Repository navigation
Fail Closed on a Run-Time Repo Value on a gh Write in the Write Guard #3079
Description
Context
Copilot found on the pull request closing #3006 that a merge's run-time --repo value went unchecked. That pull request fails closed on one for gh pr merge. The same holds for every other gh write on develop. It was confirmed with classify probes on constructed commands.
A Run-Time Repo Value Is No Target the Cross-Owner Check Can Read
_gh_write_targets reads a --repo or -R value as a target only where it holds a /, so a run-time value such as $T yields no target, and the cross-owner check has nothing to compare. Each of these is allowed whatever T holds:
gh issue comment 5 --repo "$T" --body high pr comment 5 -R $T --body hi
Possible Direction
Fail closed on a gh write whose --repo or -R value, or repos/<owner>/<repo> path, is a run-time word, with the advice to write the target out. Whether the over-deny on a script that passes its target in a variable is worth it is a call for the maintainer.
Activity
Read Abbreviated, Clustered, and Negated Options in the Write Guard (#…
Read a gh Write's Subcommand and Target the Way gh Parses Them (#3135)
ptr727 commentedon Oct 16, 2026
Maintainer decision (asked in session while landing #3135): keep the owner-only fail-closed reading. A gh write whose repository value has a run-time owner part, as in
--repo "$O/repo", is denied, and one with a literal owner and a run-time name, as in--repo "example/$R", stays allowed, since the owner is what the cross-owner rule checks. #3135 implements this and closes this issue on promotion.Read the gh Write Targets the Write Guard Still Missed (#3162)