Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by BagToad · Pull Request #13037 · cli/cli

BagToad · 2026-03-25T18:49:21Z

Description

Fixes several acceptance test failures found while running the suite locally. Each fix is in its own commit.

Fix 1: Git identity in testscript sandbox

The testscript sandbox overrides HOME, so git inside the sandbox can't find the user's global user.name/user.email. This causes "Author identity unknown" errors in any acceptance test that makes commits (e.g. extensions, PRs). The fix writes a minimal .gitconfig into the sandbox during sharedSetup.

Fix 2: Fetch `nameWithOwner` in `headRepository` GraphQL query

dd424d8 (agent-task listings) added NameWithOwner to the PRRepository struct but didn't update the headRepository GraphQL query to fetch it. Since export_pr.go dumps the raw struct, gh pr view --json headRepository started emitting "nameWithOwner":"" - breaking the pr-create-respects-simple-pushdefault acceptance test assertion.

The fix adds nameWithOwner to the GraphQL query so the field is actually populated, and updates the test assertion to expect it.

Fix 3: Remove `run-download-traversal` acceptance test

GitHub's Artifact API now rejects artifact names like .. server-side (400 Bad Request), making it impossible to create artifacts with path traversal names. The test scenario can no longer be reproduced through normal artifact creation. The client-side traversal check in gh run download remains as defense-in-depth.

Known failures not addressed

These were observed during the acceptance run but are not bugs in gh:

Test	Failure	Root cause
`TestExtensions/extension`	Search doesn't find repo after 10s sleep	GitHub search indexing latency on private repos - flaky timing
`TestRepo/repo-list-rename`	HTTP 409 during deferred cleanup	GitHub API race condition - repo operation still in progress at cleanup time. Test itself passes.
`TestRepo/repo-archive-unarchive`	HTTP 409 during deferred cleanup	Same as above. Test itself passes.
`TestRulesets/ruleset`	HTTP 403 on `gh ruleset check`	Requires GitHub Pro or public repos - plan limitation of the test org
`TestSecrets/secret-org`	Workflow assertion step fails	Secret value doesn't match in Actions runner - needs further investigation

Commits

ed97fa9 - Set git identity in testscript sandbox so acceptance tests that make commits don't fail with "Author identity unknown"
0433096 - Fetch nameWithOwner in headRepository GraphQL query to fix regression from dd424d8 that broke pr-create-respects-simple-pushdefault
9fd5f06 - Remove run-download-traversal test since GitHub's Artifact API now prevents the scenario server-side

The sandbox overrides HOME so git cannot find the user's global config, causing 'Author identity unknown' errors when acceptance test scripts make commits. Write a minimal .gitconfig with user.name and user.email into the sandbox working directory during sharedSetup. Co-Authored-By: Copilot <223556219+Copilot@users.noreply.github.com>

GitHub's Artifact API now rejects artifact names like '..' server-side with a 400 Bad Request, making it impossible to create artifacts with path traversal names. This means the scenario this test was verifying (that gh run download catches traversal names) can no longer be reproduced through normal artifact creation. The client-side traversal check in gh run download remains in place as a defense-in-depth measure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Commit dd424d8 added NameWithOwner to PRRepository for agent-task listings but didn't update the headRepository GraphQL query to fetch it. This caused gh pr view --json headRepository to emit an empty "nameWithOwner":"" field, breaking the pr-create-respects-simple- pushdefault acceptance test. Fetch nameWithOwner in the query and update the test assertion to expect it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Fixes multiple acceptance test failures by ensuring git commits work inside the testscript sandbox, correcting a GraphQL selection regression for headRepository.nameWithOwner, and removing an acceptance test scenario that can no longer be reproduced due to upstream API validation.

