How do I ensure gh doesn't use ~/.config/gh/config.yml?

[sheldonhull]

I've explicitly disabled and blocked this directory as I didn't want it writing plain text token information again.

I setup git credential manager and set it to use this:

[credential "https://github.com"]
   provider= github
   helper = /usr/local/bin/git-credential-manager
   useHttpPath = true
   interactive= auto
   guiPrompt = false

I also exited the git daemon processes and reloaded in a new terminal and authenticated after getting the expected git credential manager prompt for web/token.

I can't get gh repo list or any other command to work when that gh/config.yml is blocked.
Is it required even if not using auth?
If so, how do I get gh to honor my credential settings and not store a plain text token?

[mislav]

You can use gh auth login --secure-storage, which is now the default behavior even if you don't pass that flag. That will still write host information to either config.yml or hosts.yml, but won't save your token there, and instead save it to Keychain on macOS, "wincred" on Windows, or Secret Service (e.g. Gnome keyring) on Linux. This will typically only work on computers with a graphical desktop environment installed.

In all other environments you can manually set the GH_TOKEN environment variable with a Personal Access token you've generated yourself. In that case, gh will only read from the environment variable and not from config.yml or hosts.yml.

[sheldonhull]

thank you! I'll try this out. I'm trying to ensure no plain text tokens anywhere on system and either vault pulled or in keychain, so i'll try this out.

[sheldonhull]

@mislav so I'm on cli version 2.29.0 and last I tried it stored a token.
There should be no token saved to that file directly in darwin right?

[mislav]

Yes, on darwin Keychain should be used. If that doesn't work, check if the security CLI tool has access to Keychain. You should have been asked by OS dialog prompt for this, but if you've answered "never" some time in the past, that could have affected it. Otherwise, open an issue please!

[zimmerman-pliant]

This will typically only work on computers with a graphical desktop environment installed.

Is there a recommended solution for headless embedded computers?