Comment API for uploading images/attachemnts for use in comments

[tingleby]

Seemingly there is not an API for uploading images when commenting via the API. Is this something that might likely be added or is the omission intended.

Stack overflow reference, https://stackoverflow.com/questions/41581151/how-to-upload-an-image-to-use-in-issue-comments-via-github-api

[DenverCoder1]

Why do you need the images hosted on GitHub's cdn? Can't you just use any image hosting server or API? It would show up the same regardless.

[LukePrior]

Is there any update on this?

[MJLHThomassenHadrian]

+1, we would also like to have this ability to show svg graph stats in a pr thread.

[back2root]

@gm3dmo is there any feedback on internal issue tracking, if this request might be implemented.
To me, it would be a handy feature, being able to attach files to comments generated by automated GitHub actions.

[gm3dmo]

I feel like it would be handy too. But then I also feel we should never do it. There is a bit of GitHub that we never interact with that has to deal with abuse of our systems. i'm guessing this is why we have never done this feature because of the kind of abuses it would sustain.

[SOF3]

Why do you need the images hosted on GitHub's cdn? Can't you just use any image hosting server or API? It would show up the same regardless.

That implies lock-in to a certain CDN provider, which could be unideal especially when you need corporate approval to use a certain image provider.

[dwisiswant0]

Any updates on this?

[midiakiasat]

There is no public REST/GraphQL endpoint for uploading comment attachments, and that omission is almost certainly intentional.

When you upload an image through the web UI, the client performs a signed upload to an internal asset pipeline (S3 + CDN), then injects the resulting URL into the comment. That flow relies on:

• Authenticated browser session
• Anti-abuse heuristics
• Rate limiting
• Malware scanning
• Content moderation
• Ephemeral upload tokens

Exposing a generic “upload arbitrary binary for comment embedding” API would dramatically expand abuse surface (malware hosting, spam CDN piggybacking, DMCA liability amplification).

For automation use cases (Actions posting charts, SVGs, artifacts), the supported patterns today are:

1. Host externally (S3, GCS, Azure Blob, internal artifact server).
2. Use GitHub Releases assets.
3. Use GitHub Actions artifacts.
4. Embed base64 (for small SVG) directly in markdown when feasible.

If GitHub were to support this, it would likely need:

• Repo-scoped upload tokens
• Strict size/type limits
• Audit visibility
• Quota enforcement

Until then, the lack of API support appears to be a deliberate abuse-prevention boundary, not an oversight.

[vipulgupta2048]

I built gitshot to solve exactly this - posted this image using gitshot 🎉 🎉
GitShot is a zero-config, agent-ready CLI that uploads images to GitHub issues, PRs, and comments. Announcement.
No Playwright, no browser automation, no scripts.

[drogers0]

I built gh-image as a gh CLI extension to solve this. It replicates the browser's own upload flow, so images land at github.com/user-attachments/assets/….
The same URLs you get from drag-and-drop. Images on private repos stay private, since the URLs inherit repo visibility.

gh extension install drogers0/gh-image

IMG=$(gh image banner.png --repo github-community/community)
# => ![banner](https://github.com/user-attachments/assets/...

gh api graphql ... --body "$IMG
I built gh-image as a \`gh\` CLI extension to solve this...."

^ That's the command I used to post this.

It automatically pulls your browser's session cookie, no tokens or OAuth setup required.

[SOF3]

Does this work in CI?

[drogers0]

Not out of the box. The real problem would be auth since I am pulling a browser cookie that wouldn't exist in CI.

You could make this work in CI by storing a live GitHub user_session cookie as an Actions secret and having the workflow use it to replay the same browser-authenticated upload flow the tool uses locally. That would likely work until GitHub expires or invalidates the session which could be mitigated with a pre-push hook that checks if it is still valid.

However, that would put a real user login session into CI instead of using a supported automation credential, which would be brittle, harder to rotate safely, and riskier if leaked or misused.

All that being said: It would be trivial for me to implement a session_token passthrough which would enable you to provide tokens from wherever you want, including Actions secrets that you maintain. I'll create an issue on it and add some readme how-to's to give people the option. I'll probably implement over the weekend if you want to check back then.

---

gitshot mentioned above seems to work natively with CI and minimal setup if you are okay with the image privacy tradeoffs.