[pull] trunk from cli:trunk

README.md

@@ -1,10 +1,10 @@
 # GitHub CLI
 
+GitHub CLI, or the gh CLI, is GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with `git` and your code.
+
 > [!IMPORTANT]
 > GitHub CLI's PGP signing key rotation for Linux package repositories is effective September 5, 2026; users experiencing package installation or update problems can find solutions in the [public announcement](https://github.com/cli/cli/issues/13118).
 
-`gh` is GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with `git` and your code.
-
 ![screenshot of gh pr status](https://user-images.githubusercontent.com/98482/84171218-327e7a80-aa40-11ea-8cd1-5177fc2d0e72.png)
 
 GitHub CLI is supported for users on GitHub.com, GitHub Enterprise Cloud, and [supported GitHub Enterprise Server versions](https://docs.github.com/en/enterprise-server/admin/all-releases), with support for macOS, Windows, and Linux.

internal/attachments/client.go

@@ -68,11 +68,13 @@ func checkHost(host string) error {
 	return nil
 }
 
-// uploadTokenTypes lists the credentials that can attach a file.
+// uploadTokenTypes lists the credentials that can attach a file. Some GitHub
+// App user-to-server tokens are supported, so the endpoint decides which.
 var uploadTokenTypes = []gh.TokenType{
 	gh.TokenTypeOAuth,
 	gh.TokenTypePersonalAccess,
 	gh.TokenTypeFineGrainedPAT,
+	gh.TokenTypeUserToServer,
 }
 
 // checkUploadTokenType rejects a credential that cannot upload. It is an

internal/attachments/client_test.go

@@ -409,6 +409,13 @@ func TestNewUploader(t *testing.T) {
 			targetRepository: 42,
 			viewerPermission: "WRITE",
 		},
+		{
+			name:             "App user-to-server token",
+			tokenType:        gh.TokenTypeUserToServer,
+			host:             "github.com",
+			targetRepository: 42,
+			viewerPermission: "WRITE",
+		},
 		{
 			name:             "rejects an enterprise server host",
 			tokenType:        gh.TokenTypeOAuth,
@@ -428,14 +435,6 @@ func TestNewUploader(t *testing.T) {
 			viewerPermission: "WRITE",
 			wantErr:          "attaching files is not supported on GitHub Enterprise Server",
 		},
-		{
-			name:             "rejects an App user-to-server token",
-			tokenType:        gh.TokenTypeUserToServer,
-			host:             "github.com",
-			targetRepository: 42,
-			viewerPermission: "WRITE",
-			wantErr:          badTokenErr,
-		},
 		{
 			name:             "rejects an App server-to-server token",
 			tokenType:        gh.TokenTypeServerToServer,

skills/gh/SKILL.md

@@ -126,7 +126,8 @@ blocked-by/blocking relationships.
   of `--body`, `--body-file`, or `--editor`.
 - Uploads require GitHub.com or a GHE.com tenant, an OAuth token, classic PAT,
   or fine-grained PAT, and `WRITE`, `MAINTAIN`, or `ADMIN` repository
-  permission. GitHub Enterprise Server and GitHub App tokens are unsupported.
+  permission. GitHub Enterprise Server and most GitHub App tokens are
+  unsupported.
 - Uploads stop at the first failure. If earlier files uploaded, `gh` still
   writes those attachments and exits non-zero. Create and edit commands also
   print the issue or pull request URL.