GitHub CLI

Open pull requests, triage issues, cut releases, spin up new repositories - the whole GitHub workflow from inside your container, without switching to the browser. That’s the GitHub CLI (gh), and it’s what a coding agent reaches for to open a PR the moment its work is done.

git already moves your code in and out - clone, commit, push (see Git and repositories). gh covers everything around the repo on GitHub’s side. It’s a plain command-line tool, not an AI agent, and once you authenticate it the login persists across container rebuilds.

Note

acme is just a sample workbench name - it’s whatever you passed to monoceros init. Substitute your own throughout.

Added automatically with a GitHub repo

You usually don’t add this feature by hand. Configure a GitHub repo - with monoceros init --with-repos=… or monoceros add-repo - and Monoceros adds the GitHub CLI for you, authenticated from the same token as the repo.

Add it explicitly only when a container has no GitHub repo but you still want gh - for instance to spin up and push a brand-new project (see Start a new project).

Add it

At init, when you create the container:

monoceros init acme --with-features=github

Or later, on an existing one:

monoceros add-feature acme github

Remove it

monoceros remove-feature acme github

Or delete the feature’s entry from acme.yml by hand and re-run monoceros apply acme - the yml is the source of truth.

Authentication

gh signs in with the same access token as your GitHub repos, so if you’ve set that up there’s nothing more to do here. Git and repositories shows how to create the token and where to put it.

Prefer to log in by hand? Leave the token unset and run gh auth login on first start - either way the login sticks across container rebuilds.

Options

Option	Default	Description
apiToken	(empty)	GitHub PAT - see Git and repositories for scopes. Empty for gh auth login.

acme.yml

features:
  - ref: ghcr.io/getmonoceros/monoceros-features/github-cli:1
    options:
      apiToken: ${GITHUB_API_TOKEN}

Tip

The token lives in acme.env (or the global monoceros-config.env), never in the yml - the ${GITHUB_API_TOKEN} placeholder resolves from there at apply. See Git and repositories.

What you get

The gh command on PATH, ready in any monoceros shell or via monoceros run. With a token set it’s authenticated in every shell; otherwise log in once and it persists across rebuilds.

Because it’s just gh on PATH, the AI coding tools in the container reach for it too - ask Claude Code to open a PR or check why CI failed, and it shells out to gh on your behalf.