wtg-cli 0.3.0__tar.gz → 0.3.1__tar.gz

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/Cargo.lock

@@ -3179,7 +3179,7 @@ checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
 [[package]]
 name = "wtg-cli"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "async-trait",
  "base64",
@@ -3207,7 +3207,7 @@ dependencies = [
 
 [[package]]
 name = "wtg-python"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "pyo3",
  "wtg-cli",

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/Cargo.toml

@@ -1,10 +1,9 @@
 [workspace]
 resolver = "2"
-members = ["crates/wtg-python"]
-default-members = ["crates/wtg"]
+members = ["crates/wtg", "crates/wtg-python"]
 
 [workspace.package]
-version = "0.3.0"
+version = "0.3.1"
 edition = "2024"
 description = "A snarky but helpful CLI tool to identify git commits, issues, PRs and file changes, and tell you which release they shipped in"
 authors = ["Mike Perlov"]

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wtg-cli
-Version: 0.3.0
+Version: 0.3.1
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Rust
 Classifier: License :: OSI Approved :: MIT License

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/backend/combined_backend.rs

@@ -250,6 +250,10 @@ impl CombinedBackend {
 
 #[async_trait]
 impl Backend for CombinedBackend {
+    fn emit_notice(&self, notice: Notice) {
+        self.emit(notice);
+    }
+
     async fn backend_for_pr(&self, pr: &PullRequestInfo) -> Option<Box<dyn Backend>> {
         let pr_repo = pr.repo_info.as_ref()?;
         let our_repo = self.github.repo_info();

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/backend/github_backend.rs

@@ -13,7 +13,7 @@ use crate::changelog;
 use crate::error::{WtgError, WtgResult};
 use crate::git::{CommitInfo, TagInfo, looks_like_commit_hash};
 use crate::github::{ExtendedIssueInfo, GhRepoInfo, GitHubClient, PullRequestInfo};
-use crate::notice::NoticeCallback;
+use crate::notice::{Notice, NoticeCallback};
 use crate::parse_input::{ParsedQuery, Query};
 use crate::release_filter::ReleaseFilter;
 
@@ -122,6 +122,10 @@ impl GitHubBackend {
 
 #[async_trait]
 impl Backend for GitHubBackend {
+    fn emit_notice(&self, notice: Notice) {
+        self.client.emit(notice);
+    }
+
     async fn backend_for_pr(&self, pr: &PullRequestInfo) -> Option<Box<dyn Backend>> {
         let pr_repo = pr.repo_info.as_ref()?;
 

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/backend/mod.rs

@@ -33,6 +33,14 @@ use crate::remote::{RemoteHost, RemoteInfo};
 /// return `WtgError::Unsupported` for operations not available.
 #[async_trait]
 pub trait Backend: Send + Sync {
+    // ============================================
+    // Notice emission (default: no-op)
+    // ============================================
+
+    /// Emit a notice to the registered callback.
+    /// Used by resolution code to surface warnings to the user.
+    fn emit_notice(&self, _notice: Notice) {}
+
     // ============================================
     // Cross-project support (default: not supported)
     // ============================================
@@ -227,6 +235,7 @@ pub fn resolve_backend_with_notices(
         } else {
             // Can't access git locally, use pure API (soft notice)
             notice_cb(Notice::ApiOnly);
+            github.set_notice_callback(notice_cb);
             Ok(Box::new(github))
         }
     } else {

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/error.rs

@@ -16,6 +16,7 @@ pub enum WtgError {
     GhConnectionLost,
     GhRateLimit(OctoError),
     GhSaml(OctoError),
+    GhBadCredentials(OctoError),
     GitHub(OctoError),
     MultipleMatches(Vec<String>),
     Io(std::io::Error),
@@ -142,6 +143,26 @@ impl fmt::Display for WtgError {
                     "Try authenticating your GITHUB_TOKEN with SAML first!".red()
                 )
             }
+            Self::GhBadCredentials(_) => {
+                writeln!(
+                    f,
+                    "{}",
+                    "🔑 Nope! GitHub doesn't recognize that token."
+                        .yellow()
+                        .bold()
+                )?;
+                writeln!(f)?;
+                writeln!(
+                    f,
+                    "   {}",
+                    "Expired? Revoked? Typo? It happens to the best of us. 🤷".yellow()
+                )?;
+                writeln!(
+                    f,
+                    "   {}",
+                    "Check your GITHUB_TOKEN and try again!".yellow()
+                )
+            }
             Self::GitHub(e) => write!(f, "GitHub error: {e}"),
             Self::MultipleMatches(types) => {
                 writeln!(f, "{}", "💥 OH MY, YOU BLEW ME UP!".red().bold())?;
@@ -273,11 +294,12 @@ impl From<OctoError> for WtgError {
     fn from(err: OctoError) -> Self {
         if let OctoError::GitHub { ref source, .. } = err {
             match source.status_code {
+                StatusCode::UNAUTHORIZED => return Self::GhBadCredentials(err),
                 StatusCode::TOO_MANY_REQUESTS => return Self::GhRateLimit(err),
                 StatusCode::FORBIDDEN => {
                     let msg_lower = source.message.to_ascii_lowercase();
 
