Handle top-level array REST request bodies in gh CLI code samples (#62191)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: heiskr

src/rest/components/get-rest-code-samples.ts

@@ -200,18 +200,16 @@ export function getGHExample(
   // and the type is a string.
   const { bodyParameters } = codeSample.request
   if (bodyParameters) {
-    // There should not be a case in a REST API where only an array is sent
-    if (Array.isArray(bodyParameters)) {
-      throw new Error('Array of arrays found in body parameters')
-    }
-
     if (typeof bodyParameters === 'object') {
       // Special handling for gist endpoints - use --input for nested file structures
       const isGistEndpoint =
+        !Array.isArray(bodyParameters) &&
         operation.requestPath.includes('/gists') &&
         (operation.title === 'Create a gist' || operation.title === 'Update a gist')
 
-      // For complex objects with arrays, use --input with JSON
+      // For top-level arrays or complex objects with arrays, use --input with JSON.
+      // The gh CLI -f/-F flags can't represent a request body that is itself an array,
+      // so we fall back to piping the JSON body via --input.
       const hasArrays = hasNestedArrays(bodyParameters as NestedObjectParameter)
       if (hasArrays || isGistEndpoint) {
         const jsonBody = JSON.stringify(
@@ -233,7 +231,7 @@ export function getGHExample(
         requestBodyParams += handleObjectParameter(bodyParameters as NestedObjectParameter)
       }
     } else {
-      requestBodyParams += handleSingleParameter('', bodyParameters)
+      requestBodyParams += handleSingleParameter('', bodyParameters as NestedObjectParameter)
     }
   }
 
@@ -388,11 +386,13 @@ export function getJSExample(
   if (codeSample.request) {
     Object.assign(parameters, codeSample.request.parameters)
     // Most of the time the example body parameters have a name and value
-    // and are included in an object. But, some cases are a single value
-    // and the type is a string.
+    // and are included in an object. But some cases are a single scalar value
+    // or a top-level JSON array, both of which Octokit sends as the raw
+    // request body via the `data` option.
     if (
       codeSample.request.bodyParameters &&
-      typeof codeSample.request.bodyParameters !== 'object'
+      (typeof codeSample.request.bodyParameters !== 'object' ||
+        Array.isArray(codeSample.request.bodyParameters))
     ) {
       parameters.data = codeSample.request.bodyParameters
     } else {

src/rest/components/types.ts

@@ -51,7 +51,12 @@ export interface CodeSample {
   request: {
     contentType: string
     acceptHeader: string
-    bodyParameters: Record<string, string | Array<string | { [key: string]: string }>>
+    // Most request bodies are an object of named parameters, but some REST
+    // operations take a single scalar value or a top-level JSON array.
+    bodyParameters:
+      | Record<string, string | Array<string | { [key: string]: string }>>
+      | Array<unknown>
+      | string
     parameters: Record<string, string>
     description: string
   }

src/rest/tests/get-rest-code-samples-2.ts

@@ -447,6 +447,36 @@ describe('REST code samples authentication header handling', () => {
       expect(result).toContain("await octokit.request('POST /credentials/revo")
       expect(result).toContain("'X-GitHub-Api-Version': '2022-11-28'")
     })
+
+    test('sends a top-level array body via the data option', () => {
+      const arrayBodyCodeSample: CodeSample = {
+        request: {
+          contentType: 'application/json',
+          description: 'Example',
+          acceptHeader: 'application/vnd.github+json',
+          bodyParameters: [{ id: 'MVS-2026-001', summary: 'Example summary' }],
+          parameters: {},
+        },
+        response: {
+          statusCode: '200',
+          contentType: 'application/json',
+          description: 'Response',
+          example: {},
+        },
+      }
+
+      const result = getJSExample(
+        standardOperation,
+        arrayBodyCodeSample,
+        'free-pro-team@latest',
+        mockVersions,
+      )
+
+      // The array must be nested under `data`, not spread as numeric keys ("0", "1").
+      expect(result).toContain('data: [')
+      expect(result).toContain("id: 'MVS-2026-001'")
+      expect(result).not.toMatch(/["']0["']\s*:/)
+    })
   })
 
   describe('edge cases and special scenarios', () => {

src/rest/tests/get-rest-code-samples.ts

@@ -229,4 +229,73 @@ describe('getGHExample - GitHub CLI code generation', () => {
     expect(result).toContain('"tag2"')
     expect(result).toContain('"tag3"')
   })
+
+  test('handles a top-level array body via --input', () => {
+    const operation: Operation = {
+      serverUrl: 'https://api.github.com',
+      verb: 'post',
+      requestPath: '/enterprises/{enterprise}/innersource-vulnerabilities/sync',
+      title: 'Sync InnerSource vulnerabilities',
+      descriptionHTML: '<p>Sync vulnerabilities</p>',
+      previews: [],
+      statusCodes: [],
+      bodyParameters: [],
+      category: 'enterprise-admin',
+      subcategory: 'security-advisories',
+      parameters: [
+        {
+          name: 'enterprise',
+          in: 'path',
+          required: true,
+          description: 'The enterprise slug',
+          schema: { type: 'string' },
+        },
+      ],
+      codeExamples: [],
+      progAccess: {
+        permissions: [],
+        userToServerRest: true,
+        serverToServer: true,
+        fineGrainedPat: true,
+      },
+    }
+
+    const codeSample: CodeSample = {
+      request: {
+        contentType: 'application/json',
+        description: 'Example',
+        acceptHeader: 'application/vnd.github+json',
+        bodyParameters: [
+          {
+            id: 'MVS-2026-001',
+            summary: 'Example vulnerability summary',
+            aliases: ['GHSA-xxxx-xxxx-xxxx'],
+          },
+        ],
+        parameters: { enterprise: 'octo-enterprise' },
+      },
+      response: {
+        statusCode: '200',
+        contentType: 'application/json',
+        description: 'Response',
+        example: {},
+      },
+    }
+
+    const currentVersion = 'enterprise-cloud@latest'
+    const allVersions: Record<string, VersionItem> = {
+      'enterprise-cloud@latest': {
+        version: 'enterprise-cloud@latest',
+        versionTitle: 'Enterprise Cloud',
+        apiVersions: ['2022-11-28'],
+        latestApiVersion: '2022-11-28',
+      },
+    }
+
+    const result = getGHExample(operation, codeSample, currentVersion, allVersions)
+
+    expect(result).toContain('--input - <<<')
+    expect(result).toContain('"MVS-2026-001"')
+    expect(result).toContain('"GHSA-xxxx-xxxx-xxxx"')
+  })
 })