Add dependabot-triage agentic workflow by williammartin · Pull Request #13985 · cli/cli

williammartin · 2026-07-28T10:11:09Z

Description

Dependabot opens a steady stream of pull requests, and each one needs someone to decide whether it is safe to merge. That means reading the version bump, checking CI, and ideally looking at what actually changed upstream. It is repetitive work, and it is easy to let PRs pile up.

This adds a dependabot-triage agentic workflow that does the first pass. Every 6 hours it finds each open PR authored by dependabot[bot], assesses it, and posts a single comment with a merge-confidence level (High / Medium / Low), a rationale, and the key facts a maintainer needs. A human still makes every merge decision.

It is advisory only. The only write it can perform is posting a comment. There is no merge, approve, close, or label capability wired up, so there is nothing to abuse even if the agent is fed something malicious.

It re-comments only when a PR's head commit changes, so a PR sitting untouched for a week gets one comment, not 28.

File	Purpose
`.github/workflows/dependabot-triage.md`	Workflow source
`.github/workflows/dependabot-triage.lock.yml`	Compiled workflow
`.github/workflows/shared/dependabot-triage-security.md`	Read-only toolsets, GitHub App posting identity, comment-only safe-output policy
`.github/skills/dependabot-triager/SKILL.md`	Triage protocol, read from the local checkout

Once this is proven here, they can move to a shared location.

How did you test this change?

The workflow has no pull_request trigger, so it cannot run from this PR. Instead I ran it for real with gh aw trial against cli/go-gh, which has three open Dependabot PRs.

$ gh aw trial ./.github/workflows/dependabot-triage.md \
    --host-repo williammartin/gh-aw-trial \
    --logical-repo cli/go-gh \
    --append "$(cat inlined-skill.md)"

✓ Compiled 1 workflow(s): 0 error(s), 0 warning(s)
i Workflow run started with ID: 30535477254

--append is required here because the skill itself is locked down to only read files in the invoking repo, and the --host-repo and --logical-repo are different.

The full chain ran end to end. Tool calls from the run audit:

1x github-search_pull_requests
9x github-pull_request_read        (get / get_check_runs / get_comments, 3 PRs)
3x github-get_release_by_tag       (upstream validation)
3x safeoutputs-add_comment         (one per PR)

This is what it produced for cli/go-gh#271, reading from the run's agent_output.json:

Merge confidence: Medium

This is a patch bump (0.0.7 → 0.0.8) of thlib/go-timezone-local, but the upstream changes are broader than a typical patch — multiple detection improvements across Windows and Unix, a removed exported helper (tzdata.FTPDownload), and a refreshed Windows-to-IANA mapping. CI passes cleanly.

Key facts

Dependency: github.com/thlib/go-timezone-local

Versions: 0.0.7 → 0.0.8

Update type: semver-patch

Ecosystem: Go modules

Security update: No

CI status: Passing (all checks — lint, test on ubuntu/macos/windows, codeql — completed successfully)

Upstream diff: Changes include Windows native API usage (GetDynamicTimeZoneInformation), suppressed tzutil console window, improved Unix symlink handling, POSIX : prefix support for TZ, and mapping generator hardening. The public tzlocal API is unchanged, but tzdata.FTPDownload was removed. If go-gh does not import that helper directly (likely, as it's a generator utility), this is safe — but the removal warrants a quick confirmation that no code path references it. The scope of changes is larger than semver-patch implies.

Advisory only — this bot never merges, approves, or labels; a maintainer decides.

Assessed at head commit 17f21a41dc3d28ae0531ac65d8a2bf8ca1942c84.

That is the behaviour I was hoping for: it noticed the release removes an exported symbol despite being tagged semver-patch, and rated it Medium for that reason rather than waving through a patch bump.

The other two assessments were comparable. All three carried the correct head SHA. Trial mode stages safe outputs rather than posting them, so nothing was written to cli/go-gh.

Also:

$ gh aw validate
✓ .github/workflows/dependabot-triage.md
✓ .github/workflows/issue-triage.md
✓ Compiled 2 workflow(s): 0 error(s), 0 warning(s)

zizmor --min-severity low is clean on dependabot-triage.lock.yml, issue-triage.lock.yml, and agentics-maintenance.yml.

Key points

Two new restricted secrets, both for GitHub App auth and already configured on this repo:

CLI_TRIAGE_APP_CLIENT_ID
CLI_TRIAGE_APP_PRIVATE_KEY

The App mints a short-lived installation token per run, which is why the workflow's own GITHUB_TOKEN stays read-only (contents: read, pull-requests: read). All GitHub toolsets are read-only, every write goes through safe-outputs, and add-comment is the only output configured. network: defaults grants no general web egress. No new actions are introduced beyond the version bumps below, and all of those are upgrades.

The dedup marker is visible text, not a hidden HTML comment. Each comment ends with:

_Assessed at head commit `<40-char-sha>`._

The obvious design is an HTML comment so readers never see it. That does not work: gh-aw strips HTML comments in two separate places, once when rendering the prompt and again when sanitising comment bodies on the way out. Either one silently breaks dedup and turns this into something that re-comments on every open Dependabot PR every 6 hours. I hit both while trialling. Both source files carry a comment saying not to "tidy" it back.

The agent reads untrusted content by design — Dependabot PR bodies, changelogs, and upstream release notes from third-party repos. Two things contain that, and both need to stay: integrity filtering drops comments from untrusted authors before the agent sees them, and safe-outputs is the only write path. An upstream maintainer can still influence the wording of an assessment via their own release notes; the comment-only output caps that at "posts misleading text". The frontmatter says as much, so nobody adds a capability here without rechecking.

