fix(github): use full token resolution chain for attestation verification by jdx · Pull Request #9154 · jdx/mise

jdx · 2026-04-16T21:20:18Z

Summary

Attestation verification was passing only the env-var token (MISE_GITHUB_TOKEN / GITHUB_TOKEN) to the GitHub API, bypassing the full token resolution chain
This meant tokens from credential_command, github_tokens.toml, the gh CLI, and git credential fill were silently ignored during attestation calls
Result: unauthenticated requests hit GitHub's IP-based rate limit even when a valid token was configured via the credential helper

Fix

Added github::resolve_token_for_api_url(api_url) to src/github.rs — parses the hostname from the API URL and delegates to the existing resolve_token priority chain
Replaced all three env::GITHUB_TOKEN.as_deref() call sites in attestation verification (detect_provenance_type, verify_provenance_at_lock_time, try_verify_github_attestations) with the new helper
The third site didn't have api_url in scope; it now derives it from self.get_api_url(&tv.request.options())

Test plan

Install a tool with GitHub artifact attestations enabled while token is set only via credential_command (not env var) — should verify without 403
Confirm existing unit/e2e tests pass: mise run test

🤖 Generated with Claude Code

Note

Medium Risk
Touches provenance/attestation verification and how auth tokens are selected, which can affect security verification outcomes and GitHub rate-limiting behavior, but the change is small and reuses existing token-resolution logic.

Overview
GitHub attestation detection and verification now authenticate using the same per-host token resolution chain as normal GitHub API requests, rather than only GITHUB_TOKEN/MISE_GITHUB_TOKEN.

This adds github::resolve_token_for_api_url() and updates all GitHub attestation call sites in backend/github.rs (including the install-time path that now derives api_url from options) to pass the resolved token for the configured API base URL, improving behavior for enterprise/custom hosts and non-env token sources (credential command, tokens file, gh CLI, git credentials).

^{Reviewed by Cursor Bugbot for commit fa5005e. Bugbot is set up for automated code reviews on this repo. Configure here.}

…tion Attestation verification was calling GitHub APIs with only the env-var token (MISE_GITHUB_TOKEN / GITHUB_TOKEN), ignoring credential_command, github_tokens.toml, gh CLI, and git credential fill. Unauthenticated requests hit GitHub's IP-based rate limit even when a valid token was configured via the credential helper. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gemini-code-assist

Code Review

This pull request updates the GitHub backend to resolve authentication tokens dynamically based on the API URL, enabling support for GitHub Enterprise. A review comment suggests simplifying the resolve_token_for_api_url function by removing redundant host canonicalization and avoiding unnecessary string allocations.

greptile-apps · 2026-04-16T21:24:48Z

Greptile Summary

This PR fixes GitHub attestation verification to use the full token resolution chain (credential command, github_tokens.toml, gh CLI, git credentials) instead of only the GITHUB_TOKEN / MISE_GITHUB_TOKEN env vars. It introduces resolve_token_for_api_url in src/github.rs and wires it into all three attestation call sites in src/backend/github.rs, including deriving api_url for the try_verify_github_attestations path where it wasn't previously in scope.

Confidence Score: 5/5

Safe to merge — targeted, correct fix with no blocking issues.

All three call sites are correctly updated; resolve_token_for_api_url properly delegates to the existing chain, resolve_token already handles api.github.com → github.com canonicalization internally, and the unused crate::env import is cleanly removed. No P0/P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
src/github.rs	Adds `resolve_token_for_api_url` helper — parses hostname from API URL (fallback: `api.github.com`) and delegates to `resolve_token`, which already handles `api.github.com → github.com` canonicalization internally. Clean and correct.
src/backend/github.rs	Replaces all three `env::GITHUB_TOKEN.as_deref()` sites in attestation verification with `github::resolve_token_for_api_url(api_url).as_deref()`; adds `api_url` derivation in `try_verify_github_attestations` where it wasn't in scope; removes now-unused `use crate::env` import.

Sequence Diagram

sequenceDiagram
    participant Caller as Attestation Caller
    participant RTFAU as resolve_token_for_api_url(api_url)
    participant RT as resolve_token(host)
    participant Env as Env Vars
    participant CC as credential_command
    participant TF as github_tokens.toml
    participant GH as gh CLI
    participant GC as git credential

    Caller->>RTFAU: api_url (e.g. "https://api.github.com")
    RTFAU->>RTFAU: parse hostname → "api.github.com" (fallback if parse fails)
    RTFAU->>RT: resolve_token("api.github.com")
    RT->>RT: canonicalize → lookup_host="github.com"
    RT->>Env: MISE_GITHUB_TOKEN / GITHUB_TOKEN?
    alt env var set
        Env-->>RT: token
    else
        RT->>CC: credential_command?
        alt credential_command configured
            CC-->>RT: token
        else
            RT->>TF: github_tokens.toml entry?
            alt entry found
                TF-->>RT: token
            else
                RT->>GH: gh CLI hosts.yml?
                alt gh token found
                    GH-->>RT: token
                else
                    RT->>GC: git credential fill?
                    GC-->>RT: token or None
                end
            end
        end
    end
    RT-->>RTFAU: Option<(token, source)>
    RTFAU-->>Caller: Option<String> (token only)

_{Reviews (3): Last reviewed commit: "fix(github): simplify api url token reso..." | Re-trigger Greptile}

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

github-actions · 2026-04-16T21:55:12Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.15 x -- echo`	22.7 ± 0.5	21.8	25.2	1.00
`mise x -- echo`	22.7 ± 0.8	21.8	33.0	1.00 ± 0.04

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.15 env`	22.2 ± 0.8	21.2	33.1	1.00 ± 0.05
`mise env`	22.1 ± 0.7	20.9	31.2	1.00

