Fix 477 fine grained pat attachments - #478
Conversation
…alez#477) Fine-grained personal access tokens cannot download attachments from private repositories directly due to a GitHub platform limitation. This adds a workaround for image attachments (/assets/ URLs) using GitHub's Markdown API to convert URLs to JWT-signed URLs that can be downloaded without authentication. Changes: - Add get_jwt_signed_url_via_markdown_api() function - Detect fine-grained token + private repo + /assets/ URL upfront - Use JWT workaround for those cases, mark success with jwt_workaround flag - Skip download with skipped_at when workaround fails - Add startup warning when using --attachments with fine-grained tokens - Document limitation in README (file attachments still fail) - Add 6 unit tests for JWT workaround logic
Uses the real parse_args() function to get CLI defaults, so when new arguments are added they're automatically available to all tests. Changes: - Add tests/conftest.py with create_args fixture - Update 8 test files to use shared fixture - Remove duplicate _create_mock_args methods - Remove redundant @pytest.fixture mock_args definitions This eliminates the need to update multiple test files when adding new CLI arguments.
Uh oh!
There was an error while loading. Please reload this page.
lukasbestle
commented
Jan 14, 2026
@Iamrodos Thanks for the fix. Sorry I only saw it after it was merged, GitHub didn't send me a notification for the PR. I just tested it and ran into two issues:
|
Iamrodos
commented
Jan 14, 2026
Well that does complicate things a bit. I like your ideas on detecting the token type, I will do some research in the codebase. Yes, if you can find more details about 404s that you are not expecting that would be great. Rather than a new issue, should #477 be reopened? I am not familiar with the convention in such circumstances. That would be my preference. |
Iamrodos
commented
Jan 19, 2026
@lukasbestle did you find out any more on the 404s you are getting? I would like to figure that out incase it has any impact on the token type work. |
lukasbestle
commented
Jan 19, 2026
OK, I think I have found the culprit: If I understand this PR correctly, it only seems to convert URLs of the type Would it be possible to pass these through the Markdown API as well? I can test if that fixes the retrieval in org repos if you ping me in your PR. |
Closes#477
First commit.
Fine-grained personal access tokens cannot download attachments from private repositories due to a GitHub limitation. Add a workaround for image attachments using GitHub's Markdown API to convert URLs to JWT-signed URLs.
Second commit.
Refactor test fixtures to use shared create_args helper (uses real parse_args() so new CLI args are automatically available to all tests). This makes the tests more robust to CLI changes. Changing the CLI should no longer require modifying existing tests.