Changes:

Write a minimal .gitconfig into the acceptance test sandbox so git commit doesn’t fail due to missing identity.
Fetch nameWithOwner for headRepository in the PR GraphQL fragment and update the affected acceptance assertion.
Remove the obsolete run-download-traversal acceptance test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`acceptance/acceptance_test.go`	Sets up sandbox git identity via `.gitconfig` so commit-making scripts succeed.
`api/query_builder.go`	Extends `headRepository` GraphQL fragment to include `nameWithOwner`.
`acceptance/testdata/pr/pr-create-respects-simple-pushdefault.txtar`	Updates expected JSON output to include `headRepository.nameWithOwner`.
`acceptance/testdata/workflow/run-download-traversal.txtar`	Removes an acceptance test that’s no longer viable due to server-side artifact name validation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T18:52:44Z

 	"github.com/cli/cli/v2/internal/ghcmd"
 	"github.com/cli/go-internal/testscript"
+	"github.com/MakeNowJust/heredoc"
 )


Import block isn’t gofmt-sorted (third-party imports should be lexicographically ordered). As-is, the gofmt formatter (enabled in golangci-lint) will report this file; please run gofmt/goimports to normalize the import order.

Well that's just not true. Our linter seems happy.

Copilot · 2026-03-25T18:52:45Z

 		case "headRepository":
-			q = append(q, `headRepository{id,name}`)
+			q = append(q, `headRepository{id,name,nameWithOwner}`)
 		case "assignees":


This change to the headRepository fragment isn’t currently covered by api/query_builder_test.go. Since there are already unit tests asserting the generated fragments for other fields, consider adding a case that asserts IssueGraphQL([]string{"headRepository"}) (or via PullRequestGraphQL) includes nameWithOwner to prevent regressions.

Not super concerned with this personally.

williammartin

Fix 2 here looks like it breaks a lot of other tests, which are skipped by default right now:

 - pr-create-push-default-upstream-no-merge-ref-fork.txtar:50
 - pr-create-respects-push-destination.txtar:53
 - pr-create-remote-ref-with-branch-name-slash.txtar:46
 - pr-create-respects-remote-pushdefault.txtar:49
 - pr-create-guesses-remote-from-sha.txtar:48
 - pr-create-respects-user-colon-branch-syntax.txtar:47
 - pr-create-guesses-remote-from-sha-with-branch-name-slash.txtar:50
 - pr-create-respects-branch-pushremote.txtar:49

Or at least, maybe they were already broken? In any case, we should fix them.

williammartin · 2026-03-26T12:24:04Z

I fixed these failures in 971be97

williammartin

LGTM thanks

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.88.1` → `v2.89.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.89.0`](https://github.com/cli/cli/releases/tag/v2.89.0): GitHub CLI 2.89.0 [Compare Source](cli/cli@v2.88.1...v2.89.0) ####