-                    if msg_lower.to_ascii_lowercase().contains("saml") {
+                    if msg_lower.contains("saml") {
                         return Self::GhSaml(err);
                     }
 

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/github.rs

@@ -98,6 +98,32 @@ impl GhRepoInfo {
     }
 }
 
+/// Describes which client served an API call and why.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ClientSelection {
+    /// The main (possibly authenticated) client succeeded directly.
+    Main,
+    /// The backup (anonymous) client was used after the main client failed.
+    Fallback(FallbackReason),
+}
+
+/// Why the main client failed, causing fallback to the backup client.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum FallbackReason {
+    /// SAML SSO enforcement blocked the authenticated request (403).
+    Saml,
+    /// Token was invalid, expired, or revoked (401).
+    BadCredentials,
+}
+
+/// Result from [`GitHubClient::call_api_and_get_client`] containing the API
+/// response, the client that served it, and how the client was selected.
+struct ApiCallResult<'a, T> {
+    value: T,
+    client: &'a Octocrab,
+    selection: ClientSelection,
+}
+
 /// GitHub API client wrapper.
 ///
 /// - Provides a simplified interface for common GitHub operations used in wtg over direct octocrab usage.
@@ -167,6 +193,9 @@ pub struct ExtendedIssueInfo {
     pub author_url: Option<String>,
     pub closing_prs: Vec<PullRequestInfo>, // PRs that closed this issue (may be cross-repo)
     pub created_at: Option<DateTime<Utc>>, // When the issue was created
+    /// Timeline data may be incomplete due to SAML-restricted org access.
+    /// When true, closing PRs may exist but aren't visible without SSO auth.
+    pub timeline_may_be_incomplete: bool,
 }
 
 impl TryFrom<octocrab::models::issues::Issue> for ExtendedIssueInfo {
@@ -192,6 +221,7 @@ impl TryFrom<octocrab::models::issues::Issue> for ExtendedIssueInfo {
             author_url,
             closing_prs: Vec::new(), // Will be populated by caller if needed
             created_at,
+            timeline_may_be_incomplete: false,
         })
     }
 }
@@ -237,6 +267,35 @@ impl GitHubClient {
         })
     }
 
+    /// Create a GitHub client with a specific token.
+    ///
+    /// Builds an authenticated client using the given token, with an anonymous
+    /// backup for fallback on SAML or bad credentials errors.
+    /// Returns `None` if the client cannot be built.
+    #[must_use]
+    pub fn new_with_token(token: String) -> Option<Self> {
+        if token.trim().is_empty() {
+            return None;
+        }
+
+        let connect_timeout = Some(Self::connect_timeout());
+        let read_timeout = Some(Self::read_timeout());
+
+        let auth = OctocrabBuilder::new()
+            .personal_token(token)
+            .set_connect_timeout(connect_timeout)
+            .set_read_timeout(read_timeout)
+            .build()
+            .ok()?;
+
+        Some(Self {
+            main_client: auth,
+            backup_client: LazyLock::new(Self::build_anonymous_client),
+            is_authenticated: true,
+            notice_callback: OnceLock::new(),
+        })
+    }
+
     /// Set the notice callback for this client.
     /// Can be called even when client is behind an `Arc`.
     /// First call wins - subsequent calls are ignored.
@@ -246,20 +305,29 @@ impl GitHubClient {
     }
 
     /// Emit a notice via the callback, if one is set.
-    fn emit(&self, notice: Notice) {
+    pub(crate) fn emit(&self, notice: Notice) {
         if let Some(cb) = self.notice_callback.get() {
             (cb)(notice);
         }
     }
 
