refactor(core): split Mergify and GitHub token resolution

[sileht]

auth::resolve_token answered one chain -- --token, MERGIFY_TOKEN,
GITHUB_TOKEN, gh auth token -- for two unrelated services. stack
sends the result to api.github.com; every other command group sends it
to api.mergify.com.

Only the Mergify side is going to move. It gains the credential
mergify auth login stores, and its two GitHub fallbacks get a
deprecation warning. stack keeps sending GitHub exactly what it sends
it today, warns about nothing, and never sees a Mergify-issued token.
One resolver cannot do the first without doing the second, so this
splits it in two before anything changes.

No behavior change: both resolvers answer the same chain, and each side
pins its own precedence in tests rather than asserting the two agree --
they are about to stop agreeing, and the GitHub test has to keep failing
if the divergence ever reaches it.

Fixes MRGFY-8703

[sileht]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	refactor(core): split Mergify and GitHub token resolution	#1802	👈
2	feat(core): store the Mergify credential in the OS keychain	#1803
3	feat(core): let a caller read an endpoint's rejection body	#1804
4	feat(auth): the device authorization grant, client side	#1805
5	feat(cli): mergify auth login, logout and status	#1806
6	feat(core): use the stored credential, deprecate GITHUB_TOKEN	#1807
7	fix(core): never send a Mergify user token to GitHub	#1808

[mergify]

Merge Protections

🔴 2 of 6 protections blocking · waiting on 👀 reviews

	Protection	Waiting on
🔴	👀 Review Requirements	👀 reviews
🔴	🔎 Reviews	👀 reviews
🟢	🤖 Continuous Integration	—
🟢	Enforce conventional commit	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🔴 👀 Review Requirements

Waiting for

• #approved-reviews-by>=2

This rule is failing.

• any of:
  • #approved-reviews-by>=2
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🔴 🔎 Reviews

Waiting for

• #review-requested = 0

This rule is failing.

• #review-requested = 0
• #changes-requested-reviews-by = 0
• #review-threads-unresolved = 0

---

Show 4 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=ci-gate

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[Copilot]

🟡 Changes recommended

It still contains newly-touched inline documentation in main.rs that references a Python shim/consumer, which is stale and misleading in the Rust-only CLI.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Refactors mergify-core::auth token resolution by splitting the single resolve_token helper into two explicit resolvers—one for Mergify API calls and one for GitHub REST calls—so upcoming precedence differences can be introduced without impacting stack.

Changes:

• Introduced resolve_mergify_token and resolve_github_token backed by a shared internal token chain.
• Updated Mergify-API command paths to use resolve_mergify_token and stack/GitHub paths to use resolve_github_token.
• Added/updated unit tests to pin each resolver’s precedence independently.

File summaries

File	Description
crates/mergify-core/src/command_context.rs	Switches core command context token resolution to the Mergify-specific resolver.
crates/mergify-core/src/auth.rs	Splits token resolution into Mergify vs GitHub functions and updates tests accordingly.
crates/mergify-config/src/simulate.rs	Uses the Mergify-specific token resolver for simulate calls.
crates/mergify-cli/src/main.rs	Uses the GitHub-specific token resolver for stack and related internal GitHub calls; updates related docs.
crates/mergify-ci/src/tests_show.rs	Uses the Mergify-specific token resolver for CI API calls.
crates/mergify-ci/src/tests_quarantine.rs	Uses the Mergify-specific token resolver for CI quarantine API calls.
crates/mergify-ci/src/scopes_send.rs	Uses the Mergify-specific token resolver for scopes send API calls.
crates/mergify-ci/src/junit_process/command.rs	Uses the Mergify-specific token resolver for JUnit processing API calls.

Review details

Suppressed comments (1)

crates/mergify-cli/src/main.rs:2642

• This comment still refers to a “Python caller” supplying tokens via the subprocess environment. If the intent is to document how to avoid leaking tokens via ps, it should be phrased without referencing a Python shim.

                // `auth::resolve_github_token` reads `MERGIFY_TOKEN` /
                // `GITHUB_TOKEN` / `gh auth token` so the Python
                // caller can pass it via the subprocess env and keep
                // it out of `ps`/process listings.

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	3d3e49d		2026-09-04 23:40 UTC
2	content	3d3e49d → a02e23a (raw)		2026-09-04 23:40 UTC