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.15 hook-env`	22.8 ± 0.9	21.8	37.9	1.01 ± 0.05
`mise hook-env`	22.5 ± 0.6	21.6	28.9	1.00

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.15 ls`	19.7 ± 0.4	18.9	22.1	1.00
`mise ls`	19.8 ± 0.7	19.1	26.4	1.01 ± 0.04

`xtasks/test/perf`

Command	mise-2026.4.15	mise	Variance
install (cached)	147ms	149ms	-1%
ls (cached)	77ms	78ms	-1%
bin-paths (cached)	85ms	83ms	+2%
task-ls (cached)	824ms	803ms	+2%

@ergofriend

### 🚀 Features - **(registry)** add .perl-version support for perl by @ergofriend in [#9102](#9102) - **(task)** add Tera template support for inline table run tasks by @iamkroot in [#9079](#9079) ### 🐛 Bug Fixes - **(env)** use runtime symlink paths for fuzzy versions by @jdx in [#9143](#9143) - **(github)** use full token resolution chain for attestation verification by @jdx in [#9154](#9154) - **(go)** Remove install-time version override for subpath packages by @c22 in [#9135](#9135) - **(npm)** respect install_before when resolving dist-tag versions by @webkaz in [#9145](#9145) - **(self-update)** ensure subcommand exists by @salim-b in [#9144](#9144) - **(task)** show available tasks when run target missing by @jdx in [#9141](#9141) - **(task)** forward task help args and add raw_args by @jdx in [#9118](#9118) - **(task)** remove red/yellow from task prefix colors by @lechuckcaptain in [#8782](#8782) - **(task)** merge TOML task block into same-named file task and surface resolved dir by @jdx in [#9147](#9147) - **(toolset)** round-trip serialized tool options by @atharvasingh7007 in [#9124](#9124) - **(vfox)** fallback to absolute bin path if env_keys not set by @80avin in [#9151](#9151) ### 📚 Documentation - make agent guide wording generic by @jdx in [#9142](#9142) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:deb docker digest to e019cb9 by @renovate[bot] in [#9160](#9160) - update ghcr.io/jdx/mise:copr docker digest to 8d25608 by @renovate[bot] in [#9159](#9159) - update ghcr.io/jdx/mise:rpm docker digest to 22e52da by @renovate[bot] in [#9161](#9161) - update ghcr.io/jdx/mise:alpine docker digest to a3da97c by @renovate[bot] in [#9158](#9158) - update rust docker digest to 4a2ef38 by @renovate[bot] in [#9162](#9162) - update ubuntu:24.04 docker digest to c4a8d55 by @renovate[bot] in [#9164](#9164) - update rust crate aws-lc-rs to v1.16.3 by @renovate[bot] in [#9165](#9165) - update ubuntu docker tag to resolute-20260413 by @renovate[bot] in [#9169](#9169) - update rust crate clap to v4.6.1 by @renovate[bot] in [#9166](#9166) - update taiki-e/install-action digest to a2352fc by @renovate[bot] in [#9163](#9163) - update rust crate ctor to 0.10 by @renovate[bot] in [#9170](#9170) - update rust crate tokio to v1.52.1 by @renovate[bot] in [#9167](#9167) - update rust crate rmcp-macros to 0.17 by @renovate[bot] in [#9173](#9173) - update rust crate signal-hook to 0.4 by @renovate[bot] in [#9177](#9177) - update rust crate zipsign-api to 0.2 by @renovate[bot] in [#9180](#9180) - update rust crate toml_edit to 0.25 by @renovate[bot] in [#9179](#9179) - update rust crate strum to 0.28 by @renovate[bot] in [#9178](#9178) ### 📦 Registry - add ibmcloud by @dnwe in [#9139](#9139) - add rush by @jdx in [#9146](#9146) ### New Contributors - @80avin made their first contribution in [#9151](#9151) - @atharvasingh7007 made their first contribution in [#9124](#9124) - @lechuckcaptain made their first contribution in [#8782](#8782) - @ergofriend made their first contribution in [#9102](#9102) - @dnwe made their first contribution in [#9139](#9139) ## 📦 Aqua Registry Updates #### New Packages (3) - [`controlplaneio-fluxcd/flux-operator`](https://github.com/controlplaneio-fluxcd/flux-operator) - [`dependency-check/DependencyCheck`](https://github.com/dependency-check/DependencyCheck) - [`kiro.dev/kiro-cli`](https://github.com/kiro.dev/kiro-cli) #### Updated Packages (2) - [`jreleaser/jreleaser/standalone`](https://github.com/jreleaser/jreleaser/standalone) - [`sigstore/cosign`](https://github.com/sigstore/cosign)

jdx marked this pull request as ready for review April 16, 2026 21:22

gemini-code-assist Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread src/github.rs

greptile-apps Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread src/github.rs Outdated

jdx and others added 2 commits April 16, 2026 16:26

Update src/github.rs

735d083

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

fix(github): simplify api url token resolution

fa5005e

jdx merged commit 3ec47a1 into main Apr 16, 2026
36 checks passed

jdx deleted the fix/attestation-credential-helper branch April 16, 2026 21:51

mise-en-dev mentioned this pull request Apr 16, 2026

chore: release 2026.4.16 #9140

Merged

BrewTestBot mentioned this pull request Apr 17, 2026

mise 2026.4.16 Homebrew/homebrew-core#278070

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(github): use full token resolution chain for attestation verification#9154

fix(github): use full token resolution chain for attestation verification#9154
jdx merged 3 commits intomainfrom
fix/attestation-credential-helper

jdx commented Apr 16, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jdx commented Apr 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jdx commented Apr 16, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`