-    /// Build an authenticated octocrab client
+    /// Build an authenticated octocrab client.
+    /// Returns `None` if `WTG_GH_NO_AUTH` is set or no valid token is found.
     fn build_auth_client() -> Option<Octocrab> {
+        // Undocumented: skip all authentication when WTG_GH_NO_AUTH is set
+        if env::var("WTG_GH_NO_AUTH").is_ok() {
+            log::debug!("WTG_GH_NO_AUTH set, skipping GitHub authentication");
+            return None;
+        }
+
         // Set reasonable timeouts: 5s connect, 30s read/write
         let connect_timeout = Some(Self::connect_timeout());
         let read_timeout = Some(Self::read_timeout());
 
-        // Try GITHUB_TOKEN env var first
-        if let Ok(token) = env::var("GITHUB_TOKEN") {
+        // Try GITHUB_TOKEN env var first (skip empty/whitespace-only values)
+        if let Ok(token) = env::var("GITHUB_TOKEN")
+            && !token.trim().is_empty()
+        {
             return OctocrabBuilder::new()
                 .personal_token(token)
                 .set_connect_timeout(connect_timeout)
@@ -305,6 +373,7 @@ impl GitHubClient {
             if let Ok(content) = fs::read_to_string(&xdg_path)
                 && let Ok(config) = serde_yaml::from_str::<GhConfig>(&content)
                 && let Some(token) = config.github_com.oauth_token
+                && !token.trim().is_empty()
             {
                 return Some(token);
             }
@@ -319,7 +388,10 @@ impl GitHubClient {
             if let Ok(content) = fs::read_to_string(&config_path)
                 && let Ok(config) = serde_yaml::from_str::<GhConfig>(&content)
             {
-                return config.github_com.oauth_token;
+                return config
+                    .github_com
+                    .oauth_token
+                    .filter(|t| !t.trim().is_empty());
             }
         }
 
@@ -406,26 +478,29 @@ impl GitHubClient {
 
         // Only fetch timeline for closed issues (open issues can't have closing PRs)
         if matches!(issue_info.state, octocrab::models::IssueState::Closed) {
-            issue_info.closing_prs = self.find_closing_prs(repo_info, issue_info.number).await;
+            let (closing_prs, timeline_may_be_incomplete) =
+                self.find_closing_prs(repo_info, issue_info.number).await;
+            issue_info.closing_prs = closing_prs;
+            issue_info.timeline_may_be_incomplete = timeline_may_be_incomplete;
         }
 
         Some(issue_info)
     }
 
-    /// Find closing PRs for an issue by examining timeline events
-    /// Returns list of PR references (may be from different repositories)
-    /// Priority:
-    /// 1. Closed events with `commit_id` (clearly indicate the PR/commit that closed the issue)
-    /// 2. CrossReferenced/Referenced events (fallback, but only merged PRs)
+    /// Find closing PRs for an issue by examining timeline events.
+    /// Returns `(prs, timeline_may_be_incomplete)` where the flag is true when
+    /// the timeline was fetched via an anonymous fallback client (after a SAML
+    /// or bad-credentials error) or the API call failed entirely, meaning
+    /// cross-project PR references may be missing from the response.
     async fn find_closing_prs(
         &self,
         repo_info: &GhRepoInfo,
         issue_number: u64,
-    ) -> Vec<PullRequestInfo> {
+    ) -> (Vec<PullRequestInfo>, bool) {
         let mut closing_prs = Vec::new();
 
         // Try to get first page with auth client, fallback to anonymous
-        let Ok((mut current_page, client)) = self
+        let Ok(result) = self
             .call_api_and_get_client(move |client| {
                 let repo_info = repo_info.clone();
                 Box::pin(async move {
@@ -439,11 +514,19 @@ impl GitHubClient {
             })
             .await
         else {
-            return Vec::new();
+            // API call failed entirely -- timeline is definitely incomplete
+            return (Vec::new(), true);
         };
 
