From 15ecc154b65218298c1df74c4270f3fb29174a7b Mon Sep 17 00:00:00 2001
From: Jordan Sussman <jordan_sussman@cargill.com>
Date: Wed, 27 May 2026 10:31:58 -0500
Subject: [PATCH] feat(auth): add ability to ignore token refresh

---
 cmd/vela-cli/main.go      | 7 +++++++
 go.mod                    | 2 ++
 go.sum                    | 4 ++--
 internal/client/client.go | 5 +++++
 internal/internal.go      | 2 ++
 5 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/cmd/vela-cli/main.go b/cmd/vela-cli/main.go
index d72505c4..b5efd7a6 100644
--- a/cmd/vela-cli/main.go
+++ b/cmd/vela-cli/main.go
@@ -97,6 +97,13 @@ func main() {
 			Aliases: []string{"rt"},
 			Usage:   "refresh access token used for communication with the Vela server",
 		},
+		&cli.BoolFlag{
+			Sources: cli.EnvVars("VELA_PERFORM_REFRESH_TOKEN", "CONFIG_PERFORM_REFRESH_TOKEN", "SERVER_PERFORM_REFRESH_TOKEN"),
+			Name:    internal.FlagAPIPerformTokenRefresh,
+			Aliases: []string{"prt"},
+			Usage:   "whether the cli should attempt to refresh the credentials",
+			Value:   true,
+		},
 		&cli.StringFlag{
 			Sources: cli.EnvVars("VELA_API_VERSION", "CONFIG_API_VERSION", "API_VERSION"),
 			Name:    internal.FlagAPIVersion,
diff --git a/go.mod b/go.mod
index f89b8397..0ea7dd48 100644
--- a/go.mod
+++ b/go.mod
@@ -1,5 +1,7 @@
 module github.com/go-vela/cli
 
+replace github.com/go-vela/sdk-go => github.com/go-vela/sdk-go v0.28.1-0.20260526194207-83df9236b666
+
 go 1.26.1
 
 require (
diff --git a/go.sum b/go.sum
index a769415a..1f68f3dc 100644
--- a/go.sum
+++ b/go.sum
@@ -162,8 +162,8 @@ github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy0
 github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/go-vela/sdk-go v0.28.0 h1:nao4xxk+JyDy2ftN3J1EhA27KTfXgjS6mA+fm6HP+Nc=
-github.com/go-vela/sdk-go v0.28.0/go.mod h1:43aQiVr6BAl7ensvpCytHjFaG0TI3Hq3wD4aUcAeZE4=
+github.com/go-vela/sdk-go v0.28.1-0.20260526194207-83df9236b666 h1:t0AF5dykZmy3wuAthuSYMXh2YoI5z9IKnQN+cadtad8=
+github.com/go-vela/sdk-go v0.28.1-0.20260526194207-83df9236b666/go.mod h1:43aQiVr6BAl7ensvpCytHjFaG0TI3Hq3wD4aUcAeZE4=
 github.com/go-vela/server v0.28.0 h1:vuJNQFTJ0lle/sCH1SZqup1ukfdwbTm/ejw8jhRz8j8=
 github.com/go-vela/server v0.28.0/go.mod h1:R0GLaoCrY4OsnynoiN1MIdRo67kqzY5sTavxrn3bcfc=
 github.com/go-vela/worker v0.28.0 h1:RQAzJT/YDp/H69PVZmgGu8hfvqCAzWRkfdEo4iaeTgs=
diff --git a/internal/client/client.go b/internal/client/client.go
index e071757a..a8c41f49 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -35,6 +35,9 @@ func Parse(c *cli.Command) (*vela.Client, error) {
 	// capture the refresh token from the context
 	refreshToken := c.String(internal.FlagAPIRefreshToken)
 
+	// capture the perform token refresh from the context
+	performTokenRefresh := c.Bool(internal.FlagAPIPerformTokenRefresh)
+
 	// validate the provided configuration
 	err := validate(address, token, velaGitToken, accessToken, refreshToken)
 	if err != nil {
@@ -66,6 +69,8 @@ func Parse(c *cli.Command) (*vela.Client, error) {
 		client.Authentication.SetAccessAndRefreshAuth(accessToken, refreshToken)
 	}
 
+	client.Authentication.SetPerformTokenRefresh(performTokenRefresh)
+
 	// pass the token to the client instance, overrides previous methods
 	if len(token) > 0 {
 		client.Authentication.SetPersonalAccessTokenAuth(token)
diff --git a/internal/internal.go b/internal/internal.go
index 1f74bda4..622ecc9b 100644
--- a/internal/internal.go
+++ b/internal/internal.go
@@ -31,6 +31,8 @@ const (
 	//nolint:gosec // false negative - not a real token
 	FlagAPIRefreshToken = "api.token.refresh"
 
+	FlagAPIPerformTokenRefresh = "api.token.perform-refresh"
+
 	// FlagAPIVersion defines the key for the
 	// flag when setting the API version.
 	FlagAPIVersion = "api.version"