github.com/cli/cli/pkg/cmdutil/auth_check.go:43: <nil>
github.com/cli/cli/pkg/cmdutil/auth_check.go:44: &{
  Usage:<nil> 
  SortFlags:true 
  ParseErrorsWhitelist:{UnknownFlags:false} 
  name:actions 
  parsed:false 
  actual:map[] 
  orderedActual:[] 
  sortedActual:[] 
  formal:map[] 
  orderedFormal:[] 
  sortedFormal:[] 
  shorthands:map[] 
  args:[] 
  argsLenAtDash:-1 
  errorHandling:0 
  output:0xc0003a7e30 
  interspersed:true 
  normalizeNameFunc:<nil> 
  addedGoFlagSets:[]
}

I tried looking for an appropriate Cobra method, but it seems the flags aren't getting set somewhere. Am I missing something obvious? If I wasn't depending on expandedArgs in gh/main.go, I could move the check into cmdutil.IsAuthCheckEnabled.

I've updated the pull request and the pull request description. My latest commits now skip the authentication message and just print the help page. We still do the authentication check though.

I've dug around a little more, but I'm still not sure why cmd.Flags().Lookup("help") returns nil.

Thanks for looking into all this. I didn't realize Cobra didn't make this more straightforward. I've pushed some changes to avoid manually checking for -h/--help flags and to avoid re-implementing the help system. It relies on Cobra's pre-run hooks. Since Cobra's implementation of hooks is pretty bad, I had to jump through hoops to ensure that the -R/--repo override hook doesn't accidentally override the auth-checking one.

No problem! I'm still trying to understand Cobra and the gh codebase, so I wasn't sure if I was missing something obvious.

The latest commit adds back the help "footer" that shows usage, inherited flags, etc. At the moment, the footer doesn't provide any new information, but if you add other flags to gh actions later, it should appear.

@chemotaxis I've reverted whitespace changes to the help doc because we feed all docs as Markdown to our documentation site, and whitespace (even trailing) in Markdown is significant.

@chemotaxis I've reverted whitespace changes to the help doc because we feed all docs as Markdown to our documentation site, and whitespace (even trailing) in Markdown is significant.

Sorry, I didn't realize that!

This pull request now has two main fixes:

• Fixing the general problem of bypassing authentication when explicitly asking for help using any command
  • Caveat: gh help <command> actually already works
• Refactoring gh actions

I was looking over the changes one last time and noticed the cmdutil.DisableAuthCheck function. I thought I'd gone over it before, but decided to investigate uses of it in the codebase. gh actions can bypass authentication by just adding cmdutil.DisableAuthCheck to the command instead of making it non-runnable.

The latest commit makes gh actions runnable again, but I've disabled authentication with the disable function. There are quite a few uses of the disable function, but gh version is probably the simplest example.

This also restores the original print behavior where gh actions prints just the text for explaining actions and workflows, but gh actions --help appends the help footer (usage, inherited flags, etc.).

Feel free to revert b0f58d0, but I think this is a better solution since it maintains the original print behavior for gh actions.