The first commit is unrelated to the feature. Recompiling with the current toolchain touches actions-lock.json, agentics-maintenance.yml, and issue-triage.lock.yml:

Component	From	To
`gh-aw-actions/setup`, `setup-cli`	v0.83.3	v0.83.4
Copilot CLI	1.0.73	1.0.75
awf binary	v0.27.38	v0.27.42
`gh-aw-mcpg` image	v0.4.3	v0.4.6
`github-mcp-server` image	v1.6.0	v1.7.0

This supersedes #13996, which bumped the generated files directly without recompiling and left the tree inconsistent: actions-lock.json and the agentics-maintenance.yml header still said v0.83.1 while the workflows pinned newer SHAs. Recompiling regenerates everything from one toolchain version.

Notes for reviewers

Start with .github/workflows/dependabot-triage.md for the trigger, permissions, and scope, then shared/dependabot-triage-security.md for the toolsets and output policy, then SKILL.md for the triage protocol itself. dependabot-triage.lock.yml is generated by gh aw compile and is not worth reading line by line.

Reviewing commit-by-commit is easiest: the toolchain refresh, the workflow, then three fixes from testing.

The thing I am least sure about: the post → re-read dedup cycle is unverified. Trial mode captures safe outputs instead of performing them, so no comment is ever posted for a later run to find. The read path is exercised (get_comments runs, filters correctly, finds nothing) and the write path produces a correct marker, but the two have never been joined up. Worth watching the first two real runs — the second should post nothing. If it comments again, dedup is broken and the workflow should be disabled until it is fixed.

Related: #13996, superseded by the first commit here.

Authorship and follow-up

Who wrote this:

A human wrote it.
An agent wrote it under close human direction.
An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

@williammartin will read and reply directly.
An agent will draft replies and @username will read them before they are posted.
Nobody has explicitly committed to replying.

Copilot

Pull request overview

This PR adds a new GitHub Agentic Workflows (gh-aw) scheduled workflow to automatically triage open Dependabot PRs and post an advisory “merge confidence” comment, using a shared security/safe-output envelope vendored into this repository.

Changes:

Added the catalog workflow source (dependabot-triage.md) describing the agent’s triage protocol and constraints.
Added the compiled, runnable workflow (dependabot-triage.lock.yml) generated by gh aw v0.83.1.
Vendored a shared “security envelope” import and marked the imports directory as generated/merge-ours.

Show a summary per file

File	Description
.github/workflows/dependabot-triage.md	Catalog workflow source defining triggers, permissions intent, and the agent’s triage instructions.
.github/workflows/dependabot-triage.lock.yml	Compiled GitHub Actions workflow implementing the runtime plumbing (MCP gateway, safe-outputs, jobs, permissions).
.github/aw/imports/desktop/gh-cli-and-desktop-shared-workflows/fbc4b10f5acfdb18978da65b9040d93c19a0b64e/shared_dependabot-triage-security.md	Vendored shared security/safe-outputs envelope (read-only tools + comment-only writes via GitHub App).
.github/aw/imports/.gitattributes	Marks vendored imports as generated and enforces “ours” merge strategy for cached content.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/4 changed files
Comments generated: 3
Review effort level: Low

williammartin · 2026-07-28T12:00:09Z

+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write


This is generated. Can't touch.

Copilot

Review details

Comments suppressed due to low confidence (10)

.github/skills/dependabot-triager/SKILL.md:50

This section uses em dashes in headings and list items; replace them with normal hyphens to match repository documentation style.

### Step 1 — Read the PR head commit SHA

Record the current head commit (`headRefOid`). This SHA is the change key: it
advances whenever Dependabot rebases the PR or bumps to a new version.

.github/skills/dependabot-triager/SKILL.md:64

Avoid em dashes in headings; use a regular hyphen instead.

### Step 3 — Look for your previous triage comment (dedup)

.github/skills/dependabot-triager/SKILL.md:83

Avoid em dashes in headings and prose; use a regular hyphen instead.

### Step 4 — Assess merge confidence

Apply the rubric below, then post exactly one comment (Step 5).

## Confidence rubric

.github/skills/dependabot-triager/SKILL.md:98

These list items use em dashes; replace with normal hyphens to match repository documentation style.

3. **Ecosystem.** GitHub Actions SHA/tag bumps, Go modules, npm, etc. — note the
   ecosystem in the key facts.
4. **Dependabot compatibility score**, when present in the PR body.
5. **Upstream source-code changes** (see below) — the strongest signal.
6. **CI status** from Step 2 — a hard cap (see below).

.github/skills/dependabot-triager/SKILL.md:122

Avoid em dashes in list items; use a regular hyphen instead.

- **failing** CI caps confidence at **Low**, regardless of the dependency
  change. State that CI is failing in the rationale.
- **passing** CI does not by itself grant High — combine it with the other
  signals.

.github/skills/dependabot-triager/SKILL.md:130

The level definition bullets use em dashes; replace with normal hyphens to match repository documentation style.

- **High** — low-risk change (typically patch/minor), CI passing, and the
  upstream diff matches the stated update type with no breaking or suspicious
  changes. Safe for a maintainer to merge with a quick glance.
- **Medium** — some caution warranted: a minor/major bump, notable upstream
  changes, an incomplete compatibility picture, or anything a maintainer should

.github/skills/dependabot-triager/SKILL.md:149

Avoid em dashes in the suggested comment template; use a regular hyphen instead.

   and a one-line note on the upstream diff you reviewed.
4. A closing line: _"Advisory only — this bot never merges, approves, or labels;
   a maintainer decides."_

.github/workflows/shared/dependabot-triage-security.md:41

This section states the only write this workflow can perform is posting a comment, but the compiled workflow currently enables issue-writing operational handlers (noop reports as issue; missing_tool/report_incomplete can create issues) and grants issues: write in .github/workflows/dependabot-triage.lock.yml (e.g. conclusion job). Also, max: 50 is a real cap, so “effectively uncapped” is misleading.

