Kc Ship PR

Ship a PR from a kube-coder workspace

The only GitHub credential here is the App installation token (/home/dev/.credentials/.github-token, ghs_…). The token-refresh sidecar installs a self-refreshing global credential.helper that reads that file fresh on every call, so ordinary git push works — no Git Data API dance needed. gh api also works (it reads GITHUB_TOKEN from ~/.github-env).

There is no user-level gh auth login and no SSH key here, so do not suggest gh auth login or a fork — the App token pushes to origin directly.

If git push is wedged — remote: Invalid username or token or could not read Username — something is shadowing that helper with a point-in-time token. The token file itself is almost never the problem (curl -H "Authorization: token $(cat /home/dev/.credentials/.github-token)" https://api.github.com/user proves it in one line). Diagnose in this order:

git config --show-origin --get-all credential.helper
git config --show-origin --get-all credential.https://github.com.helper
printf 'protocol=https\nhost=github.com\n\n' | git credential fill  # vs. the token file
grep github.com ~/.git-credentials

Three known causes, all "a token frozen an hour ago":

1. A stale baked http.<host>.extraheader in .git/config — git sends it verbatim and it shadows the helper: git config --unset-all http.https://github.com/.extraheader.
2. A host-scoped helper chain reset (issue #454) — gh auth setup-git writes an empty helper = under [credential "https://github.com"], which clears the chain and drops the self-refreshing reader; gh auth git-credential then answers with the stale GH_TOKEN your long-lived shell captured before the last rotation. The workspace re-asserts that section every 50 min, so this self-heals — to fix it now, run python3 /github-app/github-app-token.py --configure-git (or --once, which also asks the github-app-token sidecar for a fresh token; the private key lives only in that sidecar since #558, so nothing in your shell can mint one).
3. A stale github.com line in ~/.git-credentials (persistent on the PVC, so a captured ghs_… outlives its 1-hour validity). The daemon purges these in app mode; delete by hand if you're ahead of it.

One-shot escape hatch that bypasses all three:

git -c credential.helper= \
    -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$(cat /home/dev/.credentials/.github-token)"; }; f' \
    push -u origin <branch>

Only if push is still broken after that, fall back to the Git Data API (§3b). See your github-auth memory for the full background.

Steps

Given the working tree already has the changes staged/committed on a feature branch (create one first if the user is on main):

1. Commit locally

cd /home/dev/kube-coder   # or your worktree
git add -A            # or specific paths
git commit -m "<type>(<scope>): <summary>

<body>

Co-Authored-By: Claude <noreply@anthropic.com>"

2. Re-sync onto current origin/main (avoid a stale base)

git fetch origin main && git rebase origin/main

If the credential helper is somehow unavailable, the repo is public so an unauthenticated fetch also works: git -c credential.helper= -c http.https://github.com/.extraheader= fetch https://github.com/imran31415/kube-coder.git main

3. Push the branch

git push -u origin <branch>