Disable telemetry for unauthenticated GHES gh api requests using absolute hostnames

[williammartin]

Description

gh api builds a specialized HTTP client to support command-specific cache and verbose behavior. This API Client was not provided with a TelemetryDisabler at construction time. It was therefore possible for gh api --hostname or gh api <absolute url> to emit telemetry unexpectedly under extremely narrow conditions:

1. User is logged into a non-GHES host (e.g. github.com or GHEC with DR), otherwise global auth check fails:

➜ GH_CONFIG_DIR=/tmp gh api --hostname ghe.example.com /
To get started with GitHub CLI, please run: gh auth login
Alternatively, populate the GH_TOKEN environment variable with a GitHub API authentication token.

2. No GHES hosts are logged into, otherwise mightBeGHESUser disables telemetry:

cli/internal/ghcmd/cmd.go

Lines 504 to 506 in 6e82bc5

	returnslices.ContainsFunc(cfg.Authentication().Hosts(), func(hoststring) bool {
	returnghauth.IsEnterprise(host)
	})

3. No enterprise-token environment variable is set, otherwise mightBeGHESUser disables telemetry:

cli/internal/ghcmd/cmd.go

Lines 495 to 497 in 6e82bc5

	ifos.Getenv("GH_ENTERPRISE_TOKEN") !=""||os.Getenv("GITHUB_ENTERPRISE_TOKEN") !="" {
	returntrue
	}

Under these circumstances, an unauthenticated request using gh api could send telemetry if sampled at a 1% chance:

➜ GH_TELEMETRY=log gh api --hostname ghe.io /
Telemetry payload:
{
"events": [
{
"type": "command_invocation",
"dimensions": {
"accessible_colors": "false",
"accessible_prompter": "false",
"agent": "",
"architecture": "arm64",
"ci": "false",
"color_labels": "false",
"command": "gh api",
"device_id": "160e44ae-38df-4bc5-9bae-0d9a126573b3",
"flags": "hostname",
"github_actions": "false",
"invocation_id": "1e13fd5a-9110-4287-817c-e8c55cd3ebf6",
"is_tty": "true",
"os": "darwin",
"spinner_disabled": "false",
"timestamp": "2026-09-03T13:55:18.399Z",
"version": "2.98.0"
}
}
]
}

How did you test this change?

Before

See above

After

➜ GH_TELEMETRY=log ./bin/gh api --hostname ghe.io /
Telemetry payload: none

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @williammartin will read and reply directly.
• An agent will draft replies and @username will read them before they are posted.
• Nobody has explicitly committed to replying.

[Copilot]

Copilot review overview

🟡 Changes recommended

The exported HTTP client injection contract must be preserved before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	pkg/​cmd/​api/​api.go — 🛑 Requirement: Preserve the exported HTTP client injection contract. Changing this field from a…

What changed in this PR

Routes telemetry suppression into gh api’s specialized HTTP client for GHES requests.

Changes:

• Propagates the telemetry disabler through command factories.
• Configures API clients to suppress GHES telemetry.
• Adds GHES and GitHub.com regression tests.

Blocking issue: 🛑 Critical (2 votes) — Preserve the exported HttpClient injection signature in ApiOptions; changing it breaks existing consumers. Capture TelemetryDisabler in the default closure or use a separate unexported factory.

File	Description
pkg/​cmdutil/​factory.go	Exposes the telemetry disabler.
pkg/​cmd/​factory/​default.go	Initializes the new factory field.
pkg/​cmd/​api/​api.go	Passes telemetry configuration into the API client.
pkg/​cmd/​api/​api_test.go	Tests hostname and absolute-URL telemetry behavior.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[babakks]

LGTM