GitHub CLI operations
v0.1.16GitHub introspection — PRs, issues, repos, workflow runs, releases, commit checks, search — plus operator actions: merge PR, close PR, rerun workflow, dispatch workflow. Authenticates via the runner host's `gh auth status` token (i.e. ~/.config/gh).
gh
Install
emisar pack install
fetches this pack, re-validates it, and verifies its content hash against the
--hash
below — the exact bytes this page was rendered against, so a tampered copy is
rejected — before copying it into the runner's packs dir. The command reloads a
running daemon itself; no manual restart.
sudo emisar pack install github-cli --hash sha256:a0990116f71b6814f54aa3b1136858c25d3be2e2f82c30323921d6bf58ff375a
Setup
Actions shell out to gh on the runner host. gh authenticates with
GH_TOKEN
(or
GITHUB_TOKEN
) if set, otherwise with the token stored by
gh auth login
. Provide one of those so gh is signed in.
Environment
Set these on the runner host, then add each name to
execution.inherit_env
so the value reaches the action.
-
GH_TOKENGitHub token gh uses to authenticate. Omit if the runner host is already signed in via
gh auth login.
Notes
-
Create a classic token with the repo scope preselected
. Classic tokens have no read-only repo scope, so
repois the floor for reading private repositories and is whatrepo_clone_countneeds (GitHub's traffic API requires push access); a fine-grained token limited to chosen repositories, with read-only Contents, Pull requests, and Actions, is narrower when you enable only the reads. -
Token-free alternative: run
gh auth loginas the runner's user once; the credential is stored in~/.config/gh/hosts.ymland read from disk, so it needs noinherit_enventry. - The token needs repo read scope for the introspection actions; the mutators (pr_merge, pr_close, workflow_rerun, workflow_dispatch) and repo_clone_count need write/push access to the target repo.
Verify it works
Runs gh.auth_status, a low-risk
read that confirms the pack can reach its target. Run it on the host once the pack
is installed; pack install runs it for
you.
sudo emisar pack verify github-cli
Install and configure a pack walks through the whole sequence on a host.
Actions 19 total
View on GitHub-
gh.auth_status exec low Low — read-only or trivially reversible
gh auth status
Show which GitHub account the runner's `gh` is signed in as + token scopes.
View source on GitHub -
gh.branch_list exec low Low — read-only or trivially reversible
gh api repos/<repo>/branches
List branches in the repo (paginated, up to 100).
View source on GitHub -
gh.issue_list exec low Low — read-only or trivially reversible
gh issue list
List open issues for one repo.
View source on GitHub -
gh.issue_view exec low Low — read-only or trivially reversible
gh issue view
Show details + comments for one issue.
View source on GitHub -
gh.pr_checks exec low Low — read-only or trivially reversible
gh pr checks
List all CI checks for one PR + pass/fail status.
View source on GitHub -
gh.pr_close exec medium Medium — changes state, easily reversible
gh pr close <num>
Close one PR without merging. Use for stale or abandoned PRs. Reopenable via the UI or `gh pr reopen`.
View source on GitHub -
gh.pr_list exec low Low — read-only or trivially reversible
gh pr list
List open PRs for one repo.
View source on GitHub -
gh.pr_merge exec high High — service-affecting
gh pr merge <num> --<method>
Merge an open PR. Squash, merge-commit, or rebase. Branch protection rules still apply — required checks/approvals must be satisfied or the merge is rejected. Use --auto in the GH UI for "merge when ready" instead; this action commits NOW.
View source on GitHub -
gh.pr_view exec low Low — read-only or trivially reversible
gh pr view
Show details for one PR — title, body, status, reviews, checks.
View source on GitHub -
gh.release_list exec low Low — read-only or trivially reversible
gh release list
List recent releases.
View source on GitHub -
gh.repo_clone_count exec low Low — read-only or trivially reversible
gh api repos/<repo>/traffic/clones
Show last-14-day clone counts (requires push access on the repo).
View source on GitHub -
gh.repo_view exec low Low — read-only or trivially reversible
gh repo view
Show repo summary — description, stars, default branch, latest release.
View source on GitHub -
gh.search_prs exec low Low — read-only or trivially reversible
gh search prs
Search PRs across all of GitHub by query.
View source on GitHub -
gh.workflow_dispatch exec high High — service-affecting
gh workflow run <workflow>
Trigger a workflow that supports workflow_dispatch. Pass ref + JSON inputs. Used for ad-hoc deploys, scripted rollbacks, or manual release flows.
View source on GitHub -
gh.workflow_list exec low Low — read-only or trivially reversible
gh workflow list
List all workflows defined in one repo.
View source on GitHub -
gh.workflow_rerun exec medium Medium — changes state, easily reversible
gh run rerun <run-id>
Re-run one workflow run. Useful after fixing a transient infrastructure issue. With --failed, only re-runs failed jobs.
View source on GitHub -
gh.workflow_run_list exec low Low — read-only or trivially reversible
gh run list
List recent workflow runs across the repo.
View source on GitHub -
gh.workflow_run_logs exec medium Medium — changes state, easily reversible
gh run view --log-failed
Show logs from failed jobs in one run. Use for "why did CI break?".
View source on GitHub -
gh.workflow_run_view exec low Low — read-only or trivially reversible
gh run view
Show job-by-job result for one workflow run.
View source on GitHub