+        let mut current_page = result.value;
+        let client = result.client;
+        let timeline_may_be_incomplete = matches!(
+            result.selection,
+            ClientSelection::Fallback(FallbackReason::Saml | FallbackReason::BadCredentials)
+        );
+
         // Collect all timeline events to get closing commits and referenced PRs
-        loop {
+        'pagination: loop {
             for event in &current_page.items {
                 // Collect candidate PRs from cross-references
                 if let Some(source) = event.source.as_ref() {
@@ -466,7 +549,7 @@ impl GitHubClient {
                             if matches!(event.event, TimelineEventType::Closed) {
                                 // If it's a Closed event, assume this is the closing PR
                                 closing_prs.push(pr_info);
-                                break; // No need to check further events
+                                break 'pagination; // No need to check further events or pages
                             }
 
                             // Otherwise, only consider CrossReferenced/Referenced events
@@ -507,7 +590,7 @@ impl GitHubClient {
             }
         }
 
-        closing_prs
+        (closing_prs, timeline_may_be_incomplete)
     }
 
     /// Fetch releases from GitHub, optionally filtered by date
@@ -524,7 +607,7 @@ impl GitHubClient {
         let per_page = 100u8; // Max allowed by GitHub API
 
         // Try to get first page with auth client, fallback to anonymous
-        let Ok((mut current_page, client)) = self
+        let Ok(result) = self
             .call_api_and_get_client(move |client| {
                 let repo_info = repo_info.clone();
                 Box::pin(async move {
@@ -542,6 +625,8 @@ impl GitHubClient {
         else {
             return releases;
         };
+        let mut current_page = result.value;
+        let client = result.client;
 
         'pagintaion: loop {
             if current_page.items.is_empty() {
@@ -883,52 +968,68 @@ impl GitHubClient {
     where
         for<'a> F: Fn(&'a Octocrab) -> Pin<Box<dyn Future<Output = OctoResult<T>> + Send + 'a>>,
     {
-        let (result, _client) = self.call_api_and_get_client(api_call).await?;
-        Ok(result)
+        let result = self.call_api_and_get_client(api_call).await?;
+        Ok(result.value)
     }
 
-    /// Call a GitHub API with fallback to backup client on SAML errors.
-    /// Returns results & the client used, or error.
+    /// Call a GitHub API with fallback to backup client on SAML or bad-credentials errors.
+    /// Returns an [`ApiCallResult`] containing the value, the client used, and how the
+    /// client was selected (see [`ClientSelection`]).
     /// Emits `Notice::GhRateLimitHit` if rate limit is detected.
-    async fn call_api_and_get_client<F, T>(&self, api_call: F) -> WtgResult<(T, &Octocrab)>
+    async fn call_api_and_get_client<F, T>(&self, api_call: F) -> WtgResult<ApiCallResult<'_, T>>
     where
         for<'a> F: Fn(&'a Octocrab) -> Pin<Box<dyn Future<Output = OctoResult<T>> + Send + 'a>>,
     {
         // Try with main client first
-        let main_error = match Self::await_with_timeout_and_error(api_call(&self.main_client)).await
-        {
-            Ok(result) => return Ok((result, &self.main_client)),
-            Err(e) if e.is_gh_rate_limit() => {
-                log::debug!(
-                    "GitHub API rate limit hit (authenticated={}): {:?}",
-                    self.is_authenticated,
-                    e
-                );
-                self.emit(Notice::GhRateLimitHit {
-                    authenticated: self.is_authenticated,
-                });
-                return Err(e);
-            }
-            Err(e) if e.is_gh_saml() && self.is_authenticated => {
-                // SAML error with authenticated client - fall through to try backup
-                e
-            }
-            Err(e) => {
-                // Non-SAML error, or SAML with anonymous client (no fallback possible)
-                log::debug!("GitHub API error: {e:?}");
-                return Err(e);
-            }
-        };
+        let (main_error, fallback_reason) =
+            match Self::await_with_timeout_and_error(api_call(&self.main_client)).await {
+                Ok(result) => {
+                    return Ok(ApiCallResult {
+                        value: result,
+                        client: &self.main_client,
+                        selection: ClientSelection::Main,
+                    });
+                }
+                Err(e) if e.is_gh_rate_limit() => {
+                    log::debug!(
+                        "GitHub API rate limit hit (authenticated={}): {:?}",
+                        self.is_authenticated,
+                        e
+                    );
+                    self.emit(Notice::GhRateLimitHit {
+                        authenticated: self.is_authenticated,
+                    });
+                    return Err(e);
+                }
+                Err(e) if e.is_gh_saml() && self.is_authenticated => {
+                    // SAML error with authenticated client - fall through to try backup
+                    (e, FallbackReason::Saml)
+                }
+                Err(e) if e.is_gh_bad_credentials() && self.is_authenticated => {
+                    // Bad credentials (401) - token is invalid/expired, fall through to try backup
+                    log::debug!("GitHub API bad credentials, falling back to anonymous client");
+                    (e, FallbackReason::BadCredentials)
+                }
+                Err(e) => {
+                    // Non-recoverable error, or unauthenticated client (no fallback possible)
+                    log::debug!("GitHub API error: {e:?}");
+                    return Err(e);
+                }
+            };
 
