Diffinery

codician/diffinerypublic

Open-source, agent-first GitHub and GitHub Actions alternative that runs on your own Cloudflare account: git hosting, pull requests, code review and drop-in GitHub Actions YAML on Workers, Durable Objects, R2 and Containers.

gh issue commands over GraphQL, and gh inside workflows with the job token #324

Mergedtest-botagenton behalf of cnbrkdmrcimerged into main from claude/graphql-issues
test-botagenton behalf of cnbrkdmrciopened Author

Requested by Can · project thread

What this changes

Two reports on the GitHub mirror (codician-team/diffinery#4 and #5) found that gh issue … failed against Diffinery and that gh inside a workflow couldn't use GraphQL at all. This fixes both.

  • Issues over GraphQL. repository.issue, issues (states, labels, orderBy, filterBy with assignee, createdBy, mentioned, milestone, since), issueOrPullRequest, Issue nodes, and issue search through search(type: ISSUE | ISSUE_ADVANCED). Mutations: createIssue, updateIssue, closeIssue (with state reason), reopenIssue; addComment, labels and assignees now accept issues too.
  • Search now parses GitHub's query syntax for issues and pull requests: is:, state:, author:, assignee:, mentions:, label:, milestone:, no:, head:, base:, review-requested:, draft:, sort:, parentheses and OR, and free-text words.
  • Job tokens on GraphQL. A workflow's GITHUB_TOKEN can call /api/graphql, and each field checks the same permissions: grant REST uses (issues, pull-requests, contents, metadata). Writes need the matching write scope. Public repositories skip the read check, as on REST.
  • /api/v3/meta reports installed_version: 3.20.0, which gh uses for feature detection. Without it gh issue list --label, --search and gh workflow run fail with "malformed version".
  • pullRequests is no longer capped at 100 items.
  • Docs: the gh CLI page (issue commands, a "gh in workflows" section), the GraphQL reference, Actions compatibility and the migration guide.

How it was tested

  • test/e2e/graphql.test.mjs adds two tests and passes 8/8 locally. The first runs the gh issue query shapes end to end. The second runs a workflow job token with issues: read and checks that the repository and issues are allowed, while pull requests and createIssue are refused with the missing scope named.
  • Real gh 2.89 ran against a local server over HTTPS: issue create (label, assignee), list, view, view --comments, comment, edit, close --reason "not planned", reopen, status, list --label, --search, --assignee @me, --author, --json, repo view and label create.
  • Typecheck is clean and the unit tests pass (1128).

Checklist

  • Docs updated
  • No workflow files changed

🤖 Generated with Claude Code

https://claude.ai/code/session_015ALxdbMU5hpZXjGpL2jhC4

Intentwhat this change is meant to do

Make gh issue list/view/create/comment/edit/close/reopen/status/search work against Diffinery, and let workflow GITHUB_TOKENs use GraphQL with their REST permissions, as reported on GitHub #4 and #5.

test-bot merged commit 04dacaa into main
Pull request successfully merged and closed
test-bot merged 04dacaa into main
Sign in to join the conversation.