Good point. The current script was developed / is optimised fir a batch operation to deal with some external criteria.

Handling single users can currently be done via the GUI at Special:CentralAuth. This requires temporarily making yourself a local steward, eg via eval.php or createAndPromote. That's how we handle most other privileged non-batch actions. But I agree adding a param, given the script exists already, makes sense.

Things to check: Does it leave a trace akin to how the GUI does? For one offs that may make sense since it's not likely to be part of a larger task with technical reasoning. So logging who/why becomes important to leave in a place where you'd look for it. That could be SAL instead, but for one offs I'm not sure people would know to look there, and for other maintenance scripts like it we generally try to leave a trace as well.

Assuming the GUI works, and given the batch mode, keeping as Low priority.

In T378663#10311223, @Krinkle wrote:

This requires temporarily making yourself a local steward, eg via eval.php or createAndPromote.

Relatedly, T379433: CentralAuth should have a maintenance script for adding a user to a global group (I don't think there's a local group that gives you Special:CentralAuth edit access).
But in any case, I don't think Special:CentralAuth can attach other people's accounts (only unattach).

Things to check: Does it leave a trace akin to how the GUI does?

Does the GUI leave a trace? Unless you mean the Method column on the Special:CentralAuth local accounts table (or RCFeed which both emit to), I don't think it does.
The maintenance script uses the login method, same as autocreation. Not sure if that's good or bad. Maybe we'd want to differentiate but I can also imagine users being annoyed at one of their local accounts being labeled as "force created" or something even though (probably) it's just a normal account that got detached due to some bug. (Filed as T379609: attachAccount.php should not use "login" method.)
(It does log to Logstash but that's probably not what you mean.)

So logging who/why becomes important to leave in a place where you'd look for it.

Yeah adding an event log would be nice. But then the existing script already doesn't do that so I don't think that's related to this task. Filed as T379606: attachAccount.php should create a log entry.

Change #1308643 had a related patch set uploaded (by Shubhita6; author: Shubhita6):

[mediawiki/extensions/CentralAuth@master] Add username parameter to attachAccount.php

https://gerrit.wikimedia.org/r/1308643

I have uploaded a patch to resolve this issue by introducing a --username parameter to attachAccount.php to allow attaching a single user directly from the command line without needing to use a text file.

Patch for review: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1308643

Change #1308643 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Add username parameter to attachAccount.php

https://gerrit.wikimedia.org/r/1308643