-        // Try with backup client on SAML error (only reached if authenticated)
+        // Try with backup client (only reached if authenticated and main failed with SAML or bad creds)
         let Some(backup) = self.backup_client.as_ref() else {
             // Backup client failed to build - connection was lost between auth and now
             return Err(WtgError::GhConnectionLost);
         };
 
-        // Try the backup, but if it also fails with SAML, return original error
+        // Try the backup; if it also fails, return the appropriate error
         match Self::await_with_timeout_and_error(api_call(backup)).await {
-            Ok(result) => Ok((result, backup)),
+            Ok(result) => Ok(ApiCallResult {
+                value: result,
+                client: backup,
+                selection: ClientSelection::Fallback(fallback_reason),
+            }),
             Err(e) if e.is_gh_rate_limit() => {
                 log::debug!("GitHub API rate limit hit on backup client: {e:?}");
                 // Emit notice for anonymous fallback (authenticated was true to reach here,
@@ -938,9 +1039,12 @@ impl GitHubClient {
                 });
                 Err(e)
             }
-            Err(e) if e.is_gh_saml() => Err(main_error), // Return original SAML error
+            Err(e) if e.is_gh_saml() => Err(main_error), // Return original main-client error
             Err(e) => {
                 log::debug!("GitHub API error on backup client: {e:?}");
+                self.emit(Notice::GhAnonymousFallbackFailed {
+                    error: format!("{e}"),
+                });
                 Err(e)
             }
         }

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/notice.rs

@@ -60,6 +60,22 @@ pub enum Notice {
         /// Whether the client was authenticated or anonymous
         authenticated: bool,
     },
+    /// Anonymous fallback was attempted but failed with a non-rate-limit error
+    GhAnonymousFallbackFailed {
+        /// The error message from the failed anonymous request
+        error: String,
+    },
+    /// Cross-project PR commit fetch failed (e.g., due to rate limits or auth issues)
+    CrossProjectPrFetchFailed {
+        /// Owner of the cross-project repo
+        owner: String,
+        /// Repo name of the cross-project repo
+        repo: String,
+        /// PR number
+        pr_number: u64,
+        /// Error message
+        error: String,
+    },
 }
 
 /// Callback for emitting notices during operations.

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/output.rs

@@ -361,6 +361,28 @@ fn display_missing_info(info: &EnrichedInfo) {
             "🤷 No PR found for this issue... still hunting for the fix!"
         };
         println!("{}", message.yellow().italic());
+        if issue.timeline_may_be_incomplete {
+            println!(
+                "{}",
+                "   (Timeline data may be incomplete - we might be missing cross-project refs. Check your token access!)"
+                    .yellow()
+                    .italic()
+            );
+        }
+        println!();
+    }
+
+    // Warning: timeline may be incomplete even when a PR was found
+    if let Some(issue) = info.issue.as_ref()
+        && info.pr.is_some()
+        && issue.timeline_may_be_incomplete
+    {
+        println!(
+            "{}",
+            "⚠️  Timeline data may be incomplete - we might be missing cross-project refs. Check your token access!"
+                .yellow()
+                .italic()
+        );
         println!();
     }
 
@@ -612,7 +634,7 @@ fn display_release_info(release: Option<TagInfo>, filter: &ReleaseFilter) {
 fn display_unsupported_host(remote: &RemoteInfo) {
     match remote.host {
         Some(RemoteHost::GitLab) => {
-            println!(
+            eprintln!(
                 "{}",
                 "🦊 GitLab spotted! Living that self-hosted life, I see..."
                     .yellow()
@@ -620,7 +642,7 @@ fn display_unsupported_host(remote: &RemoteInfo) {
             );
         }
         Some(RemoteHost::Bitbucket) => {
-            println!(
+            eprintln!(
                 "{}",
                 "🪣 Bitbucket, eh? Taking the scenic route!"
                     .yellow()
@@ -632,7 +654,7 @@ fn display_unsupported_host(remote: &RemoteInfo) {
             return;
         }
         None => {
-            println!(
+            eprintln!(
                 "{}",
                 "🌐 A custom git remote? Look at you being all independent!"
                     .yellow()
@@ -641,13 +663,13 @@ fn display_unsupported_host(remote: &RemoteInfo) {
         }
     }
 