  # The ONLY write this workflow can perform is posting a comment. There is
  # deliberately no merge, approve, or label safe-output, so the triager is
  # advisory only and can never auto-merge a pull request.
  add-comment:
    target: "*"                 # a scheduled run has no single triggering item

.github/workflows/dependabot-triage.md:61

Avoid using an em dash in workflow/skill documentation (use a normal hyphen instead) to match repository style conventions.

- If this run was triggered via `workflow_dispatch` with a `pr_number` input
  (`${{ github.event.inputs.pr_number }}`), triage only that pull request in
  `${{ github.repository }}` — but only if it is open and authored by
  `dependabot[bot]`.

.github/skills/dependabot-triager/SKILL.md:15

Avoid em dashes in documentation text; use a regular hyphen to match repository documentation style.

This issue also appears in the following locations of the same file:

line 46
line 64
line 79
line 94
line 119
...and 2 more

Reviews open **Dependabot** pull requests and posts one merge-confidence comment
per PR. It is **advisory only** — it must **never** merge, approve, close, or
label a PR. A human always makes the merge decision.

Files reviewed: 6/7 changed files
Comments generated: 0 new
Review effort level: Low

Regenerated by `gh aw compile` with gh-aw v0.83.4. Version bumps only, no behavioural change: - gh-aw-actions/setup, setup-cli v0.83.3 -> v0.83.4 - Copilot CLI 1.0.73 -> 1.0.75 - awf binary v0.27.38 -> v0.27.42 - gh-aw-mcpg image v0.4.3 -> v0.4.6 - github-mcp-server image v1.6.0 -> v1.7.0 This supersedes the Dependabot bumps to v0.83.3 in #13996, which edited the generated files directly without recompiling. That left the tree inconsistent: actions-lock.json and the agentics-maintenance.yml header still reported v0.83.1 while the workflows pinned newer SHAs. Recompiling regenerates all outputs from one toolchain version and resolves the drift. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7a164b7-f32d-481d-9a02-4941f1530248

Triages open Dependabot PRs on a schedule and posts an advisory merge-confidence comment. Advisory only: it can never merge, approve, close, or label a pull request. Everything is vendored locally so the workflow has no cross-repository dependency at build or run time: - .github/skills/dependabot-triager/SKILL.md the triage protocol, read from the local checkout - .github/workflows/shared/dependabot-triage-security.md read-only GitHub toolsets, GitHub App posting identity, and a comment-only safe-output policy The upstream catalog version fetches both from a shared repository at runtime. That is deferred until the workflow has been validated here; once it has, these can move to a shared location. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7a164b7-f32d-481d-9a02-4941f1530248

Integrity filtering defaults to `approved` on public repos, and the triage app posts with author_association NONE. Its own prior comments would have been filtered out before the agent saw them, so the head-SHA dedup marker could never match and the workflow would have re-commented on every open Dependabot PR every 6 hours. Trust `cli-triage[bot]` explicitly to fix it. Keeping `approved` also means comments from drive-by accounts never reach the agent, which closes both PR-comment prompt injection and dedup marker forgery. Make the setting explicit so the dependency is visible. Correct the toolsets: `search` is not a toolset in github-mcp-server v1.7.0 (search_pull_requests lives in pull_requests), and `actions` is unnecessary because pull_request_read covers check runs. Replace the `gh pr list` example, which cannot work since the sandbox has no GitHub token, and name the exact MCP calls for CI status, dedup and upstream validation. The hard constraints only prohibited action types, leaving the target unconstrained, so an injected "comment on issue #N" broke no stated rule. Add an explicit scope constraint and lower add-comment max from 50 to 20. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5a53384-7506-4902-a0cc-f309aecdf8b9

A trial run showed the rendered prompt contained "look for the `` marker": the prompt renderer strips HTML comments, so the literal marker written inline in the workflow body reached the agent as an empty string. Dedup could never have worked from the workflow prompt alone. Describe the marker structurally in the workflow body and defer to the skill file for its literal form. The agent reads the skill verbatim from the checkout, so the literal there survives. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5a53384-7506-4902-a0cc-f309aecdf8b9

A trial run against cli/go-gh's real Dependabot PRs showed the agent emitting the correct marker into safeoutputs.jsonl, but agent_output.json had it stripped: the safe-output sanitizer removes HTML comments from comment bodies, by design, to stop hidden instructions being smuggled through. That is a second, independent place HTML comments get erased. The marker would never have been posted, so dedup could never match and the reconciler would re-comment on every open Dependabot PR every 6 hours. Use a visible markdown line carrying the full head SHA instead. It survives both layers, and telling a maintainer which commit was assessed is useful in its own right. Verified end to end: all three markers now reach agent_output.json intact with the correct SHAs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5a53384-7506-4902-a0cc-f309aecdf8b9

Copilot

Review details

Comments suppressed due to low confidence (4)

.github/skills/dependabot-triager/SKILL.md:79

These bullet items use em dashes (—), which the repo style guide forbids in documentation (AGENTS.md:142). Prefer a colon here, and consider replacing the other em dashes throughout this file for consistency.

- **pending** — one or more required checks are still queued or in progress.
- **passing** — all completed checks succeeded (none failed).
- **failing** — at least one check concluded failure/cancelled/timed_out.

