Harden deployment workflow by niik · Pull Request #13780 · cli/cli

niik · 2026-07-02T14:16:09Z

Note, this includes #13492 which replaces the old CLI site PAT with a proper GitHub App.

This PR moves us from using federated environment secrets of macOS signing to using gatewatcher. All production releases will now require gatewatcher approvals.

This also adds a dry-run mode in order to be able to confidently iterate on the deployment workflow itself. While working on this I realised that the macOS installer wasn't getting signed but that appears to have been the case before this work as well.

I've added a timeout to the jobs because I saw a few previous runs that had ran for 6+ hours because the Windows code signing was hanging when using the staging environment.

The release workflow currently checks out github/cli.github.com using a personal access token (SITE_DEPLOY_PAT) owned by an individual maintainer to push generated docs, the index.html version stamp, and RPM/DEB package metadata. Replace that with a short-lived installation token minted at runtime from the new gh-cli-site-deployer GitHub App, owned by the github org and installed only on github/cli.github.com with Contents:write permission. The App's credentials live in the production environment as SITE_DEPLOY_APP_CLIENT_ID and SITE_DEPLOY_APP_PRIVATE_KEY, federated from the github-cli Vault. The token mint step is guarded on inputs.environment == 'production' because non-production environments don't have the App credentials and don't push to the site anyway (the Publish site step is already gated on DO_PUBLISH which requires production). github/cli.github.com is public, so the checkout in non-production falls back to GITHUB_TOKEN for anonymous read access, matching existing behavior. Also update docs/release-process-deep-dive.md to reflect the new flow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ploy

Fix workflow inputs for actions/create-github-app-token by replacing the incorrect app-id key with client-id in multiple deploy job steps. This corrects the parameter name (four occurrences) so the Action receives the expected secret (DEPLOY_APP_ID) and can generate deployment tokens successfully. No other changes to the workflow or action version were made.

Update .github/workflows/deployment.yml to rename the deploy secret from DEPLOY_APP_ID to DEPLOY_APP_CLIENT_ID and adjust all create-github-app-token steps to use the new secret (client-id: ${{ secrets.DEPLOY_APP_CLIENT_ID }}). This clarifies that the secret is the GitHub App Client ID used to generate deploy tokens and keeps the workflow consistent across multiple deploy-token job invocations.

Set `timeout-minutes: 20` for the Linux, macOS, and Windows deployment jobs in the deployment workflow to prevent stalled runs from hanging indefinitely.

Gate signing in sign.ps1 on a new DO_PUBLISH env var, set in the deployment workflow to true only for production. This avoids attempting code signing in non-production environments, consistent with the existing DO_PUBLISH gating used elsewhere in the workflow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication.

Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Interpolating ${{ secrets.* }} directly into the run: script meant a certificate password containing a single quote (or other shell metacharacters) would break quoting and could inject commands. Map the cert and password into the step env and reference them as quoted shell variables instead, and remove the temporary .p12 after import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR hardens the GitHub CLI deployment workflow by introducing a dry-run mode, tightening publishing guards, and improving signing-related setup so production builds can be exercised without externally visible mutations.

Changes:

Add a dry_run workflow input (defaulting to true) and plumb --dry-run through script/release to enable safe end-to-end production build validation without publishing.
Gate signing more explicitly via DO_SIGN_ARTIFACTS for macOS and Windows, and update macOS notarization to use keychain-stored credentials.
Replace the site deploy PAT with a short-lived GitHub App installation token for checking out/pushing to github/cli.github.com.

Show a summary per file

File	Description
`script/sign.ps1`	Adds a `DO_SIGN_ARTIFACTS` guard to skip Windows signing outside production contexts.
`script/sign`	Adds a `DO_SIGN_ARTIFACTS` guard and updates macOS signing/notarization to use keychain-based credentials.
`script/release`	Adds `--dry-run` and passes `dry_run` input when triggering the deployment workflow.
`docs/release-process-deep-dive.md`	Documents dry-run behavior and updated signing/token flows for the deployment pipeline.
`.github/workflows/deployment.yml`	Adds `dry_run` input, timeouts for OS build jobs, publishing guards, and GitHub App token generation for site deployment.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 5
Review effort level: Low

The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

babakks

Thanks for the PR, @niik! 🙏

All seems good. Just some comments for further improvement/simplification.