-    println!(
+    eprintln!(
         "{}",
         "   (I can only do GitHub API stuff, but let me show you local git info...)"
             .yellow()
             .italic()
     );
-    println!();
+    eprintln!();
 }
 
 fn display_mixed_remotes(hosts: &[RemoteHost], count: usize) {
@@ -660,7 +682,7 @@ fn display_mixed_remotes(hosts: &[RemoteHost], count: usize) {
         })
         .collect();
 
-    println!(
+    eprintln!(
         "{}",
         format!(
             "🤯 Whoa, {} remotes pointing to {}? I'm getting dizzy!",
@@ -670,19 +692,19 @@ fn display_mixed_remotes(hosts: &[RemoteHost], count: usize) {
         .yellow()
         .italic()
     );
-    println!(
+    eprintln!(
         "{}",
         "   (You've got quite the multi-cloud setup going on here...)"
             .yellow()
             .italic()
     );
-    println!(
+    eprintln!(
         "{}",
         "   (I can only do GitHub API stuff, but let me show you local git info...)"
             .yellow()
             .italic()
     );
-    println!();
+    eprintln!();
 }
 
 /// Print a notice to stderr.
@@ -812,5 +834,42 @@ pub fn print_notice(notice: Notice) {
                 );
             }
         }
+        Notice::GhAnonymousFallbackFailed { error } => {
+            eprintln!(
+                "{}",
+                "🔑 Tried anonymous fallback, but GitHub wasn't having it..."
+                    .yellow()
+                    .italic()
+            );
+            eprintln!("{}", format!("   ({error})").yellow().italic());
+            eprintln!(
+                "{}",
+                "   (Set GITHUB_TOKEN for more reliable access!)"
+                    .yellow()
+                    .italic()
+            );
+        }
+        Notice::CrossProjectPrFetchFailed {
+            owner,
+            repo,
+            pr_number,
+            error,
+        } => {
+            eprintln!(
+                "{}",
+                format!(
+                    "🔍 Spotted PR #{pr_number} in {owner}/{repo}, but it's playing hard to get..."
+                )
+                .yellow()
+                .italic()
+            );
+            eprintln!("{}", format!("   ({error})").yellow().italic());
+            eprintln!(
+                "{}",
+                "   (Cross-project sleuthing needs a GITHUB_TOKEN with access!)"
+                    .yellow()
+                    .italic()
+            );
+        }
     }
 }

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/src/resolution.rs

@@ -9,6 +9,7 @@ use crate::changelog;
 use crate::error::{WtgError, WtgResult};
 use crate::git::{CommitInfo, FileInfo, TagInfo};
 use crate::github::{ExtendedIssueInfo, PullRequestInfo};
+use crate::notice::Notice;
 use crate::parse_input::Query;
 use crate::release_filter::ReleaseFilter;
 
@@ -36,6 +37,8 @@ pub struct IssueInfo {
     pub url: String,
     pub author: Option<String>,
     pub author_url: Option<String>,
+    /// Timeline data may be incomplete due to SAML-restricted org access.
+    pub timeline_may_be_incomplete: bool,
 }
 
 impl From<&ExtendedIssueInfo> for IssueInfo {
@@ -48,6 +51,7 @@ impl From<&ExtendedIssueInfo> for IssueInfo {
             url: ext_info.url.clone(),
             author: ext_info.author.clone(),
             author_url: ext_info.author_url.clone(),
+            timeline_may_be_incomplete: ext_info.timeline_may_be_incomplete,
         }
     }
 }
@@ -223,20 +227,32 @@ async fn resolve_issue(
         if let Some(merge_sha) = &pr.merge_commit_sha {
             // Get backend for PR (returns cross-project backend if needed, None if same repo)
             let cross_backend = backend.backend_for_pr(pr).await;
+            let is_cross_project = cross_backend.is_some();
             let effective_backend: &dyn Backend =
                 cross_backend.as_ref().map_or(backend, |b| b.as_ref());
 
