fix: send gh token only for correct hostname

cmd/root.go

@@ -438,7 +438,7 @@ func newRunCommand(ctx context.Context, input *Input) func(*cobra.Command, []str
 		if _, hasGitHubToken := secrets["GITHUB_TOKEN"]; !hasGitHubToken {
 			ctx, cancel := common.EarlyCancelContext(ctx)
 			defer cancel()
-			secrets["GITHUB_TOKEN"], _ = gh.GetToken(ctx, "")
+			secrets["GITHUB_TOKEN"], _ = gh.GetToken(ctx, "", input.githubInstance)
 		}
 
 		log.Debugf("Loading vars from %s", input.Varfile())

pkg/gh/gh.go

@@ -4,20 +4,25 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"errors"
 	"os/exec"
 )
 
-func GetToken(ctx context.Context, workingDirectory string) (string, error) {
+func GetToken(ctx context.Context, workingDirectory string, hostname string) (string, error) {
 	var token string
 
+	if hostname == "" {
+		return "", errors.New("hostname must not be empty")
+	}
+
 	// Locate the 'gh' executable
 	path, err := exec.LookPath("gh")
 	if err != nil {
 		return "", err
 	}
 
 	// Command setup
-	cmd := exec.CommandContext(ctx, path, "auth", "token")
+	cmd := exec.CommandContext(ctx, path, "auth", "token", "--hostname", hostname)
 	cmd.Dir = workingDirectory
 
 	// Capture the output

pkg/gh/gh_test.go

@@ -3,9 +3,21 @@ package gh
 import (
 	"context"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestGetToken(t *testing.T) {
-	token, _ := GetToken(context.TODO(), "")
+	token, _ := GetToken(context.TODO(), "", "github.com")
 	t.Log(token)
 }
+
+func TestGetTokenWithUnmatchedHostname(t *testing.T) {
+	_, err := GetToken(context.TODO(), "", "notgithub.example.com")
+	assert.Error(t, err)
+}
+
+func TestGetTokenWithNoHostname(t *testing.T) {
+	_, err := GetToken(context.TODO(), "", "")
+	assert.EqualError(t, err, "hostname must not be empty")
+}