.github/skills/dependabot-triager/SKILL.md:202

The suggested closing sentence includes an em dash (—), but the repo style guide forbids em dashes in documentation/output text (AGENTS.md:142). Use a colon or hyphen-minus so downstream comments follow the style guide.

4. A closing line: _"Advisory only — this bot never merges, approves, or labels;

.github/workflows/dependabot-triage.md:82

This line uses an em dash (—), but the repo’s style guide forbids em dashes in code/comments/docs (AGENTS.md:142). Replace with a comma/colon or a normal hyphen.

  `${{ github.repository }}` — but only if it is open and authored by

.github/skills/dependabot-triager/SKILL.md:55

This heading uses an em dash (—); the repo style guide forbids em dashes in documentation (AGENTS.md:142). Use a colon or hyphen-minus instead. (Also applies to the other “Step N — …” headings in this file.)

This issue also appears in the following locations of the same file:

line 77
line 202

### Step 1 — Read the PR head commit SHA

Files reviewed: 6/7 changed files
Comments generated: 0 new
Review effort level: Low

@me

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28

* docs(search): reword raw qualifier examples * Add dry_run flag to gate release publishing Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix macOS signing/notarization keychain and gating Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update deployment.yml * Use workflow_dispatch for deployment flow Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication. * Update deployment.yml * Update deployment.yml * Add draft issue-triage gh-aw workflow (issue-intents starting point) Net-new draft agentic issue-triage labeller for cli/cli built with gh-aw. On a newly opened issue (or manual workflow_dispatch) an agent reads the issue and, only when confident, applies a small allowlist of existing cli/cli labels and posts one short rationale comment via native issue-intents safe outputs. Conservative starting point for discussion, not a final triage configuration. Inert until issue_intents is enabled for the org/repo and a repo admin sets the GH_AW_RUNTIME_FEATURES=issue_intents repository variable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Retune issue-triage stub to the team's documented triage process Rework the draft workflow to follow gh-cli-and-desktop triage-process.md: the objective is to drive an issue toward removing needs-triage by landing the minimal correct end-state labels, surfaced for maintainer approval via issue-intents rationale and confidence rather than silent auto-apply. - Prompt now follows the documented issues decision tree (closeable / duplicate / spam / abuse / off-topic / no-help-wanted-issue, then bug + priority or unable-to-reproduce, then enhancement or more-info-needed). - add-labels allowlist switched to the real cli/cli triage taxonomy: bug, priority-1/2/3, enhancement, more-info-needed, unable-to-reproduce, off-topic, no-help-wanted-issue, invalid, suspected-spam, duplicate. needs-triage is intentionally excluded (the agent must not add it). - max labels 3, add-comment max 1; engine copilot, strict:false, permissions contents:read + issues:read, github toolset [issues], triggers issues:opened + workflow_dispatch, timeout 10m, intents wiring unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Let's try a different approach * Add diagnostic step to list macOS signing identities Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Try this then * Don't see how this could have worked in the past * Don't need this any more * Update release deep-dive doc for macOS signing and dry_run changes Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Forward dry_run to deployment workflow from script/release The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove ref input from deployment workflow The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Pass macOS signing secrets via env instead of inline interpolation Interpolating ${{ secrets.* }} directly into the run: script meant a certificate password containing a single quote (or other shell metacharacters) would break quoting and could inject commands. Map the cert and password into the step env and reference them as quoted shell variables instead, and remove the temporary .p12 after import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Gate macOS signing on DO_SIGN_ARTIFACTS Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Mark dry runs in the workflow run name Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert to missing var * chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2ee...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Support antigravity-cli and antigravity2.0 in gh skill (#13784) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(skills): honor --dir without agent prompt (#13766) * docs: fix duplicated word in primer README (#13677) Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com> * Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> * docs: fix broken install command and link/grammar errors (#13690) Co-authored-by: Patrick Wehbe <patrick.wehbe.applications@gmail.com> * Fix concurrent map writes in codespace port forwarding (#13313) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> * Merge commit from fork * Validate Jupyter Server URLs * Validate Jupyter Server URLs: address reviews * Validate Jupyter Server URLs: address test reviews * Validate Jupyter Server URLs: address test reviews * Gate publishing the site on the production environment * Fix pkg installer var in deep-dive code snippet The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Correct pkg signing NOTE in deep-dive The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Quote $KEYCHAIN in notarytool submit invocation Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump keyring operation timeout from 3s to 60s The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react. Fixes #11005 * Apply suggestions from code review Co-authored-by: Babak K. Shandiz <babakks@github.com> * Update deep-dive doc for final release workflow state Bring the release deep-dive in line with the final branch state: site steps gated on production, createrepo/reprepro gate on environment instead of GPG_SIGN, dropped github.token fallback, quoted keychain paths, and documented the script/release --dry-run default. Also restore the reprepro env: key that was dropped when GPG_SIGN was removed, which had left the workflow YAML invalid. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5) --- updated-dependencies: - dependency-name: charm.land/lipgloss/v2 dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.39.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Bump Go to 1.26.5 * chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Adopt skills-driven triage approach from desktop/desktop Replace the inline decision tree with the shared skills-driven approach used in desktop/desktop. The workflow now fetches triage instructions from desktop/gh-cli-and-desktop-shared-workflows at runtime, uses a GitHub App token for auth, and always suggests labels at medium confidence or lower so all suggestions require maintainer approval. Key changes: - Add repos toolset and allowed-repos for cross-repo skill loading - Add min-integrity: none for reading untrusted issue content - Add github-app safe-output with CLI_TRIAGE_APP secret refs - Replace inline decision tree with 5-step skills-driven flow - Keep duplicate label (cli/cli has one, unlike desktop) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove medium-confidence instruction from Step 5 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use Actions token for Copilot inference instead of PAT Add copilot-requests: write permission so the workflow uses the built-in GitHub Actions token for LLM calls, removing the need for a separate COPILOT_GITHUB_TOKEN secret. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.81.6 to 0.82.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/ba6380cc6e5be5d21677bebe04d52fb48e3abec7...3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1) --- updated-dependencies: - dependency-name: charm.land/bubbles/v2 dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump codeql-action/init and upload-sarif to v4.36.3 All three codeql-action sub-actions (init, analyze, upload-sarif) must be the same version to avoid version mismatch errors. This commit brings init and upload-sarif in line with the analyze bump. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. - [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.2 to 0.82.