If a user has an environment variable like GH_TOKEN, then zizmor --completions ... fails in a weird way with an unintuitive error message:

$ GH_TOKEN=lol zizmor --completions zsh
error: the argument '--completions <SHELL>' cannot be used with one or more of the other specified arguments

Usage: zizmor [OPTIONS] <INPUTS>...

For more information, try '--help'.

This happens because the --shell option is marked with exclusive:

...which in turn means that zizmor rejects any combination of it with other options, including options that are implicitly supplied via the environment.

In the above example, clap sees the following as equivalent:

GH_TOKEN=lol zizmor --completions zsh
zizmor --gh-token lol --completions zsh

...which is why it fails with the confusing "one or more of the other specified arguments" error.

I'll need to think a bit about how zizmor should handle this: it's (IMO) a bug/surprising behavior within clap itself, but is also potentially something they can't change easily.

A "simple" solution would be to make --completions non-exclusive and then enforce exclusivity at the top of the CLI handling, but this is less declarative and lets people silently pass weird non-operative arguments without a warning/error.

h/t @philpennock for noticing this.