-            let commit = effective_backend.find_commit(merge_sha).await.ok();
-            let commit = match commit {
-                Some(c) => Some(effective_backend.enrich_commit(c).await),
-                None => None,
+            // Try to fetch the commit, emit notice if cross-project fetch fails
+            let commit = match effective_backend.find_commit(merge_sha).await {
+                Ok(c) => Some(effective_backend.enrich_commit(c).await),
+                Err(e) => {
+                    // Emit notice if this was a cross-project fetch failure
+                    if is_cross_project && let Some(repo_info) = pr.repo_info.as_ref() {
+                        backend.emit_notice(Notice::CrossProjectPrFetchFailed {
+                            owner: repo_info.owner().to_string(),
+                            repo: repo_info.repo().to_string(),
+                            pr_number: pr.number,
+                            error: e.to_string(),
+                        });
+                    }
+                    None
+                }
             };
 
             let release = if let Some(ref c) = commit {
                 let hash = &c.hash;
                 let date = Some(c.date);
                 // Try issue's repo first, fall back to PR's repo for releases
-                if cross_backend.is_some() {
+                if is_cross_project {
                     match backend.find_release_for_commit(hash, date, filter).await {
                         Some(r) => Some(r),
                         None => {

{wtg_cli-0.3.0 → wtg_cli-0.3.1}/crates/wtg/tests/integration.rs

@@ -327,6 +327,63 @@ async fn integration_specific_tag_found() {
     );
 }
 
+/// Test that an invalid `GITHUB_TOKEN` doesn't panic and attempts anonymous fallback.
+/// The anonymous fallback may itself fail (e.g., rate limits on shared CI runners),
+/// so this test only asserts the result when the fallback succeeds. When the fallback
+/// returns None, we verify a fallback notice was emitted (rate-limit or anonymous
+/// fallback failure) to confirm fallback was actually attempted (rather than silently
+/// accepting a regression).
+#[tokio::test]
+async fn integration_invalid_github_token_falls_back_to_anonymous() {
+    use std::sync::{Arc, Mutex};
+    use wtg_cli::github::{GhRepoInfo, GitHubClient};
+    use wtg_cli::notice::Notice;
+
+    // Build a client with an invalid token to force 401 Bad Credentials
+    let client = GitHubClient::new_with_token("ghp_clearly_not_a_real_token_000000000".to_string())
+        .expect("Failed to create GitHub client");
+
+    // Track notices to verify fallback behavior even when the result is None
+    let notices: Arc<Mutex<Vec<Notice>>> = Arc::new(Mutex::new(Vec::new()));
+    let notices_clone = Arc::clone(&notices);
+    client.set_notice_callback(Arc::new(move |notice| {
+        notices_clone.lock().unwrap().push(notice);
+    }));
+
+    // Fetch a known commit via a single API call. The bad token triggers fallback
+    // to the anonymous backup client. If anonymous rate limit is exhausted
+    // (common on shared CI runners), the result is None - that's acceptable
+    // only if a rate-limit notice confirms the fallback was actually attempted.
+    let repo_info = GhRepoInfo::new("go-task".to_string(), "task".to_string());
+    let commit = client.fetch_commit_full_info(&repo_info, "15b7e3c").await;
+
+    if let Some(commit) = commit {
+        assert!(
+            commit.hash.starts_with("15b7e3c"),
+            "Expected commit hash starting with 15b7e3c, got {}",
+            commit.hash
+        );
+    } else {
+        let captured = notices.lock().unwrap();
+        let got_fallback_notice = captured.iter().any(|n| {
+            matches!(
+                n,
+                Notice::GhRateLimitHit {
+                    authenticated: false
+                } | Notice::GhAnonymousFallbackFailed { .. }
+            )
+        });
+        let captured_notices: Vec<String> = captured.iter().map(|n| format!("{n:?}")).collect();
+        drop(captured);
+        assert!(
+            got_fallback_notice,
+            "Fallback returned None but no anonymous fallback notice was emitted; \
+                 this suggests the fallback mechanism may be broken. \
+                 Captured notices: {captured_notices:?}"
+        );
+    }
+}
+
 /// Convert `IdentifiedThing` to a consistent snapshot structure
 fn to_snapshot(result: &IdentifiedThing) -> IntegrationSnapshot {
     match result {