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a...eb6dc28843ed52402ea15a0ddf6334c40330eab4) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * drop notPanics assertion Signed-off-by: Meredith Lancaster <malancas@github.com> * Add Grok skill host support Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify agent host examples Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.36.2...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.3 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.3 to 0.82.8. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/eb6dc28843ed52402ea15a0ddf6334c40330eab4...99d9d888952ee25fce70c6b3120ca490d7d8da95) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: remove dead CODEOWNERS rule for non-existent pkg/cmd/release/attestation/ * docs(search): note OWNER/REPO format on --repo flag The search --repo flag feeds GitHub's repo:OWNER/REPO qualifier, but its help never showed the expected format, so a full URL silently matched nothing. Add an OWNER/REPO placeholder and format hint to the code, commits, issues, and prs subcommands. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add name-based resolution to gh project item-edit (#13807) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.8.2 to 1.8.4. - [Release notes](https://github.com/yuin/goldmark/releases) - [Commits](https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.4) --- updated-dependencies: - dependency-name: github.com/yuin/goldmark dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Upgrade CodeQL action to version 4.37.1 Updated CodeQL action versions to v4.37.1 for analysis and SARIF upload. * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/attest from 4.1.1 to 4.2.0 Bumps [actions/attest](https://github.com/actions/attest) from 4.1.1 to 4.2.0. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.8 to 0.82.13. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/99d9d888952ee25fce70c6b3120ca490d7d8da95...a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(typos): fix typos in code and documentation * chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.0...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Group CodeQL Dependabot updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6ceb930-bece-4da4-b457-7b142c3a322b * Add --worktree flag to gh pr checkout Support checking out a pull request into a new git worktree via `gh pr checkout <pr> --worktree <path>`. Re-running against the same path fast-forwards the existing worktree (idempotent, matching plain checkout), and checking out a branch already present in another worktree fails with a clear message. Adds a git.Client.Worktrees() helper that parses `git worktree list --porcelain`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 (#13944) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Refine PR checkout worktree flag help * tidying.. * chore(deps): bump nodeselector/setup-apple-codesign from ab275d0f6fb63ef9e20b12b42ea0d567f935723c to 309922bbe4c7277c477635e68d3a1af52d8ad06b (#13878) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Run submodule commands inside the worktree for pr checkout When --worktree is combined with --recurse-submodules, the submodule sync/update commands ran in the main worktree instead of the newly created one, leaving the worktree's submodules uninitialized. Prefix the submodule commands with -C <path> (applied as cmd.Dir, mirroring the fetch handling) so they operate on the correct worktree. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify submodule worktree prefix to inline conditional Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Preserve no-force safety when reusing a worktree for fork PRs The missing-remote existing-worktree path used checkout -B <branch> FETCH_HEAD, which unconditionally reset the branch and could discard local commits even without --force. Switch to existence-aware logic that mirrors the non-worktree paths: when the branch exists, check it out and sync with merge --ff-only (or reset --hard under --force); only create the branch from FETCH_HEAD when it does not exist yet. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Extract authenticatedCommand helper to dedupe -C handling Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Create branch when reusing a worktree with a new --branch name The existing-remote worktree-reuse path assumed the target branch already existed and ran checkout <branch>, which failed when a new --branch name was supplied for an already-existing worktree (e.g. repointing a review worktree at a different PR). Create the branch tracking the remote when it does not exist yet, mirroring the new-worktree path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden worktree submodule prefixing and cover cmd.Dir stripping Use slices.Concat instead of append(prefix, ...) when building the worktree-scoped submodule commands so the shared prefix slice can never alias between the two commands. Add a unit test on authenticatedCommand asserting the leading -C <path> is applied as cmd.Dir and stripped from the args, which the CommandStubber-based tests cannot observe. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add named field columns to gh project item-list (#13823) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(project): present by-name item-edit as the first-class flow (#13927) Signed-off-by: Solaris-star <820622658@qq.com> * Fix duplicated-word typos in comments (#13900) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * Cover detach-reuse, worktree fetch dir, and symlink path resolution Add the coverage gaps surfaced by review: re-running --detach against an existing worktree (the per-worktree FETCH_HEAD path), a cmd.Dir assertion for the worktree-local fetch shape (the real fork/detach production combo, not just submodule), and a symlink-resolving isWorktreeAtPath unit test so worktree reuse keeps working when git reports a canonical path but the user passes a symlinked one. Drop the custom-branch new-worktree case, which duplicated the new-branch path already covered by the existing-worktree custom-branch case. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.0 to 1.19.1. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.13 to 0.82.14. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996...b6d1443e05b8716267fa19425b99aa4f12006b4a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: refresh agentic workflows to stable gh-aw v0.82.14 Upgrade the gh-aw toolchain from v0.81.6 to the latest stable release (v0.82.14, not a pre-release) and recompile the existing issue-triage agentic workflow with `gh aw compile`. The source workflow (issue-triage.md) is unchanged: frontmatter_hash and body_hash are identical, and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated runtime infrastructure: - issue-triage.lock.yml: compiler v0.81.6->v0.82.14, engine 1.0.65->1.0.71, action/container SHA bumps, new OAuth-token/lockdown steps, dropped .crush support, whitespace normalization. - .github/aw/actions-lock.json: setup action v0.81.6->v0.82.14 (+setup-cli). - .gitattributes: gh-aw-managed linguist-generated marker for lock files. - agentics-maintenance.yml: auto-generated companion for the workflow's expiring safe outputs (new in v0.82.14). Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget agentic workflows to pre-release gh-aw v0.83.0 Bump the gh-aw compiler from stable v0.82.14 to pre-release v0.83.0 and recompile the existing issue-triage workflow with `gh aw compile`. Source workflow issue-triage.md is unchanged: frontmatter_hash and body_hash are identical and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated: - issue-triage.lock.yml: compiler v0.82.14->v0.83.0, engine 1.0.71->1.0.73. - agentics-maintenance.yml: regenerated companion, version bumps only. - .github/aw/actions-lock.json: setup/setup-cli action v0.82.14->v0.83.0. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * feat(issue-triage): enable native issue-intent on supported safe outputs Add hyphenated `issue-intent: true` to every configured safe-output tool that supports it under gh-aw v0.83.0. Inspected all configured outputs against the v0.83.0 schema: - add-labels: supported -> issue-intent enabled (native rationale/ confidence/suggest on suggested labels). - add-comment: not an issue-intent-capable output type in v0.83.0 -> left unchanged. No safe-output tools were added or removed. Recompiled the issue-triage workflow with `gh aw compile`; the generated handler config now carries "add_labels":{...,"issue_intent":true}. frontmatter_hash changes as an intentional result of this config edit; body_hash is unchanged. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(issue-triage): scope refresh to issue-triage; drop unrelated maintenance workflow The setup PR (cli/cli#13777) meaningfully updated only the issue-triage workflow, so this refresh must touch issue-triage alone. gh-aw v0.83.0 otherwise auto-generates a repo-wide agentics-maintenance.yml companion workflow, which is out of scope here. Suppress that generation with the documented compiler toggle `.github/workflows/aw.json` {"maintenance": false} and remove the previously generated agentics-maintenance.yml. No repo variables changed and no safe-output tools added. issue-triage is unaffected: its lock, the issue-intent enablement on add-labels, and the v0.83.0 toolchain bump are all preserved. Validated with `gh aw compile` (v0.83.0) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile (maintenance workflow does not regenerate). Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget issue-triage agentic workflow to stable gh-aw v0.83.1 Bump the gh-aw compiler from v0.83.0 to the latest stable release v0.83.1 and recompile the issue-triage workflow. Scope is unchanged: only the issue-triage source/lock plus the directly required shared action lock; the maintenance workflow stays suppressed via aw.json. Source issue-triage.md is unchanged: frontmatter_hash and body_hash are identical, so the add-labels issue-intent enablement and all workflow behavior are preserved. Generated changes only: - issue-triage.lock.yml: compiler v0.83.0->v0.83.1, AWF v0.27.37->v0.27.38. - .github/aw/actions-lock.json: setup action v0.83.0->v0.83.1 (v0.83.1 no longer emits a separate setup-cli entry). Validated with `gh aw compile` (v0.83.1) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile, maintenance workflow not regenerated. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com> * chore: initialize agentic workflow tooling Add the gh-aw agent, dispatcher skill, MCP configuration, Copilot setup workflow, and generated maintenance workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add macos keyring security doc (#13960) * chore(deps): bump github.com/gabriel-vasile/mimetype Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.14 to 1.4.15. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.14...v1.4.15) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-version: 1.4.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.23 to 0.0.24. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.23...v0.0.24) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Replace Windsurf with Devin in skill agents Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 93e6d7e7-48ed-4f1c-9ec2-a182d419e40d * chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Rewrite the pull request template The old template asked for nothing, so a pull request could satisfy it with an empty body. It now asks only for things a reviewer cannot get from the diff: the problem, testing evidence, reviewer guidance, and who is accountable for answering review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address review: restore TODO, flatten detachCmds, guard worktree symlink - Restore the non-fast-forward // TODO breadcrumb in syncBranchCmds - Early-return the non-worktree case in detachCmds to reduce nesting - Reject a --worktree target that is a leaf symlink or non-directory via ensureWorktreePathSafe, with unit coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Detect worktrees via git rev-parse and reject the current worktree - Replace isWorktreeAtPath path-matching with git rev-parse --show-prefix --git-common-dir, letting git resolve symlinks, "..", case, and trailing slashes; delete resolvePath/EvalSymlinks - Reject a --worktree target that resolves to the current worktree, which would otherwise silently switch the current tree's branch and print a nonsensical "cd ." hint Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix worktree toplevel stub to match Windows absolute paths isCurrentWorktree resolves the target with filepath.Abs, which yields a drive-letter path on Windows (e.g. D:\path\to\wt). Match the -C target via a wildcard so the show-toplevel stub matches on all platforms. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Resolve worktree target once instead of re-querying git Collapse the separate worktree-detection helpers (isWorktreeAtPath, isCurrentWorktree, worktreeToplevel, worktreeInfoAtPath, repoCommonDir) into a single resolveWorktreeTarget call made once in checkoutRun. It runs two rev-parse queries (current + target) instead of the previous four and hands the command builders a plain reuseWorktree bool, so they no longer depend on the git client for detection and stay pure. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Trim redundant comments and clarify worktree field names Streamline comments in the worktree checkout path to only the non-obvious rationale, and rename the worktreeTarget fields to isCurrentWorktree and isExistingWorktree so they read clearly without explanation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Drop docs on self-explanatory worktree helpers Match the surrounding codebase, which rarely documents unexported helpers: remove the godoc on worktreeCheckoutCmds and tighten syncBranchCmds, keeping comments only where the rationale is non-obvious. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Return ok bool from revParseFacts to satisfy nilerr resolveWorktreeTarget deliberately proceeds with default flags when a rev-parse fails, which the nilerr linter flagged as returning a nil error after a non-nil one. Have revParseFacts report success via an ok bool instead so the best-effort fallthrough is explicit and lint-clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify current-worktree rejection message Reword the --worktree rejection to avoid the "current worktree" jargon, which is confusing for users who don't think of their main checkout as a worktree. Point at "the repository you're already in" instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Bail out early on unusable --worktree paths Reject --worktree paths that point inside a different repository or nest inside an existing worktree with clear messages, instead of deferring to git (which silently creates a nested worktree or emits a generic error). Fold all rejection cases into resolveWorktreeTarget, which now returns (reuseWorktree bool, error), removing the worktreeTarget struct and simplifying the checkoutRun guard. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Merge pull request #13985 from cli/williammartin-dependabot-triage-dry-run Add dependabot-triage agentic workflow * Fix skill picker label wrapping (#13967) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bf61d1c-810a-4324-874c-665275a607a9 * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.3 to 0.83.4. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/v0.83.3...e89c65e17eb281bbd5ff2ff9e9199a03e96654c7) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add a code review agent skill (#14003) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Babak K. Shandiz <babakks@github.com> * Merge commit from fork * Add terminal-safety mechanisms for untrusted content Introduce the building blocks for keeping untrusted external content (HTTP response bodies and the like) from reaching a terminal as live ANSI escape sequences, while leaving the application's own styled output untouched. - iostreams.Untrusted: a value type that wraps external content. The raw bytes are unexported; String sanitizes and is called automatically by fmt, so the default print path is safe. Raw and RawBytes are the explicit, greppable opt-out for non-terminal uses (disk, the API, hashing), and the type carries its label across JSON decoding so a decoded field stays marked. - iostreams.ContentOut and SetContentSanitization: a sink that sanitizes raw external streams by default and becomes a passthrough when a command opts out, so the sanitization decision is made at the moment of writing. - A CodeQL query (with help text, examples, and a per-category test suite) that flags HTTP response content reaching a terminal writer other than ContentOut without sanitization, treating ContentOut, Untrusted.String, the asciisanitizer wrap, and structured JSON decoding as the accepted resolutions. Wire it into the existing CodeQL workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate gist view to the terminal-safety mechanisms GetRawGistFile now returns iostreams.Untrusted, so the two callers are forced to declare intent. gist view carries the value to the render function and lets the sink decide: the raw dump goes through ContentOut (which honors --allow-escape-sequences) and the markdown path sanitizes its input with String before rendering to Out. gist edit takes Raw, because the content is opened in an editor and sent back to the API and must round-trip verbatim. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate skills to the terminal-safety mechanisms FetchBlob base64-decodes blob content out of the JSON response, so it now returns iostreams.Untrusted and its callers split by intent: skills preview sanitizes for display, while the installer (writes the file to disk) and the frontmatter parsers take Raw to operate on the verbatim bytes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate agent-task streaming logs to the terminal-safety mechanisms The agent-task chat completion chunk's Content and ReasoningText fields arrive over a streaming response, which is not a JSON content type, so the JSON transport sanitizer does not run on them. Type those fields as iostreams.Untrusted so provenance survives the per-line json.Unmarshal; printing them later sanitizes, and presence checks use Empty. This covers a path that flows resp.Body through json.Unmarshal to a printed field, which value dataflow cannot track but the type expresses directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate repo read-file to the terminal-safety mechanisms read-file already refuses to print terminal escape sequences by default (and opts in with --allow-escape-sequences), so it guards its own bytes. Route its two raw writes through ContentOut instead of Out, in passthrough mode, so it uses the one sink the terminal-safety query recognizes while keeping its refuse-by-default behavior. Passthrough is required here: sanitizing would corrupt binary files and strip the escapes that --allow-escape-sequences explicitly allows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate pr diff to the terminal-safety mechanisms pr diff neutralized escape sequences only when stdout was a terminal, leaving piped and redirected output raw. Neutralize by default in all modes instead: the plain and name-only paths write through ContentOut, and the colored path wraps the diff reader in the shared asciisanitizer, since colored output is always terminal-bound. Add --allow-escape-sequences to opt back into raw bytes for the non-colored paths, for example when piping a patch to another program. This also replaces the command's bespoke sanitizer with the shared asciisanitizer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate api response output to the terminal-safety mechanisms gh api copied non-JSON response bodies straight to stdout, so escape sequences in the response reached the terminal unneutralized (JSON bodies are already cleaned by the transport). Route the raw copy through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped so binary payloads are not corrupted, and honors --allow-escape-sequences. Silent, verbose, and slurp writers are left in place. The colorized JSON path now sanitizes its input before jsoncolor adds color, keeping the color intact while removing the raw bytes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate release download stdout to the terminal-safety mechanisms release download --output - copied asset bytes straight to stdout, so escape sequences in an asset reached the terminal unneutralized. Route the stdout write through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped or redirected so binary assets are not corrupted, and honors --allow-escape-sequences. File downloads are unaffected. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate codespace logs to the terminal-safety mechanisms gh codespace logs streams a remote log file over ssh by running cat or tail -f, and the shared ssh helper wires the command's stdout straight to os.Stdout, so the file's bytes reach the terminal without passing through this process and cannot be neutralized. Point the logs command's stdout at ContentOut instead: on a terminal this sanitizes escape sequences and forces the remote output through the process, while piped output stays raw so a follow stream is not buffered and saved logs keep their exact bytes. The shared helper is left untouched so the interactive ssh shell still passes control sequences through. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Build the CodeQL Go database from the shipped build The Go analysis previously relied on autobuild, which walks the whole tree and extracts the nested module under .github/codeql/queries' test fixtures as well as the main module. Both declare the same module path with their own pkg/iostreams, so the analyzer conflated the two and reported a flow through unrelated code. Switch the Go job to build-mode: manual and build with make, the same command the integration tests use. Extraction is then scoped to the packages the released gh binary compiles, which excludes the separate fixtures module, so the spurious finding is gone and the analyzed code matches what we ship. The actions job builds nothing, so it is marked build-mode: none. The query's own test suite is unchanged and still runs each fixture directory in isolation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Match guarded-content errors by kind in tests Replace the binary-error boolean with a `wantErrAs` field so the table matches typed errors with errors.As and sentinels with errors.Is, mirroring how callers detect them. Any future typed error slots in without a new field. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Clarify that Untrusted wraps string content Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Convert Untrusted tests to testify assertions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Collapse guarded content cases into the table test Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Match binary terminal errors with errors.AsType Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Reuse the raw gist content when writing it out Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cover the non-truncated gist file path Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Document the refusal guarantee on CopyGuardedContent Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clear stale content when unmarshaling JSON null Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Merge commit from fork * feat(safeurl): add SafeURL package and CodeQL enforcement query Introduce internal/safeurl, which builds HTTP request URLs from variable components that are percent-encoded when rendered, so user or server controlled values cannot break the path or change which resource is addressed. It provides the SafeURL interface, the MutableSafeURL and ImmutableSafeURL implementations, the JoinPath and JoinPathWithHostPrefix builders, and NewImmutableSafeURL for entrusting already-formed URLs. Because percent-encoding leaves a component that is exactly ".." intact as a real path segment, JoinPath and JoinPathWithHostPrefix reject any such component and return an error, which callers bubble up to the command level. Also add a CodeQL query that flags any HTTP request URL argument that is not literally the result of a safeurl.SafeURL.String call. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(api): route REST paths through SafeURL Build the hand-written REST paths in the shared API layer with safeurl so their variable components are escaped. CreateRepoTransformToV4 now takes a safeurl.SafeURL path instead of a string. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(repo): build REST paths with SafeURL Escape the variable components of the repo command REST paths. The new read-file command builds its Contents API URL with safeurl, and the repo create and edit commands pass a safeurl.SafeURL to CreateRepoTransformToV4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(run): build REST paths with SafeURL Escape the variable components of the run command REST paths. GetJobs no longer mutates the Run; it takes an entrusted jobs URL and a run id and returns the jobs, so its callers assign them explicitly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(release): build REST paths with SafeURL Escape the variable components of the release command REST paths. The upload and delete-asset pipeline threads a safeurl.SafeURL through, so the asset upload URL and AssetForUpload.ExistingURL are carried as SafeURL. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(codespace): build REST paths with SafeURL Escape the variable components of the codespace command REST paths. The NWO validation helper moves out of safeurl into the codespace package, where it is the only remaining caller. Co-authored-by…

