feat: store Netlify token in native OS secure keychain

.github/workflows/integration-tests.yml

@@ -44,7 +44,10 @@ jobs:
           for node in $node_versions; do
             OS_NODE+=("ubuntu-latest:$node")
           done
-          if [[ "$HEAD_REF" == release-please--* ]]; then
+          # XXX(serhalp): also run the macOS + Windows matrix on this branch so we can verify the new keychain code
+          # paths before merge.
+          # Revert before merging.
+          if [[ "$HEAD_REF" == release-please--* || "$HEAD_REF" == "serhalp/feat/native-token-keychain-storage" ]]; then
             for os in $extra_oses; do
               OS_NODE+=("$os:$primary")
             done

CONTRIBUTING.md

@@ -137,7 +137,8 @@ Every `track()` event includes these properties, which callers can't override:
 - `ci_is_pr`: whether the CI run is for a pull request, on platforms that expose it
 
 Properties with no value are omitted. The `cli:command` event sent after each command also includes `command`, `opts`
-(with sensitive values masked), `args`, `frameworks`, `buildSystem`, `packageManager`, and `monorepo`.
+(with sensitive values masked), `args`, `frameworks`, `buildSystem`, `packageManager`, `monorepo`, and
+`authTokenSource` (`flag`, `env`, `config`, `keychain`, or `not found`).
 
 The test suites set `NETLIFY_TELEMETRY_DISABLED` in their Vitest config, so tests never send real telemetry. Tests that
 spawn the CLI with `extendEnv: false` must pass it explicitly.

docs/commands/login.md

@@ -9,7 +9,8 @@ description: Login to your Netlify account
 
 <!-- AUTO-GENERATED-CONTENT:START (GENERATE_COMMANDS_DOCS) -->
 Login to your Netlify account
-Opens a web browser to acquire an OAuth token.
+Opens a web browser to acquire an OAuth token, which is stored in your OS keychain when available.
+To store it in a plaintext config file instead, set NETLIFY_USE_LEGACY_AUTH_STORAGE=1. This is not recommended.
 
 **Usage**
 

docs/index.md

@@ -235,6 +235,6 @@ A program that runs `netlify login` on a user’s behalf can set `NETLIFY_LOGIN_
 
 ## Telemetry
 
-The CLI sends usage telemetry and error reports to `cli.netlify.com`. Usage telemetry covers which commands run, their flags with sensitive values masked, the CLI and Node.js versions, the detected framework and package manager, the AI agent running the CLI, and the CI platform.
+The CLI sends usage telemetry and error reports to `cli.netlify.com`. Usage telemetry covers which commands run, their flags with sensitive values masked, the CLI and Node.js versions, the detected framework and package manager, the AI agent running the CLI, the CI platform, and where the auth token is stored (never the token itself).
 
 To disable telemetry, run `netlify --telemetry-disable`, or set `NETLIFY_TELEMETRY_DISABLED=1` or `DO_NOT_TRACK=1`. The environment variables also disable error reporting, and are the most reliable option in CI, where the setting saved by `--telemetry-disable` may not persist between runs.

eslint-suppressions.json

@@ -45,7 +45,7 @@
       "count": 7
     },
     "@typescript-eslint/no-unsafe-assignment": {
-      "count": 14
+      "count": 13
     },
     "@typescript-eslint/no-unsafe-call": {
       "count": 2

package.json

@@ -61,7 +61,7 @@
     "@netlify/build-info": "^11.3.1",
     "@netlify/config": "^25.5.1",
     "@netlify/dev": "^5.1.12",
-    "@netlify/dev-utils": "^6.0.4",
+    "@netlify/dev-utils": "https://pkg.pr.new/@netlify/dev-utils@2b6145e",
     "@netlify/edge-bundler": "^16.2.0",
     "@netlify/edge-functions": "^4.0.3",
     "@netlify/edge-functions-bootstrap": "^3.2.0",
@@ -212,6 +212,9 @@
     "verdaccio": "^6.3.2",
     "vitest": "^5.0.0"
   },
+  "overrides": {
+    "@netlify/dev-utils": "$@netlify/dev-utils"
+  },
   "engines": {
     "node": ">=22.13.0"
   },