Add a code review agent skill by BagToad · Pull Request #14003 · cli/cli

BagToad · 2026-07-28T21:50:41Z

Description

This adds a cli-code-reviewer agent skill that captures how an agent can review gh pull requests, and reference it in AGENTS.md.

This will cause our CCR workflows to read this skill automatically and follow the methodology in that skill for discovery of problems.

Review Methodology

The skill directs the reviewer to work in this order:

Understand intent first. Read the linked issue, the PR description, and prior discussion to learn what the change is for, then verify each claim against the code so the review posts no false positives.
Hold the diff to AGENTS.md. Those conventions are authoritative.
Sort every finding into one of three buckets: a blocking Requirement, non-blocking Commentary, or a Nit.
Judge breaking changes based on our classification: who consumes the behavior. Interactive output is for a human and may change, while the non-interactive surface that scripts parse is a contract, so changing it is blocking.
Review the shape of the PR too: keep it to one concern and flag commits that are hard to follow.
Report findings grouped by severity, each with a severity label and, where it helps, links to the issues or pull requests that give context.

Key Technical Points

The skill lives under .github/skills/ instead of at the repo root's skills folder. This is because this isn't a published skill. It's meant to be consumed by agents working in this repo only, like agents that have checked out this repo or CCR/CCA
The skill defers to AGENTS.md for code conventions rather than restating them
AGENTS.md gains a short Code Review section that points back at the skill, hinting at CCR to pick it up
This PR also introduces a few more codebase convention notes to AGENTS.md

Add a reviewer charter at .github/skills/cli-code-reviewer/SKILL.md and point AGENTS.md at it. Expand AGENTS.md with the two-table test pattern, feature-detection and round-trip guidance. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds an internal agent skill for reviewing GitHub CLI (gh) pull requests and updates AGENTS.md to both expand convention guidance and reference the new skill, so CCR/agent workflows can pick it up from the repo.

Changes:

Adds a new .github/skills/cli-code-reviewer/SKILL.md skill document describing review methodology and reporting structure.
Expands AGENTS.md with additional testing guidance and feature-detection guidance.
Adds a Code Review section in AGENTS.md linking to the new skill.

Show a summary per file

File	Description
AGENTS.md	Adds/extends repository conventions (testing patterns, feature detection guidance) and links to the new review skill.
.github/skills/cli-code-reviewer/SKILL.md	Introduces an internal skill doc describing how to review PRs against `AGENTS.md`.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 3
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

babakks

LGTM! Thanks for putting this together! 🍻

Co-authored-by: Babak K. Shandiz <babakks@github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>

