GitHub
Use the gh CLI to read pull requests, Actions runs, releases and issues through an allowlist of read commands.
What it covers
GitHub supplies code and release context: merged pull requests, Actions runs, releases and issues. A merge or a failed run is a correlation point until other evidence shows how it caused a symptom.
Connect
A GitHub account usually serves every environment, so one shared connection is enough:
reckon connect github --org acme --provider githubFill in ~/.reckon/orgs/acme/secrets/github.env with a fine-grained token that
can read contents, pull requests, issues and Actions:
GH_TOKEN=replace_meGITHUB_TOKEN works instead of GH_TOKEN. Set GH_HOST for GitHub
Enterprise. Instead of the file, you can run reckon login github in your own
terminal: it runs gh auth login --insecure-storage, which keeps the token in
that connection's private config instead of the OS keychain.
reckon verify github runs gh api user and reports the login; pin it with
reckon connect github --account <login>.
Read-only contract
gh has no read-only mode, so Reckon allows only these commands:
pr list|view|diff|checks|status, run list|view, workflow list|view,
release list|view, issue list|view|status, repo view|list, search,
and label list. auth status is left out because it can print the saved
token; reckon verify checks the login for you. It also refuses --web, -w and
--hostname.
A token without write scopes is the server-side barrier.
Key commands
The org folder is not a Git checkout, so pass --repo every time:
reckon run github -- pr list --repo <owner/repo> --search "merged:>=<date>" --json number,title,mergedAt,author,url
reckon run github -- pr view <number> --repo <owner/repo> --json title,body,files,mergedAt
reckon run github -- run list --repo <owner/repo> --workflow <workflow> --json databaseId,headSha,status,conclusion,createdAt,url
reckon run github -- release list --repo <owner/repo> --limit 10 --json tagName,publishedAt,name
reckon run github -- issue list --repo <owner/repo> --state open --json number,title,labels,updatedAt