docs: document ghtkn GitHub token setup by jdx · Pull Request #9546 · jdx/mise

jdx · 2026-05-02T15:22:22Z

Summary

document using ghtkn as a GitHub credential_command
show mise which ghtkn for mise-managed installs so the stored command calls the real executable path
warn against invoking mise x or mise exec from the credential command to avoid token-resolution loops

Validation

markdownlint docs/dev-tools/github-tokens.md
mise run docs:build was attempted, but fails before this page builds with Package subpath './decode' is not defined by "exports" from the entities package.

This PR description was generated by an AI coding assistant.

Note

Low Risk
Documentation-only change describing how to use ghtkn with credential_command; no runtime or security-sensitive code paths are modified.

Overview
Adds a new “Using ghtkn” section to the GitHub token docs explaining how to generate short-lived GitHub App user tokens via ghtkn for settings.github.credential_command.

Includes guidance for mise-managed installs to call the real ghtkn binary via mise which, warns against invoking mise x/mise exec in the credential command to avoid recursion, and suggests verifying resolution with mise token github.

^{Reviewed by Cursor Bugbot for commit 056656f. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-05-02T15:24:01Z

Greptile Summary

This PR adds a ### Using ghtkn subsection under the existing ## Credential Command section, documenting how to configure ghtkn as a credential_command source for short-lived GitHub App tokens. No runtime code is changed.

Confidence Score: 5/5

Documentation-only change; safe to merge.

No runtime code is modified. The new prose is technically accurate and consistent with the surrounding credential_command documentation. Previously raised concerns (stale versioned path, missing $1 handling) are already captured in existing review threads.

No files require special attention.

Important Files Changed

Filename	Overview
docs/dev-tools/github-tokens.md	Adds 27-line documentation subsection covering ghtkn setup, the `mise which ghtkn` shim-bypass pattern, the loop-prevention warning, and a validation step; no code changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[mise needs GitHub token] --> B{credential_command set?}
    B -- No --> C[Check github_tokens.toml / gh CLI / git credentials]
    B -- Yes --> D[sh -c credential_command with hostname as $1]
    D --> E{ghtkn shim on PATH?}
    E -- "No (direct install or mise which path)" --> F[ghtkn get -m 1h]
    E -- "Yes (mise shim)" --> G[⚠️ Shims stripped from PATH\nshim would not be found]
    F --> H[Token returned to mise]
    G --> I[Use 'mise which ghtkn' to get real path\nand store it in credential_command]
    I --> F
    H --> J[Cache result per host per session]

_{Reviews (2): Last reviewed commit: "docs: document ghtkn GitHub token setup" | Re-trigger Greptile}

gemini-code-assist

Code Review

This pull request adds a new section to the documentation for using ghtkn as a credential command in mise. It provides instructions on how to configure the credential_command to avoid recursive mise invocations by using the absolute path of the executable. A review comment suggests wrapping the executable path in single quotes in the example command to prevent execution failures when the path contains spaces.

gemini-code-assist · 2026-05-02T15:27:15Z

+mise settings set github.credential_command "$(mise which ghtkn) get -m 1h"
+```


If the path returned by mise which ghtkn contains spaces (which is common on Windows or certain macOS home directory setups), the resulting credential_command will fail when executed via sh -c. It is safer to wrap the executable path in single quotes within the command string.

