gh

Installs the GitHub CLI (gh).

devtools:
  - name: gh

The version field is not used by this recipe.

What it does

On Debian and Ubuntu it declares GitHub’s official apt repository and signing key, then installs the gh package through the normal repository and package phases. On Alpine it installs the distribution’s github-cli package.

Authenticating it

Installing gh leaves it unauthenticated. Pair it with the gh toolconfig, which writes an authenticated login from a Secret — without setting GH_TOKEN, so gh auth login/logout/switch keep working inside the workstation.

Example

An opt-in add-on layer that installs gh and authenticates it from your own token Secret:

apiVersion: workstations.ringleader.dev/v1
kind: WorkstationConfig
metadata:
  name: gh-cli
  namespace: local
spec:
  selector:
    matchLabels:
      owner: ada
  priority: 200
  devtools:
    - name: gh
  toolconfigs:
    - id: gh
      name: gh
      config:
        token: "${secret:gh-token/token}"

Create the Secret first — with an unresolved reference the workstation fails loudly rather than writing a placeholder:

rl secret create gh-token -n local --from-string token=<your-token>

Notes

• A fine-grained token that is read-only for repository contents is enough for gh pr, gh run, and gh api. Pushes can still ride SSH: the toolconfig’s gitProtocol defaults to ssh.
• Alternatively, authenticate interactively with gh auth login and pair with passthrough-www-browser so the device-code URL opens on your laptop.