`gh agent-task` now works on ghe.com tenancies `gh agent-task` commands previously failed with `401 Unauthorized` for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so `gh agent-task` works correctly regardless of your GitHub hosting environment. #### Experimental new prompter A new TUI-based prompter powered by [charmbracelet/huh](https://github.com/charmbracelet/huh) is available behind the `GH_EXPERIMENTAL_PROMPTER` environment variable. This is an early preview — try it out and share feedback! ``` export GH_EXPERIMENTAL_PROMPTER=1 ``` #### `gh issue create` and `gh issue transfer` no longer require extra token scopes `gh issue create` and `gh issue transfer` previously fetched repository fields they didn't need, which could require additional token scopes. These commands now fetch only the minimal fields necessary for issue operations. #### What's Changed ##### ✨ Features - `gh pr create`, `gh issue create`, `gh issue edit`: search-based assignee selection and login-based mutation on github.com by [@BagToad](https://github.com/BagToad) in [#13009](cli/cli#13009) - Add experimental huh-only prompter gated by `GH_EXPERIMENTAL_PROMPTER` by [@BagToad](https://github.com/BagToad) in [#12859](cli/cli#12859) ##### 🐛 Fixes - fix(agent-task): resolve Copilot API URL dynamically for ghe.com tenancies by [@BagToad](https://github.com/BagToad) in [#12956](cli/cli#12956) - fix(issue): avoid fetching unnecessary fields in `issue create` and `issue transfer` by [@babakks](https://github.com/babakks) in [#12884](cli/cli#12884) - fix: resolve data race in codespaces port forwarder by [@Lslightly](https://github.com/Lslightly) in [#13033](cli/cli#13033) ##### 📚 Docs & Chores - Record agentic invocations in User-Agent header by [@williammartin](https://github.com/williammartin) in [#13023](cli/cli#13023) - docs: clarify that `gh pr edit --add-reviewer` can re-request reviews by [@joshjohanning](https://github.com/joshjohanning) in [#13021](cli/cli#13021) - Add AGENTS.md by [@williammartin](https://github.com/williammartin) in [#13024](cli/cli#13024) - Fix typo: remove extra space in README.md link by [@realMelTuc](https://github.com/realMelTuc) in [#12725](cli/cli#12725) - Align triage.md with current triage process by [@tidy-dev](https://github.com/tidy-dev) in [#13030](cli/cli#13030) - Remove auto-labels from issue templates by [@tidy-dev](https://github.com/tidy-dev) in [#12972](cli/cli#12972) - Consolidate actor-mode signals into `ApiActorsSupported` by [@BagToad](https://github.com/BagToad) in [#13025](cli/cli#13025) - Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by [@BagToad](https://github.com/BagToad) in [#13037](cli/cli#13037) #####

Dependencies - chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#12963](cli/cli#12963) - chore(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#12962](cli/cli#12962) - chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#13031](cli/cli#13031) - chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13005](cli/cli#13005) - chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#13004](cli/cli#13004) - chore(deps): bump azure/login from 2.3.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12951](cli/cli#12951) #### New Contributors - [@joshjohanning](https://github.com/joshjohanning) made their first contribution in [#13021](cli/cli#13021) - [@realMelTuc](https://github.com/realMelTuc) made their first contribution in [#12725](cli/cli#12725) - [@Lslightly](https://github.com/Lslightly) made their first contribution in [#13033](cli/cli#13033) **Full Changelog**: [v2.88.1...v2.89.0](cli/cli@v2.88.1...v2.89.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

BagToad and others added 3 commits March 25, 2026 12:47

BagToad requested a review from a team as a code owner March 25, 2026 18:49

BagToad requested review from Copilot and williammartin March 25, 2026 18:49

Copilot started reviewing on behalf of BagToad March 25, 2026 18:49 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

williammartin requested changes Mar 26, 2026

View reviewed changes

Add nameWithOwner to necessary tests

971be97

williammartin approved these changes Mar 26, 2026

View reviewed changes

williammartin enabled auto-merge March 26, 2026 12:32

williammartin merged commit 39407e6 into trunk Mar 26, 2026
11 checks passed

williammartin deleted the kw/acceptance-test-git-config branch March 26, 2026 12:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test#13037

Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test#13037
williammartin merged 4 commits intotrunkfrom
kw/acceptance-test-git-config

BagToad commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

BagToad Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

BagToad Mar 25, 2026

Uh oh!

williammartin left a comment •

edited

Loading

Uh oh!

williammartin commented Mar 26, 2026

Uh oh!

williammartin left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

BagToad commented Mar 25, 2026

Description

Fix 1: Git identity in testscript sandbox

Fix 2: Fetch nameWithOwner in headRepository GraphQL query

Fix 3: Remove run-download-traversal acceptance test

Known failures not addressed

Commits

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

BagToad Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

BagToad Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

williammartin left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

williammartin commented Mar 26, 2026

Uh oh!

williammartin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix 2: Fetch `nameWithOwner` in `headRepository` GraphQL query

Fix 3: Remove `run-download-traversal` acceptance test

williammartin left a comment •

edited

Loading