Suggested change

mise settings set github.credential_command "$(mise which ghtkn) get -m 1h"

```

GHTKN="$(mise which ghtkn)"

mise settings set github.credential_command "'$GHTKN' get -m 1h"

github-actions · 2026-05-02T15:44:58Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.28 x -- echo`	22.0 ± 0.4	21.3	24.6	1.00
`mise x -- echo`	22.2 ± 0.4	21.5	27.7	1.01 ± 0.02

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.28 env`	21.5 ± 0.6	20.4	26.6	1.00
`mise env`	21.7 ± 0.4	21.0	27.3	1.01 ± 0.03

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.28 hook-env`	22.0 ± 0.3	21.2	23.2	1.00
`mise hook-env`	22.4 ± 0.5	21.6	28.9	1.02 ± 0.02

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.28 ls`	19.3 ± 0.3	18.6	20.9	1.00
`mise ls`	20.1 ± 0.4	19.2	21.9	1.04 ± 0.03

`xtasks/test/perf`

Command	mise-2026.4.28	mise	Variance
install (cached)	149ms	156ms	-4%
ls (cached)	76ms	77ms	-1%
bin-paths (cached)	81ms	82ms	-1%
task-ls (cached)	837ms	801ms	+4%

@jdx

### 🚀 Features - **(conda)** graduate conda backend out of experimental by @jdx in [#9544](#9544) - **(deps)** Add dart and flutter providers by @tjarvstrand in [#9505](#9505) - **(registry)** add neo4j by @mnm364 in [#9525](#9525) - **(registry)** add rustfs by @mnm364 in [#9530](#9530) - **(task)** support exclusion patterns in task sources by @jlarmstrongiv in [#9496](#9496) - **(vfox)** add stat function to lua file module by @esteve in [#9497](#9497) ### 🐛 Bug Fixes - **(backend)** flag regex prerelease versions by @jdx in [#9500](#9500) - **(backend)** mark -nightly/-canary/-experimental as prereleases by @jdx in [#9523](#9523) - **(backend)** suppress no-versions warning for unresolved-latest backends by @jdx in [#9548](#9548) - **(backend)** include dotnet prereleases from package flags by @jdx in [#9551](#9551) - **(backend)** scope PEP 440 prerelease detection to Python backends by @jdx in [#9558](#9558) - **(cargo)** Apply install_env during cargo install by @c22 in [#9502](#9502) - **(copr)** drop epel-9 chroots since rust >= 1.91 is unavailable by @jdx in [#9484](#9484) - **(github)** skip attestations on non-default api_url by @jdx in [#9486](#9486) - **(github)** retry ip allow list errors without auth by @risu729 in [#9506](#9506) - **(http)** update versions host tracking endpoint by @jdx in [#9527](#9527) - **(install)** don't warn for configured tools when version is passed via CLI by @jdx in [#9522](#9522) - **(install)** refresh latest before installing missing tools by @jdx in [#9545](#9545) - **(install)** don't cache nonexistent install paths by @jdx in [#9553](#9553) - **(lockfile)** don't propagate ad-hoc CLI overrides into the project lockfile by @jdx in [#9562](#9562) - **(plugin)** detect plugin types after cloning by @risu729 in [#9540](#9540) - **(release)** pass --no-git-checks to aube publish by @jdx in [#9483](#9483) - **(task)** convert PATH to MSYS Unix form when spawning POSIX shells on Windows by @JamBalaya56562 in [#9547](#9547) ### 📚 Documentation - **(contributing)** require popularity check for registry PRs by @jdx in [7bbeebe](7bbeebe) - **(watch)** update pitchfork domain to en.dev by @risu729 in [#9536](#9536) - document ghtkn GitHub token setup by @jdx in [#9546](#9546) - clarify registry backend acceptance policy by @jdx in [#9543](#9543) - Change exec command to use bash for variable echo by @kuboon in [#9567](#9567) ### 🧪 Testing - **(e2e)** run test-tool targets in parallel by @jdx in [#9564](#9564) - **(e2e)** run tests in parallel by @jdx in [#9563](#9563) - **(e2e)** bind-mount /tmp on disk and surface failed tests in CI summary by @jdx in [#9570](#9570) - **(tasks)** migrate test_task_help atask to usage field by @jdx in [#9549](#9549) ### 📦️ Dependency Updates - update fedora:45 docker digest to 8b838b3 by @renovate[bot] in [#9507](#9507) - update ghcr.io/jdx/mise:deb docker digest to f02194c by @renovate[bot] in [#9509](#9509) - update taiki-e/install-action digest to 7769b73 by @renovate[bot] in [#9512](#9512) - update ghcr.io/jdx/mise:alpine docker digest to 581f8a8 by @renovate[bot] in [#9508](#9508) - update rust crate ctor to v0.10.1 by @renovate[bot] in [#9515](#9515) - update ghcr.io/jdx/mise:rpm docker digest to a5c9655 by @renovate[bot] in [#9510](#9510) - update rust docker digest to a9cfb75 by @renovate[bot] in [#9511](#9511) - update rust crate age to v0.11.3 by @renovate[bot] in [#9514](#9514) - update rust crate jiff to v0.2.24 by @renovate[bot] in [#9516](#9516) - update dependency vitepress-plugin-tabs to ^0.9.0 by @renovate[bot] in [#9518](#9518) - update autofix-ci/action action to v1.3.4 by @renovate[bot] in [#9513](#9513) - update rust crate usage-lib to v3.2.1 by @renovate[bot] in [#9517](#9517) - update apple-actions/import-codesign-certs action to v7 by @renovate[bot] in [#9519](#9519) - update taiki-e/install-action digest to 51cd0b8 by @renovate[bot] in [#9531](#9531) - exclude taiki-e/install-action from renovate by @jdx in [#9532](#9532) - update rust crate blake3 to v1.8.5 by @renovate[bot] in [#9533](#9533) ### 📦 Registry - enable shellcheck on windows by @zeitlinger in [#9487](#9487) - add google-java-format by @zeitlinger in [#9488](#9488) - add expert ([aqua:expert-lsp/expert](https://github.com/expert-lsp/expert)) by @AlternateRT in [#9498](#9498) - update entry for checkmake by @eread in [#9504](#9504) - add systemctl-tui ([aqua:rgwood/systemctl-tui](https://github.com/rgwood/systemctl-tui)) by @2xdevv in [#9521](#9521) - add codon by @3w36zj6 in [#9538](#9538) - add tool yr (backend:github:VirusTotal/yara-x) by @adam-moss in [#9542](#9542) - add tool betterleaks (backend:aqua/betterleaks/betterleaks) by @adam-moss in [#9541](#9541) - add `git-filter-repo` by @garysassano in [#9550](#9550) - add umoci ([aqua:opencontainers/umoci](https://github.com/opencontainers/umoci)) by @2xdevv in [#9555](#9555) - add aqua backend for elixir-ls by @AlternateRT in [#9557](#9557) - deny inline backend options by @risu729 in [#9565](#9565) ### Chore - **(ci)** fail registry tests without summary by @jdx in [#9559](#9559) - **(ci)** use !cancelled() instead of always() for test-ci aggregator by @jdx in [#9569](#9569) - **(ci)** use namespace runners for ci jobs by @jdx in [#9561](#9561) - **(config)** deprecate shorthands_file setting by @risu729 in [#9534](#9534) - **(docs)** remove shrill.en.dev analytics script by @jdx in [#9539](#9539) - **(release)** replace bc with awk in release-plz star formatting by @jdx in [d7f177f](d7f177f) - bump hk to 1.44.3 by @jdx in [#9493](#9493) - invert CLAUDE.md/AGENTS.md so AGENTS.md is canonical by @jdx in [#9560](#9560) - set dev profile debug to 1 by @jdx in [#9572](#9572) ### New Contributors - @kuboon made their first contribution in [#9567](#9567) - @AlternateRT made their first contribution in [#9557](#9557) - @2xdevv made their first contribution in [#9555](#9555) - @adam-moss made their first contribution in [#9541](#9541) - @jlarmstrongiv made their first contribution in [#9496](#9496) - @tjarvstrand made their first contribution in [#9505](#9505)

greptile-apps Bot reviewed May 2, 2026

View reviewed changes

Comment thread docs/dev-tools/github-tokens.md Outdated

Comment thread docs/dev-tools/github-tokens.md

docs: document ghtkn GitHub token setup

056656f

jdx force-pushed the codex/document-ghtkn-github-token branch from 6c24c29 to 056656f Compare May 2, 2026 15:24

gemini-code-assist Bot reviewed May 2, 2026

View reviewed changes

jdx enabled auto-merge (squash) May 2, 2026 15:33

jdx merged commit c40786f into main May 2, 2026
37 checks passed

jdx deleted the codex/document-ghtkn-github-token branch May 2, 2026 15:43

mise-en-dev mentioned this pull request May 2, 2026

chore: release 2026.5.0 #9485

Merged

BrewTestBot mentioned this pull request May 3, 2026

mise 2026.5.0 Homebrew/homebrew-core#280712

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: document ghtkn GitHub token setup#9546

docs: document ghtkn GitHub token setup#9546
jdx merged 1 commit intomainfrom
codex/document-ghtkn-github-token

jdx commented May 2, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented May 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		mise settings set github.credential_command "$(mise which ghtkn) get -m 1h"
		```

-mise settings set github.credential_command "$(mise which ghtkn) get -m 1h"
-```
+GHTKN="$(mise which ghtkn)"
+mise settings set github.credential_command "'$GHTKN' get -m 1h"

Uh oh!

Conversation

jdx commented May 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

greptile-apps Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented May 2, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented May 2, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`