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

williammartin requested a review from Copilot July 28, 2026 10:18

williammartin force-pushed the williammartin-dependabot-triage-dry-run branch from 29c8195 to 911e56c Compare July 28, 2026 10:19

williammartin marked this pull request as ready for review July 28, 2026 10:19

williammartin requested a review from a team as a code owner July 28, 2026 10:19

williammartin requested a review from BagToad July 28, 2026 10:19

Copilot started reviewing on behalf of williammartin July 28, 2026 10:19 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

williammartin force-pushed the williammartin-dependabot-triage-dry-run branch from 911e56c to ef8f688 Compare July 28, 2026 10:47

williammartin requested a review from Copilot July 28, 2026 12:00

Copilot started reviewing on behalf of williammartin July 28, 2026 12:00 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

williammartin and others added 2 commits July 30, 2026 11:09

williammartin force-pushed the williammartin-dependabot-triage-dry-run branch from ef8f688 to e15767d Compare July 30, 2026 09:10

williammartin and others added 3 commits July 30, 2026 11:40

williammartin requested a review from Copilot July 30, 2026 11:11

Copilot started reviewing on behalf of williammartin July 30, 2026 11:11 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

sergiou87 approved these changes Jul 30, 2026

View reviewed changes

williammartin merged commit 11a5ef8 into trunk Jul 30, 2026
38 checks passed

williammartin deleted the williammartin-dependabot-triage-dry-run branch July 30, 2026 11:46

tidy-dev mentioned this pull request Jul 30, 2026

Add dependabot-triage agentic workflow desktop/desktop#22628

Closed

BrewTestBot mentioned this pull request Jul 31, 2026

gh 2.97.0 Homebrew/homebrew-core#296261

Merged

scottames-github-bot Bot mentioned this pull request Aug 4, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1003

Merged

1 task

Navigation Menu

Uh oh!

Add dependabot-triage agentic workflow - #13985

Add dependabot-triage agentic workflow#13985
williammartin merged 5 commits into
trunkfrom
williammartin-dependabot-triage-dry-run

williammartin commented Jul 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

williammartin Jul 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

williammartin commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How did you test this change?

Key points

Notes for reviewers

Authorship and follow-up

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

williammartin Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

williammartin commented Jul 28, 2026 •

edited

Loading