Also, the deep-dive file seems a bit stale, so please make sure you revise it after any changes (especially if you removed the GPG_SIGN env var).

babakks · 2026-07-03T10:34:13Z

-          APPLE_DEVELOPER_ID: ${{ vars.APPLE_DEVELOPER_ID }}
+          DEVELOPER_ID_CERT_IDENTIFIER: ${{ vars.MAC_APP_SIGNING_IDENTITY }}
+          KEYCHAIN: ${{ runner.temp }}/build.keychain
+          DO_SIGN_ARTIFACTS: ${{ inputs.environment == 'production' }} # Technically redundant given the step guard above, but kept for consistency with the build step.


Nice comment. 🙏

babakks · 2026-07-03T10:57:11Z

+      dry_run:
+        description: "Perform a dry run without publishing artifacts or creating a release"
+        type: boolean
+        default: true


I like this default: true for safety reasons. 👍

Co-authored-by: Babak K. Shandiz <babakks@github.com>

Bring the release deep-dive in line with the final branch state: site steps gated on production, createrepo/reprepro gate on environment instead of GPG_SIGN, dropped github.token fallback, quoted keychain paths, and documented the script/release --dry-run default. Also restore the reprepro env: key that was dropped when GPG_SIGN was removed, which had left the workflow YAML invalid. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@me

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

williammartin and others added 29 commits May 22, 2026 18:52

Merge remote-tracking branch 'origin/wm-site-deploy-app' into niik/de…

da101bf

…ploy

Initial conversion to reusable workflow

7d92f7d

Update deployment.yml

8f2ecd2

Mint a token from GitHub app

9522f6e

Update deployment.yml

4f43068

Add 20-minute timeouts to deploy jobs

f69cf0f

Set `timeout-minutes: 20` for the Linux, macOS, and Windows deployment jobs in the deployment workflow to prevent stalled runs from hanging indefinitely.

Update deployment.yml

57e8cce

Update deployment.yml

d6be637

Update deployment.yml

3b24ab7

Let's try a different approach

637455c

Try this then

0d8d855

Don't see how this could have worked in the past

52669eb

Don't need this any more

ef90664

Mark dry runs in the workflow run name

64840c7

Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Revert to missing var

a79c060

Merge branch 'trunk' into niik/deploy

b5b459a

Copilot AI review requested due to automatic review settings July 2, 2026 14:16

niik requested a review from a team as a code owner July 2, 2026 14:16

niik requested a review from babakks July 2, 2026 14:16

Copilot started reviewing on behalf of niik July 2, 2026 14:16 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread docs/release-process-deep-dive.md

Comment thread docs/release-process-deep-dive.md

Comment thread script/sign

Comment thread script/sign.ps1

Comment thread .github/workflows/deployment.yml

BagToad reviewed Jul 2, 2026

View reviewed changes

Comment thread .github/workflows/deployment.yml Outdated

niik and others added 5 commits July 3, 2026 08:27

Gate publishing the site on the production environment

ed04ff2

Fix pkg installer var in deep-dive code snippet

1b7da92

The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Correct pkg signing NOTE in deep-dive

ee7fd9d

The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Quote $KEYCHAIN in notarytool submit invocation

7822e91

Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge branch 'trunk' into niik/deploy

c62577b

babakks requested changes Jul 3, 2026

View reviewed changes

niik and others added 2 commits July 3, 2026 13:58

Apply suggestions from code review

9cde87c

Co-authored-by: Babak K. Shandiz <babakks@github.com>

niik temporarily deployed to production July 3, 2026 12:07 — with GitHub Actions Inactive

babakks approved these changes Jul 3, 2026

View reviewed changes

niik temporarily deployed to production July 3, 2026 12:14 — with GitHub Actions Inactive

babakks requested a review from BagToad July 3, 2026 12:16

BagToad approved these changes Jul 13, 2026

View reviewed changes

tidy-dev merged commit c14cbaa into trunk Jul 13, 2026
14 checks passed

tidy-dev deleted the niik/deploy branch July 13, 2026 16:06

BrewTestBot mentioned this pull request Jul 31, 2026

gh 2.97.0 Homebrew/homebrew-core#296261

Merged

scottames-github-bot Bot mentioned this pull request Aug 4, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1003

Merged

1 task

Navigation Menu

Uh oh!

Harden deployment workflow - #13780

Harden deployment workflow#13780
tidy-dev merged 36 commits into
trunkfrom
niik/deploy

niik commented Jul 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks Jul 3, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks Jul 3, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

niik commented Jul 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

babakks left a comment •

edited

Loading