Upload and embed files in GitHub issues and pull requests

Upload and download GitHub user-attachments drives gh-attach, a GitHub CLI extension that reproduces the web interface's attachment upload flow. It turns a local screenshot, image, PDF, archive, log, or video into a hosted user-attachments URL and can download an existing attachment to a local file.

The extension prints the uploaded URL; the surrounding workflow places that reference in a pull request, issue, comment, or README. GitHub renders supported attachment URLs as their corresponding image, video, or file. Attachment visibility follows the repository, so a private repository's upload is not an anonymous public download.

Use when asked to add a screenshot or other file to a pull request, attach evidence to an issue, embed before-and-after images, or retrieve an attachment for review. Confirm the destination repository before uploading and share only files intended for everyone who can view it.

Uploads require repository write access and an interactive browser session. Headless and CI upload paths are intentionally unsupported. Do not export, store, pass, or log a raw user_session cookie. That cookie grants full account access rather than the narrower scope of a personal access token.

For uploads, provide a resolved absolute file path and the intended repository. Quote paths containing spaces or Unicode, and resolve globs before invoking the extension. The -R option can identify owner/repository, or host/owner/repository for GitHub Enterprise Server; it is optional when the working directory already identifies the repository.

Upload output is a one-line URL on standard output. The extension can also handle concurrent files and emit Markdown or JSON with jq-style filtering. For downloads, choose the output destination explicitly:

# Specify the destination explicitly.
gh attach download "$URL" -O "/abs/path/out.png"

The URL variable refers to the attachment being retrieved. Private downloads use the active gh token, with browser authorization as a fallback. An anonymous request returning 403 or 404 for a private attachment is expected access control.

The workflow supports GitHub Cloud and GitHub Enterprise Server through gh. Its prerequisite pins the reviewed gh-attach v0.4.2 release. Installation or upgrades should not silently select a moving branch or unreviewed latest release; changing the pin requires re-review.

Uploads authenticate through a browser user_session rather than the gh token because the internal upload endpoint rejects tokens. An authenticated gh account helps select the matching local browser account. Chromium-family, Firefox-family, and Safari profiles are supported. If selection is wrong, specify browser and profile, and obtain explicit approval before the extension accesses that interactive profile.

Embedding uses gh pr edit, gh issue comment, or related commands with --body-file - so multiline text and special characters retain their meaning. File types remain subject to the accepting GitHub server's rules. The extension prints attachment references; writing those references into discussion text is a separate step.