feat(cargo-aprz): discover tokens from GitHub CLI

crates/cargo-aprz-lib/Cargo.toml

@@ -172,6 +172,10 @@ required-features = ["internals"]
 name = "docs_provider_integration"
 required-features = ["internals"]
 
+[[test]]
+name = "github_credentials_process_integration"
+required-features = ["internals"]
+
 [[test]]
 name = "hosting_provider_integration"
 required-features = ["internals"]

crates/cargo-aprz-lib/src/commands/common.rs

@@ -19,6 +19,7 @@ use ohno::IntoAppError;
 use super::ProgressReporter;
 use super::cache_dir::platform_cache_dir;
 use super::config::Config;
+use super::github_credentials::{GitHubToken, discover};
 use crate::Result;
 use crate::expr::{ExpressionDisposition, ExpressionOutcome, Risk, evaluate};
 use crate::facts::{Collector, CrateFacts, CrateRef, Endpoints, ProviderResult};
@@ -75,10 +76,20 @@ pub enum ConsoleSection {
 
 /// Common arguments shared between crates and deps commands
 #[derive(Args, Debug)]
+#[expect(clippy::struct_excessive_bools, reason = "each bool is an independent clap CLI flag")]
 pub struct CommonArgs {
-    /// GitHub personal access token
-    #[arg(long, value_name = "TOKEN", env = "GITHUB_TOKEN")]
-    pub github_token: Option<String>,
+    /// GitHub token.
+    ///
+    /// Defaults to `GITHUB_TOKEN`. If none is available, GitHub access is anonymous.
+    #[arg(long, value_name = "TOKEN")]
+    pub github_token: Option<GitHubToken>,
+
+    /// Discover a GitHub token from the authenticated `gh` CLI.
+    ///
+    /// Used only after `--github-token` and `GITHUB_TOKEN`, for the configured
+    /// GitHub host.
+    #[arg(long)]
+    pub github_token_from_gh: bool,
 
     /// Codeberg personal access token
     #[arg(long, value_name = "TOKEN", env = "CODEBERG_TOKEN")]
@@ -260,8 +271,11 @@ impl<'a, H: super::Host> Common<'a, H> {
 
         let progress_reporter = ProgressReporter::new(delay, use_colors_for_progress);
 
+        let endpoints = args.endpoints();
+        let github_token = discover(args.github_token.as_ref(), args.github_token_from_gh, &endpoints).await;
+
         let collector = Collector::new(
-            args.github_token.as_deref(),
+            github_token.as_ref().map(GitHubToken::expose_secret),
             args.codeberg_token.as_deref(),
             &cache_dir,
             config.crates_cache_ttl,
@@ -272,7 +286,7 @@ impl<'a, H: super::Host> Common<'a, H> {
             args.ignore_cached,
             config.bug_label_matcher()?.into(),
             progress_reporter,
-            &args.endpoints(),
+            &endpoints,
         )
         .await?;
 
@@ -678,7 +692,7 @@ fn should_include_rejection_details(console_mode: Option<&ConsoleOutputMode>) ->
 #[cfg(test)]
 #[cfg(not(miri))]
 mod tests {
-    use clap::Parser;
+    use clap::{CommandFactory, Parser};
     use semver::{Version, VersionReq};
 
     use super::*;
@@ -725,6 +739,27 @@ mod tests {
         assert_eq!(endpoints.advisory_url(), defaults.advisory_url());
     }
 
+    #[test]
+    fn github_cli_token_discovery_is_visible_and_opt_in() {
+        let crates_default = crate::commands::CratesArgs::parse_from(["crates"]);
+        assert!(!crates_default.common.github_token_from_gh);
+        let deps_default = crate::commands::DepsArgs::parse_from(["deps"]);
+        assert!(!deps_default.common.github_token_from_gh);
+
+        let crates = crate::commands::CratesArgs::parse_from(["crates", "--github-token-from-gh"]);
+        assert!(crates.common.github_token_from_gh);
+        let deps = crate::commands::DepsArgs::parse_from(["deps", "--github-token-from-gh"]);
+        assert!(deps.common.github_token_from_gh);
+
+        for mut command in [crate::commands::CratesArgs::command(), crate::commands::DepsArgs::command()] {
+            let help = command.render_long_help().to_string();
+            assert!(
+                help.contains("--github-token-from-gh"),
+                "the opt-in switch must be visible in help:\n{help}"
+            );
+        }
+    }
+
     #[test]
     fn test_endpoints_apply_every_override() {
         let parsed = ArgsHarness::parse_from([