Equivalent API for github.com/upload/policies/assets for drag-n-drop file upload in PR/Issue comments

[wheelerlaw]

When I drag a file into the comment box in an issue or PR, the front-end app makes a series of requests (beginning with https://github.com/upload/policies/assets) to upload the file to some sort of persistent storage in the back end. I have tried reverse engineering the requests and I can successfully perform the same actions with a little bit of code. But the main limiting factor to using this is the initial request's required use of a cookie. I tried using a PAT but I kept getting 422 responses. Is there an equivalent API in GitHub's public API to upload a file that can be put in a comment?

[mihaigalos]

I've tried variations of the following, with no luck:

curl -v \
  -H "Authorization: Bearer ghp_************************************" \
  --data-binary @/tmp/out.svg \
  -H "Content-Type: multipart/form-data" \
  -H "Referer: https://github.com/mihaigalos/config/pull/2" \
  https://api.github.com/repos/mihaigalos/config/issues/2/comments

I'm essentially trying to post an image to a pull request, the same way I would post via drag-and-drop, but via curl in commandline and using a token.

The above works for simple text, doesn't work for image upload.

Alternatively, since the image is an SVG, I would also be ok to post the content of it and have GitHub render it directly, if possible.

[wheelerlaw]

If you open up your browser dev tools and look at the requests the front-end makes to https://github.com when you drag or upload a file to a comment, you'll see that there several additional requests involved with making this happen. Because the file upload occurs separately and then a link to the file is added as a comment.

[mihaigalos]

Can anybody from GH provide feedback here? Is this missing feature to upload files from i.e. CI or commandline on the roadmap?

[drogers0]

I built gh-image as a gh CLI extension to solve this. It replicates the browser's own upload flow, so images land at github.com/user-attachments/assets/….
The same URLs you get from drag-and-drop. Images on private repos stay private, since the URLs inherit repo visibility.

gh extension install drogers0/gh-image

IMG=$(gh image banner.png --repo github-community/community)
# => ![banner](https://github.com/user-attachments/assets/...

gh api graphql ... --body "$IMG
I built gh-image as a \`gh\` CLI extension to solve this...."

^ That's the command I used to post this.

It automatically pulls your browser's session cookie, no tokens or OAuth setup required.

[drogers0]

I also have all my findings from reverse engineering the github requests here:
documentation/github-image-upload-flow.md