[maxffarrell]

Summary

Use REST API version 2026-03-10 for GitHub.com and GitHub Enterprise Cloud, while keeping GitHub Enterprise Server on 2022-11-28. Apply the host-aware policy to stdio and per-request REST clients, scope discovery, and GitHub App installation-token requests.

Why

Fixes #3037.

The pinned go-github/v92 v92.0.0 supports 2026-03-10 but still defaults requests to 2022-11-28. It exposes a per-request WithVersion option, not a public client-wide default-version option; the transport keeps generated service calls consistent without changing every call site. A regression test exercises the SDK's own version guard with 2026-03-10 before checking the final host-specific header. GHES retains the established compatibility version because its supported API versions depend on the GHES release.

What changed

• Centralize API-version constants and apply a host-aware version transport/header helper across the four REST request paths.
• Classify hosts case-insensitively and keep GitHub.com/GHEC lookalike domains on the GHES compatibility version.
• Remove deprecated singular assignee from issue and pull-request search field enums and their tool snapshots; retain plural assignees.
• Merge current main (0663b830582af923e30fb14cb2e10dd3248baa86) without conflicts.
• Add regression coverage for SDK version support, final request headers, resources.core-only rate-limit responses, cloud directory entries with type: submodule, and workflow dispatch returning 200 with run details. Preserve coverage for legacy GHES directory entries and 204 dispatch responses.

Breaking-change audit against GitHub's published 2026-03-10 changes:

• Assignees: mutations and normal issue/PR projections already use assignees; the stale search field enums are corrected here.
• Repository contents: directory entries preserve submodule as returned; individual submodules already have explicit metadata handling. Raw file downloads use the separate raw-content service, not a versioned REST contents response. New/legacy directory shapes pass tool-output coverage.
• Rate limits: no production consumer reads the removed top-level rate payload; SDK decoding uses resources.core, and rate-limit errors use response headers. Added coverage for a response without rate.
• Workflow dispatch: the SDK and handler already accept the new 200 JSON response; no return_run_details parameter is sent. Added coverage alongside existing 204 tests.
• Other changes: no consumers depend on merge_commit_sha, has_downloads, use_squash_pr_title_as_default, beta-media payload fields, gist history/forks, or legacy CVSS fields. Team creation, installation deletion, migration, attestation, removed root/hub fields, organization-secret writes and CodeQL default-setup endpoints are not used by these tools. Repository creation already reports non-success responses generically, including trade-control 451. No additional production-code fixes were needed.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
  Cloud REST calls opt into 2026-03-10; GHES retains 2022-11-28. Issue/PR search field selection no longer advertises singular assignee.
• New tool added

Prompts tested (tool changes only)

• No live prompts were run. Automated MCP calls cover get_file_contents for cloud/GHES submodule directory entries and actions_run_trigger with method=run_workflow for the new response contract; host/version and scope/token paths are covered by mocked HTTP tests.

Security / limits

• No security or limits impact
• Auth / permissions considered
  Existing token host restrictions are unchanged. GitHub App token exchange uses the same host-compatible API-version policy; lookalike domains do not receive the cloud API version.
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR
  Existing tool names are unchanged.

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
script/lint — passed, zero issues.
• Tested locally with ./script/test
script/test — passed, full race-enabled suite, including the new regression cases.

Additional validation:

• go test -race ./pkg/http/transport ./pkg/github ./internal/ghmcp ./internal/githubapp ./pkg/scopes ./pkg/utils -run 'TestAPIVersionTransport|TestParseHostType|TestRequestDepsGetClientPreservesGHESAPIVersion|TestCreateGitHubClientsTokenProvider|TestInstallationTokenSourceSetsAPIVersionForGitHubCloud|TestFetcher_FetchTokenScopes|TestTypedRepositoryOutputs|Test_ActionsRunTrigger_RunWorkflow' -count=1 — passed.
• script/generate-docs — passed; generated documentation unchanged.
• go build ./cmd/github-mcp-server — passed.
• git diff --check — passed.
• No dependency changes beyond merging main; license regeneration was not needed. Live PAT-backed e2e tests and UI builds were not run.

Fork CI previously required maintainer approval. Workflows have not been approved by this update; approve and inspect the new-head checks before merging. The historical failed run on 3b62b709 no longer has retrievable job logs, so its original cause could not be established; current local lint and full race validation pass.

Docs

• Not needed
  Generated documentation was regenerated and is unchanged; the compatibility policy and audit are documented above.
• Updated (README / docs / examples)

[Copilot]

Pull request overview

Migrates REST requests to GitHub API version 2026-03-10.

Changes:

• Centralizes the API-version header and transport.
• Applies the version to REST clients, scope discovery, and GitHub App authentication.
• Adds request-path coverage.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/http/headers/headers.go	Defines the API version.
pkg/http/transport/api_version.go	Adds the versioning transport.
pkg/http/transport/api_version_test.go	Tests transport behavior.
internal/ghmcp/server.go	Versions stdio REST clients.
internal/ghmcp/oauth_test.go	Tests stdio requests.
pkg/github/dependencies.go	Versions per-request clients.
pkg/github/dependencies_test.go	Tests per-request clients.
pkg/scopes/fetcher.go	Updates scope discovery.
pkg/scopes/fetcher_test.go	Tests scope headers.
internal/githubapp/githubapp.go	Updates token requests.
internal/githubapp/githubapp_test.go	Tests token-request headers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pkg/http/transport/api_version.go:11

• Non-blocking: the exported type documentation says this transport only handles cloud requests, but RoundTrip also pins GHES requests to the compatibility version. Include GHES so the documented public behavior matches the implementation.

// APIVersionTransport sets the GitHub REST API version on requests to
// GitHub.com and GitHub Enterprise Cloud.

[SamMorrowDrums]

I am more than happy to move to this, but reviews are a bottleneck for us at the moment so hang tight!

[maxffarrell]

@SamMorrowDrums no worries, appreciate the update!