Jira CLIJiraCLI

I was repeating the same three moves every morning. Find what I owned and had not finished, move a ticket, leave a comment. Each one meant a browser tab, a filter rebuilt from scratch, and a dropdown to hunt for. Raw curl was not the answer either. Cloud paginates issue search with nextPageToken on /search/jql, while Server and Data Center still use startAt on the classic /search. Agile boards sit on a separate /rest/agile/1.0 API. Writing that once is fine. Writing it into every script is not.

The repository is a monorepo. The binary lives in cli-go/ and the documentation site in web/. Commands sit under cli-go/cmd/, one file per resource group, over a REST layer in cli-go/internal/client/. Configuration resolves in one order: command flags, then environment variables, then the stored profile. Profiles live in ~/.config/jira-cli/config.yaml, XDG aware and written at mode 0600. A file lock wraps every load, modify and save cycle, so a rotated OAuth refresh token survives two processes refreshing at the same moment. internal/adf/ builds the document tree that rich text fields require, and internal/output/ renders table, JSON or YAML behind one formatter interface.

Every group reads as resource then verb, and every list or get command takes -o table, -o json or -o yaml. Users are account IDs under GDPR, so commands accept an email, a display name, @me or id:<accountId> and resolve it before use.

• Every authentication method is supported, not only the Cloud token. OAuth 2.0 3LO, Cloud API token, scoped token, Server personal access token and basic credentials all work. The cost is a login command with five branches, and OAuth needs granular jira-software scopes before board and sprint commands stop failing with 401.
• issue create reuses a recent match. Before writing it looks for an issue by the same user, in the same project, with the same type, summary and parent, created in the last ten minutes. A retrying agent is therefore safe. Two genuinely identical tickets now need --allow-duplicate.
• Mutating POST requests are never retried. PostJSON sends once, and PostJSONRetryable exists only for the search shaped calls. An ambiguous response fails loudly instead of filing a second ticket.
• Release binaries carry no OAuth client secret, so each user registers their own 3LO app. This is the decision I would revisit. A server side authorization broker would remove that setup step without shipping a reusable secret in a public binary.

export JIRA_SITE=https://acme.atlassian.net
export [email protected] JIRA_TOKEN=xxxx
jira status
jira issue search "assignee = currentUser() AND statusCategory != Done" -o json | jq -r '.[].key'
jira issue transitions ABC-142
jira issue transition ABC-142 "In Progress"
jira issue comment ABC-142 --markdown --body "Picking this up"

No auth login step is needed when the environment already carries credentials. status checks reachability, authentication and server info in one call. Transitions are discover then do, because Jira has no set status operation. The CLI lists what the workflow allows, then matches the argument against a transition name or its target status. Informational lines go to stderr, which is what makes the jq above safe. Unattended, JIRA_READ_ONLY=1 JIRA_NO_INPUT=1 blocks writes and removes prompts.

This is an independent wrapper over the REST API. It is not affiliated with Atlassian and unrelated to the official acli. JQL has to be bounded, since search is not a crawler. Agile commands over OAuth need scopes the classic presets do not include, so a token or a personal access token is the shorter path there. Basic authentication against Server can trip CAPTCHA lockout. Building from source needs Go 1.26 or later. It is MIT licensed, ships binaries for macOS, Linux and Windows on amd64 and arm64, and GoReleaser cuts a release on any signed v* tag.