Use API SSH URLs for repository clones

[williammartin]

Fixes#14344

Description

gh repo clone reconstructs SSH remote URLs from the repository host, owner, and name. That drops the organization routing username GitHub includes when an organization has a usable SSH certificate authority, causing certificate authentication to fail on GHE.com.

This change requests the repository's authoritative sshUrl and uses it for SSH clones, SSH wiki clones, and fork upstream remotes. HTTPS cloning continues to use the existing URL formatter.

How did you test this change?

I configured an organization-scoped SSH certificate authority on test-prodweu01.ghe.com and ran the same clone command against williammartin-ssh-testing/ssh-test with the installed gh and a binary built from this branch. The installed version failed public-key authentication; the changed version cloned successfully.

Before

After

Key points

The API owns SSH routing semantics, so this does not try to reconstruct organization-specific usernames in the client. It returns an explicit error if an SSH clone response unexpectedly omits sshUrl. No feature detection is needed because Repository.sshUrl is supported across the GitHub products supported by gh.

Notes for reviewers

Start with remoteURL in pkg/cmd/repo/clone/clone.go, then review the GitHubRepo fragment and regression cases. Issue #14344 contains the original GHE.com failure.

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @williammartin will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted.
• Nobody has explicitly committed to replying.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the reported failure and comprehensively tests affected clone paths.

Review tier: Balanced
Findings: None

What changed in this PR

Uses API-provided SSH URLs so repository clones preserve organization-specific SSH routing.

Changes:

• Uses sshUrl for SSH clones, wikis, and fork upstreams.
• Adds missing-URL validation and regression coverage.

File	Description
pkg/​cmd/​repo/​clone/​clone.go	Selects authoritative SSH URLs.
pkg/​cmd/​repo/​clone/​clone_test.go	Tests SSH CA, wiki, upstream, and error cases.
api/​queries_repo.go	Requests sshUrl.
api/​queries_repo_test.go	Verifies SSH URL decoding.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MartinodF]

Tested it on our tenant, works perfectly 🙏

[BagToad]

LGTM