[BUG]: tokenFromGHCLI fails to resolve token for GHEC (.ghe.com) hosts — causes silent fallback to unauthenticated client

[clawster]

Expected Behavior

When

gh auth login --hostname my-enterprise.ghe.com 

has been completed and no explicit [token] is set in the provider config, the provider should resolve the token from the gh CLI and make authenticated API requests.

Actual Behavior

The provider passes api.my-enterprise.ghe.com (with api. prefix) to gh auth token --hostname, which doesn't match how gh stores GHEC credentials (my-enterprise.ghe.com). The lookup fails silently, the provider falls back to an unauthenticated client, and all API calls return:

Debug logs confirm unauthenticated requests (X-Ratelimit-Limit=60 instead of 5,000+).

Terraform Version

OpenTofu v1.11.4
on linux_amd64

• provider registry.opentofu.org/integrations/github v6.11.1

Affected Resource(s)

All resources and data sources — the issue is in provider-level authentication, not resource-specific logic.

Reproduced with:
github_repository

Terraform Configuration Files

provider "github" {
  owner    = "my-org"
  base_url = "https://api.my-enterprise.ghe.com/"
  # no token set — relying on gh CLI fallback
}

resource "github_repository" "repos" {
  for_each = toset(["my-repo"])
  name     = each.key
}

Steps to Reproduce

Authenticate with gh:

gh auth login --hostname my-enterprise.ghe.com

1. Configure the provider with a GHEC base_url and no explicit [token]
2. Run terraform plan or tofu plan
3. All API calls fail with 401 Must authenticate to access this API.

Debug Output

Panic Output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[deiga]

Thank you for raising this issue!

We're on our way of deprecating the auth with gh CLI (most likely), so I would recommend using some other method for AuthN

[clawster]

Thanks for the quick reply.
It looks like I was able to resolve the issue, if you decide to keep gh cli auth mechanism please have a look at my PR.