ErrUnsupportedHost

ErrUnsupportedHost

Error message

An unsupported host was detected. Note that gh attestation does not currently support GHES

What it means

ErrUnsupportedHost is a sentinel in pkg/cmd/attestation/auth/host.go returned by IsHostSupported when ghauth.IsEnterprise(host) is true. The gh attestation command family only works against GitHub.com because artifact attestations and the attestation API are not available on GitHub Enterprise Server (GHES). Any attestation subcommand run while authenticated to an enterprise host fails fast with this error.

Source

Thrown at pkg/cmd/attestation/auth/host.go:9

package auth

import (
	"errors"

	ghauth "github.com/cli/go-gh/v2/pkg/auth"
)

var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")

func IsHostSupported(host string) error {
	if ghauth.IsEnterprise(host) {
		return ErrUnsupportedHost
	}
	return nil
}

View on GitHub (pinned to 0eeec0b92e)

Solutions

Target github.com explicitly: gh attestation verify <artifact> --hostname github.com.
If logged into multiple hosts, set the default: gh auth switch --hostname github.com.
Unset or correct GH_HOST for the command (GH_HOST=github.com gh attestation ...).
If GHES support is required, track the upstream issue; there is no workaround because the API itself is absent on GHES.

Example fix

# before
$ GH_HOST=gh.corp.example.com gh attestation verify artifact.bin
# error: An unsupported host was detected...

# after
$ gh attestation verify artifact.bin --hostname github.com

Defensive patterns

Strategy: validation

Validate before calling

# guard the invocation
if gh auth status 2>&1 | grep -q GHES_HOST_NAME; then
  echo "attestations unsupported on GHES; skipping"; exit 0
fi
gh attestation verify ...

Type guard

if err := auth.IsHostSupported(hostname); err != nil {
    if errors.Is(err, auth.ErrUnsupportedHost) { /* skip or fail with guidance */ }
}

Try / catch

if err := auth.IsHostSupported(host); err != nil {
    if errors.Is(err, auth.ErrUnsupportedHost) {
        return fmt.Errorf("skipping attestation verification: %w", err)
    }
    return err
}

Prevention

Pin --hostname github.com in scripts that run in mixed environments.
Check gh auth status output for enterprise hosts before calling attestation commands.
Gate attestation steps in CI on the GitHub.com host condition.

When it happens

Trigger: Running gh attestation verify/download while the active host (from --hostname or the default auth host) resolves to a GHES instance, e.g. gh.example.com. Also when GH_HOST is set to an enterprise hostname or the repo remote points at GHES.

Common situations: Corporate environment using GHES; GH_HOST env var inherited from another tooling; being logged into both github.com and GHES with GHES active; scripts written for github.com reused in an enterprise context.

Related errors

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/d96f90ec46fca7d8. Report an issue: GitHub.