GitHub CLI

Allows read-only inspection of repos, PRs, issues, runs and releases; asks before anything that writes to GitHub or changes local credentials; and guards the irreversible deletions.

.claude/fencepost.yaml

import:
  - gh

Full preset

presets/gh.yaml

# Fencepost preset: gh

meta:
  title: GitHub CLI
  description: >-
    Allows read-only inspection of repos, PRs, issues, runs and releases;
    asks before anything that writes to GitHub or changes local credentials;
    and guards the irreversible deletions.

# Subcommands verified against gh 2.83.2.
tools:
  bash:
    checks:
      - test: 'gh\s+repo\s+delete\b'
        description: "Deleting a repository is irreversible and takes its issues, PRs, releases and wiki with it."
        alternative: "Archive it with 'gh repo archive' instead, or delete it manually in the GitHub UI where the name must be re-typed to confirm."
      - test: 'gh\s+issue\s+delete\b'
        description: "Deleting an issue permanently removes it and its comments; there is no undo."
        alternative: "Close it with 'gh issue close' to keep the history."

    ask:
      # Pull requests
      - gh pr create
      - gh pr merge
      - gh pr close
      - gh pr reopen
      - gh pr edit
      - gh pr comment
      - gh pr review
      - gh pr ready
      - gh pr lock
      - gh pr unlock
      - gh pr checkout
      - gh pr revert
      - gh pr update-branch
      # Issues
      - gh issue create
      - gh issue close
      - gh issue reopen
      - gh issue edit
      - gh issue comment
      - gh issue lock
      - gh issue unlock
      - gh issue pin
      - gh issue unpin
      - gh issue transfer
      - gh issue develop
      # Repositories
      - gh repo create
      - gh repo clone
      - gh repo fork
      - gh repo edit
      - gh repo rename
      - gh repo sync
      - gh repo archive
      - gh repo unarchive
      - gh repo set-default
      - gh repo deploy-key
      - gh repo autolink
      # Releases
      - gh release create
      - gh release edit
      - gh release upload
      - gh release delete
      - gh release delete-asset
      # Workflows & runs
      - gh workflow run
      - gh workflow enable
      - gh workflow disable
      - gh run rerun
      - gh run cancel
      - gh run delete
      - gh run download
      # Secrets, variables, labels, gists, caches
      - gh secret set
      - gh secret delete
      - gh variable set
      - gh variable delete
      - gh label create
      - gh label edit
      - gh label clone
      - gh label delete
      - gh gist create
      - gh gist edit
      - gh gist clone
      - gh gist rename
      - gh gist delete
      - gh cache delete
      # Local config & extensions
      - gh config set
      - gh extension install
      - gh extension upgrade
      - gh extension remove
      - gh extension create
      - gh extension exec
      - gh alias set
      - gh alias delete
      - gh alias import
      # Auth & account keys reach out or change local credentials
      - gh auth login
      - gh auth logout
      - gh auth refresh
      - gh auth setup-git
      - gh auth switch
      - gh auth token
      - gh ssh-key add
      - gh ssh-key delete
      - gh gpg-key add
      - gh gpg-key delete
      # Codespaces (create/connect/transfer)
      - gh codespace create
      - gh codespace delete
      - gh codespace edit
      - gh codespace rebuild
      - gh codespace stop
      - gh codespace ssh
      - gh codespace cp
      - gh codespace code
      - gh codespace jupyter
      # Projects (writes)
      - gh project create
      - gh project close
      - gh project copy
      - gh project delete
      - gh project edit
      - gh project field-create
      - gh project field-delete
      - gh project item-add
      - gh project item-archive
      - gh project item-create
      - gh project item-delete
      - gh project item-edit
      - gh project link
      - gh project unlink
      - gh project mark-template
      # Agent tasks
      - gh agent-task create
      # Arbitrary API surface (reads or writes; includes `gh api graphql`)
      - gh api

    allow:
      - gh status
      - gh version
      - gh auth status
      - gh repo view
      - gh repo list
      - gh repo gitignore
      - gh repo license
      - gh pr list
      - gh pr view
      - gh pr diff
      - gh pr checks
      - gh pr status
      - gh issue list
      - gh issue view
      - gh issue status
      - gh run list
      - gh run view
      - gh run watch
      - gh workflow list
      - gh workflow view
      - gh release list
      - gh release view
      - gh release download
      - gh release verify
      - gh release verify-asset
      - gh search
      - gh label list
      - gh gist list
      - gh gist view
      - gh cache list
      - gh ruleset list
      - gh ruleset view
      - gh ruleset check
      - gh variable list
      - gh variable get
      - gh secret list
      - gh browse
      - gh config get
      - gh config list
      - gh config clear-cache
      - gh extension list
      - gh extension search
      - gh org list
      - gh project list
      - gh project view
      - gh project field-list
      - gh project item-list
      - gh codespace list
      - gh codespace view
      - gh codespace logs
      - gh codespace ports
      - gh ssh-key list
      - gh gpg-key list
      - gh alias list
      - gh attestation verify
      - gh attestation download
      - gh attestation trusted-root
      - gh agent-task list
      - gh agent-task view