@me

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28

* docs(search): reword raw qualifier examples * Add dry_run flag to gate release publishing Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix macOS signing/notarization keychain and gating Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update deployment.yml * Use workflow_dispatch for deployment flow Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication. * Update deployment.yml * Update deployment.yml * Add draft issue-triage gh-aw workflow (issue-intents starting point) Net-new draft agentic issue-triage labeller for cli/cli built with gh-aw. On a newly opened issue (or manual workflow_dispatch) an agent reads the issue and, only when confident, applies a small allowlist of existing cli/cli labels and posts one short rationale comment via native issue-intents safe outputs. Conservative starting point for discussion, not a final triage configuration. Inert until issue_intents is enabled for the org/repo and a repo admin sets the GH_AW_RUNTIME_FEATURES=issue_intents repository variable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Retune issue-triage stub to the team's documented triage process Rework the draft workflow to follow gh-cli-and-desktop triage-process.md: the objective is to drive an issue toward removing needs-triage by landing the minimal correct end-state labels, surfaced for maintainer approval via issue-intents rationale and confidence rather than silent auto-apply. - Prompt now follows the documented issues decision tree (closeable / duplicate / spam / abuse / off-topic / no-help-wanted-issue, then bug + priority or unable-to-reproduce, then enhancement or more-info-needed). - add-labels allowlist switched to the real cli/cli triage taxonomy: bug, priority-1/2/3, enhancement, more-info-needed, unable-to-reproduce, off-topic, no-help-wanted-issue, invalid, suspected-spam, duplicate. needs-triage is intentionally excluded (the agent must not add it). - max labels 3, add-comment max 1; engine copilot, strict:false, permissions contents:read + issues:read, github toolset [issues], triggers issues:opened + workflow_dispatch, timeout 10m, intents wiring unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Let's try a different approach * Add diagnostic step to list macOS signing identities Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Try this then * Don't see how this could have worked in the past * Don't need this any more * Update release deep-dive doc for macOS signing and dry_run changes Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Forward dry_run to deployment workflow from script/release The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove ref input from deployment workflow The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Pass macOS signing secrets via env instead of inline interpolation Interpolating ${{ secrets.* }} directly into the run: script meant a certificate password containing a single quote (or other shell metacharacters) would break quoting and could inject commands. Map the cert and password into the step env and reference them as quoted shell variables instead, and remove the temporary .p12 after import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Gate macOS signing on DO_SIGN_ARTIFACTS Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Mark dry runs in the workflow run name Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert to missing var * chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2ee...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Support antigravity-cli and antigravity2.0 in gh skill (#13784) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(skills): honor --dir without agent prompt (#13766) * docs: fix duplicated word in primer README (#13677) Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com> * Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> * docs: fix broken install command and link/grammar errors (#13690) Co-authored-by: Patrick Wehbe <patrick.wehbe.applications@gmail.com> * Fix concurrent map writes in codespace port forwarding (#13313) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> * Merge commit from fork * Validate Jupyter Server URLs * Validate Jupyter Server URLs: address reviews * Validate Jupyter Server URLs: address test reviews * Validate Jupyter Server URLs: address test reviews * Gate publishing the site on the production environment * Fix pkg installer var in deep-dive code snippet The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Correct pkg signing NOTE in deep-dive The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Quote $KEYCHAIN in notarytool submit invocation Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump keyring operation timeout from 3s to 60s The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react. Fixes #11005 * Apply suggestions from code review Co-authored-by: Babak K. Shandiz <babakks@github.com> * Update deep-dive doc for final release workflow state Bring the release deep-dive in line with the final branch state: site steps gated on production, createrepo/reprepro gate on environment instead of GPG_SIGN, dropped github.token fallback, quoted keychain paths, and documented the script/release --dry-run default. Also restore the reprepro env: key that was dropped when GPG_SIGN was removed, which had left the workflow YAML invalid. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5) --- updated-dependencies: - dependency-name: charm.land/lipgloss/v2 dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.39.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Bump Go to 1.26.5 * chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Adopt skills-driven triage approach from desktop/desktop Replace the inline decision tree with the shared skills-driven approach used in desktop/desktop. The workflow now fetches triage instructions from desktop/gh-cli-and-desktop-shared-workflows at runtime, uses a GitHub App token for auth, and always suggests labels at medium confidence or lower so all suggestions require maintainer approval. Key changes: - Add repos toolset and allowed-repos for cross-repo skill loading - Add min-integrity: none for reading untrusted issue content - Add github-app safe-output with CLI_TRIAGE_APP secret refs - Replace inline decision tree with 5-step skills-driven flow - Keep duplicate label (cli/cli has one, unlike desktop) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove medium-confidence instruction from Step 5 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use Actions token for Copilot inference instead of PAT Add copilot-requests: write permission so the workflow uses the built-in GitHub Actions token for LLM calls, removing the need for a separate COPILOT_GITHUB_TOKEN secret. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.81.6 to 0.82.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/ba6380cc6e5be5d21677bebe04d52fb48e3abec7...3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1) --- updated-dependencies: - dependency-name: charm.land/bubbles/v2 dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump codeql-action/init and upload-sarif to v4.36.3 All three codeql-action sub-actions (init, analyze, upload-sarif) must be the same version to avoid version mismatch errors. This commit brings init and upload-sarif in line with the analyze bump. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. - [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.2 to 0.82.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a...eb6dc28843ed52402ea15a0ddf6334c40330eab4) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * drop notPanics assertion Signed-off-by: Meredith Lancaster <malancas@github.com> * Add Grok skill host support Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify agent host examples Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.36.2...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.3 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.3 to 0.82.8. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/eb6dc28843ed52402ea15a0ddf6334c40330eab4...99d9d888952ee25fce70c6b3120ca490d7d8da95) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: remove dead CODEOWNERS rule for non-existent pkg/cmd/release/attestation/ * docs(search): note OWNER/REPO format on --repo flag The search --repo flag feeds GitHub's repo:OWNER/REPO qualifier, but its help never showed the expected format, so a full URL silently matched nothing. Add an OWNER/REPO placeholder and format hint to the code, commits, issues, and prs subcommands. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add name-based resolution to gh project item-edit (#13807) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.8.2 to 1.8.4. - [Release notes](https://github.com/yuin/goldmark/releases) - [Commits](https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.4) --- updated-dependencies: - dependency-name: github.com/yuin/goldmark dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Upgrade CodeQL action to version 4.37.1 Updated CodeQL action versions to v4.37.1 for analysis and SARIF upload. * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/attest from 4.1.1 to 4.2.0 Bumps [actions/attest](https://github.com/actions/attest) from 4.1.1 to 4.2.0. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.8 to 0.82.13. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/99d9d888952ee25fce70c6b3120ca490d7d8da95...a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(typos): fix typos in code and documentation * chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.0...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Group CodeQL Dependabot updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6ceb930-bece-4da4-b457-7b142c3a322b * Add --worktree flag to gh pr checkout Support checking out a pull request into a new git worktree via `gh pr checkout <pr> --worktree <path>`. Re-running against the same path fast-forwards the existing worktree (idempotent, matching plain checkout), and checking out a branch already present in another worktree fails with a clear message. Adds a git.Client.Worktrees() helper that parses `git worktree list --porcelain`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 (#13944) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Refine PR checkout worktree flag help * tidying.. * chore(deps): bump nodeselector/setup-apple-codesign from ab275d0f6fb63ef9e20b12b42ea0d567f935723c to 309922bbe4c7277c477635e68d3a1af52d8ad06b (#13878) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Run submodule commands inside the worktree for pr checkout When --worktree is combined with --recurse-submodules, the submodule sync/update commands ran in the main worktree instead of the newly created one, leaving the worktree's submodules uninitialized. Prefix the submodule commands with -C <path> (applied as cmd.Dir, mirroring the fetch handling) so they operate on the correct worktree. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify submodule worktree prefix to inline conditional Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Preserve no-force safety when reusing a worktree for fork PRs The missing-remote existing-worktree path used checkout -B <branch> FETCH_HEAD, which unconditionally reset the branch and could discard local commits even without --force. Switch to existence-aware logic that mirrors the non-worktree paths: when the branch exists, check it out and sync with merge --ff-only (or reset --hard under --force); only create the branch from FETCH_HEAD when it does not exist yet. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Extract authenticatedCommand helper to dedupe -C handling Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Create branch when reusing a worktree with a new --branch name The existing-remote worktree-reuse path assumed the target branch already existed and ran checkout <branch>, which failed when a new --branch name was supplied for an already-existing worktree (e.g. repointing a review worktree at a different PR). Create the branch tracking the remote when it does not exist yet, mirroring the new-worktree path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden worktree submodule prefixing and cover cmd.Dir stripping Use slices.Concat instead of append(prefix, ...) when building the worktree-scoped submodule commands so the shared prefix slice can never alias between the two commands. Add a unit test on authenticatedCommand asserting the leading -C <path> is applied as cmd.Dir and stripped from the args, which the CommandStubber-based tests cannot observe. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add named field columns to gh project item-list (#13823) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs(project): present by-name item-edit as the first-class flow (#13927) Signed-off-by: Solaris-star <820622658@qq.com> * Fix duplicated-word typos in comments (#13900) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * Cover detach-reuse, worktree fetch dir, and symlink path resolution Add the coverage gaps surfaced by review: re-running --detach against an existing worktree (the per-worktree FETCH_HEAD path), a cmd.Dir assertion for the worktree-local fetch shape (the real fork/detach production combo, not just submodule), and a symlink-resolving isWorktreeAtPath unit test so worktree reuse keeps working when git reports a canonical path but the user passes a symlinked one. Drop the custom-branch new-worktree case, which duplicated the new-branch path already covered by the existing-worktree custom-branch case. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.0 to 1.19.1. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.13 to 0.82.14. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996...b6d1443e05b8716267fa19425b99aa4f12006b4a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: refresh agentic workflows to stable gh-aw v0.82.14 Upgrade the gh-aw toolchain from v0.81.6 to the latest stable release (v0.82.14, not a pre-release) and recompile the existing issue-triage agentic workflow with `gh aw compile`. The source workflow (issue-triage.md) is unchanged: frontmatter_hash and body_hash are identical, and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated runtime infrastructure: - issue-triage.lock.yml: compiler v0.81.6->v0.82.14, engine 1.0.65->1.0.71, action/container SHA bumps, new OAuth-token/lockdown steps, dropped .crush support, whitespace normalization. - .github/aw/actions-lock.json: setup action v0.81.6->v0.82.14 (+setup-cli). - .gitattributes: gh-aw-managed linguist-generated marker for lock files. - agentics-maintenance.yml: auto-generated companion for the workflow's expiring safe outputs (new in v0.82.14). Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget agentic workflows to pre-release gh-aw v0.83.0 Bump the gh-aw compiler from stable v0.82.14 to pre-release v0.83.0 and recompile the existing issue-triage workflow with `gh aw compile`. Source workflow issue-triage.md is unchanged: frontmatter_hash and body_hash are identical and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated: - issue-triage.lock.yml: compiler v0.82.14->v0.83.0, engine 1.0.71->1.0.73. - agentics-maintenance.yml: regenerated companion, version bumps only. - .github/aw/actions-lock.json: setup/setup-cli action v0.82.14->v0.83.0. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * feat(issue-triage): enable native issue-intent on supported safe outputs Add hyphenated `issue-intent: true` to every configured safe-output tool that supports it under gh-aw v0.83.0. Inspected all configured outputs against the v0.83.0 schema: - add-labels: supported -> issue-intent enabled (native rationale/ confidence/suggest on suggested labels). - add-comment: not an issue-intent-capable output type in v0.83.0 -> left unchanged. No safe-output tools were added or removed. Recompiled the issue-triage workflow with `gh aw compile`; the generated handler config now carries "add_labels":{...,"issue_intent":true}. frontmatter_hash changes as an intentional result of this config edit; body_hash is unchanged. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(issue-triage): scope refresh to issue-triage; drop unrelated maintenance workflow The setup PR (cli/cli#13777) meaningfully updated only the issue-triage workflow, so this refresh must touch issue-triage alone. gh-aw v0.83.0 otherwise auto-generates a repo-wide agentics-maintenance.yml companion workflow, which is out of scope here. Suppress that generation with the documented compiler toggle `.github/workflows/aw.json` {"maintenance": false} and remove the previously generated agentics-maintenance.yml. No repo variables changed and no safe-output tools added. issue-triage is unaffected: its lock, the issue-intent enablement on add-labels, and the v0.83.0 toolchain bump are all preserved. Validated with `gh aw compile` (v0.83.0) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile (maintenance workflow does not regenerate). Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget issue-triage agentic workflow to stable gh-aw v0.83.1 Bump the gh-aw compiler from v0.83.0 to the latest stable release v0.83.1 and recompile the issue-triage workflow. Scope is unchanged: only the issue-triage source/lock plus the directly required shared action lock; the maintenance workflow stays suppressed via aw.json. Source issue-triage.md is unchanged: frontmatter_hash and body_hash are identical, so the add-labels issue-intent enablement and all workflow behavior are preserved. Generated changes only: - issue-triage.lock.yml: compiler v0.83.0->v0.83.1, AWF v0.27.37->v0.27.38. - .github/aw/actions-lock.json: setup action v0.83.0->v0.83.1 (v0.83.1 no longer emits a separate setup-cli entry). Validated with `gh aw compile` (v0.83.1) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile, maintenance workflow not regenerated. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com> * chore: initialize agentic workflow tooling Add the gh-aw agent, dispatcher skill, MCP configuration, Copilot setup workflow, and generated maintenance workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add macos keyring security doc (#13960) * chore(deps): bump github.com/gabriel-vasile/mimetype Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.14 to 1.4.15. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.14...v1.4.15) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-version: 1.4.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.23 to 0.0.24. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.23...v0.0.24) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Replace Windsurf with Devin in skill agents Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 93e6d7e7-48ed-4f1c-9ec2-a182d419e40d * chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Rewrite the pull request template The old template asked for nothing, so a pull request could satisfy it with an empty body. It now asks only for things a reviewer cannot get from the diff: the problem, testing evidence, reviewer guidance, and who is accountable for answering review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address review: restore TODO, flatten detachCmds, guard worktree symlink - Restore the non-fast-forward // TODO breadcrumb in syncBranchCmds - Early-return the non-worktree case in detachCmds to reduce nesting - Reject a --worktree target that is a leaf symlink or non-directory via ensureWorktreePathSafe, with unit coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Detect worktrees via git rev-parse and reject the current worktree - Replace isWorktreeAtPath path-matching with git rev-parse --show-prefix --git-common-dir, letting git resolve symlinks, "..", case, and trailing slashes; delete resolvePath/EvalSymlinks - Reject a --worktree target that resolves to the current worktree, which would otherwise silently switch the current tree's branch and print a nonsensical "cd ." hint Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix worktree toplevel stub to match Windows absolute paths isCurrentWorktree resolves the target with filepath.Abs, which yields a drive-letter path on Windows (e.g. D:\path\to\wt). Match the -C target via a wildcard so the show-toplevel stub matches on all platforms. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Resolve worktree target once instead of re-querying git Collapse the separate worktree-detection helpers (isWorktreeAtPath, isCurrentWorktree, worktreeToplevel, worktreeInfoAtPath, repoCommonDir) into a single resolveWorktreeTarget call made once in checkoutRun. It runs two rev-parse queries (current + target) instead of the previous four and hands the command builders a plain reuseWorktree bool, so they no longer depend on the git client for detection and stay pure. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Trim redundant comments and clarify worktree field names Streamline comments in the worktree checkout path to only the non-obvious rationale, and rename the worktreeTarget fields to isCurrentWorktree and isExistingWorktree so they read clearly without explanation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Drop docs on self-explanatory worktree helpers Match the surrounding codebase, which rarely documents unexported helpers: remove the godoc on worktreeCheckoutCmds and tighten syncBranchCmds, keeping comments only where the rationale is non-obvious. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Return ok bool from revParseFacts to satisfy nilerr resolveWorktreeTarget deliberately proceeds with default flags when a rev-parse fails, which the nilerr linter flagged as returning a nil error after a non-nil one. Have revParseFacts report success via an ok bool instead so the best-effort fallthrough is explicit and lint-clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify current-worktree rejection message Reword the --worktree rejection to avoid the "current worktree" jargon, which is confusing for users who don't think of their main checkout as a worktree. Point at "the repository you're already in" instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Bail out early on unusable --worktree paths Reject --worktree paths that point inside a different repository or nest inside an existing worktree with clear messages, instead of deferring to git (which silently creates a nested worktree or emits a generic error). Fold all rejection cases into resolveWorktreeTarget, which now returns (reuseWorktree bool, error), removing the worktreeTarget struct and simplifying the checkoutRun guard. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Merge pull request #13985 from cli/williammartin-dependabot-triage-dry-run Add dependabot-triage agentic workflow * Fix skill picker label wrapping (#13967) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bf61d1c-810a-4324-874c-665275a607a9 * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.3 to 0.83.4. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/v0.83.3...e89c65e17eb281bbd5ff2ff9e9199a03e96654c7) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add a code review agent skill (#14003) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Babak K. Shandiz <babakks@github.com> * Merge commit from fork * Add terminal-safety mechanisms for untrusted content Introduce the building blocks for keeping untrusted external content (HTTP response bodies and the like) from reaching a terminal as live ANSI escape sequences, while leaving the application's own styled output untouched. - iostreams.Untrusted: a value type that wraps external content. The raw bytes are unexported; String sanitizes and is called automatically by fmt, so the default print path is safe. Raw and RawBytes are the explicit, greppable opt-out for non-terminal uses (disk, the API, hashing), and the type carries its label across JSON decoding so a decoded field stays marked. - iostreams.ContentOut and SetContentSanitization: a sink that sanitizes raw external streams by default and becomes a passthrough when a command opts out, so the sanitization decision is made at the moment of writing. - A CodeQL query (with help text, examples, and a per-category test suite) that flags HTTP response content reaching a terminal writer other than ContentOut without sanitization, treating ContentOut, Untrusted.String, the asciisanitizer wrap, and structured JSON decoding as the accepted resolutions. Wire it into the existing CodeQL workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate gist view to the terminal-safety mechanisms GetRawGistFile now returns iostreams.Untrusted, so the two callers are forced to declare intent. gist view carries the value to the render function and lets the sink decide: the raw dump goes through ContentOut (which honors --allow-escape-sequences) and the markdown path sanitizes its input with String before rendering to Out. gist edit takes Raw, because the content is opened in an editor and sent back to the API and must round-trip verbatim. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate skills to the terminal-safety mechanisms FetchBlob base64-decodes blob content out of the JSON response, so it now returns iostreams.Untrusted and its callers split by intent: skills preview sanitizes for display, while the installer (writes the file to disk) and the frontmatter parsers take Raw to operate on the verbatim bytes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate agent-task streaming logs to the terminal-safety mechanisms The agent-task chat completion chunk's Content and ReasoningText fields arrive over a streaming response, which is not a JSON content type, so the JSON transport sanitizer does not run on them. Type those fields as iostreams.Untrusted so provenance survives the per-line json.Unmarshal; printing them later sanitizes, and presence checks use Empty. This covers a path that flows resp.Body through json.Unmarshal to a printed field, which value dataflow cannot track but the type expresses directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate repo read-file to the terminal-safety mechanisms read-file already refuses to print terminal escape sequences by default (and opts in with --allow-escape-sequences), so it guards its own bytes. Route its two raw writes through ContentOut instead of Out, in passthrough mode, so it uses the one sink the terminal-safety query recognizes while keeping its refuse-by-default behavior. Passthrough is required here: sanitizing would corrupt binary files and strip the escapes that --allow-escape-sequences explicitly allows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate pr diff to the terminal-safety mechanisms pr diff neutralized escape sequences only when stdout was a terminal, leaving piped and redirected output raw. Neutralize by default in all modes instead: the plain and name-only paths write through ContentOut, and the colored path wraps the diff reader in the shared asciisanitizer, since colored output is always terminal-bound. Add --allow-escape-sequences to opt back into raw bytes for the non-colored paths, for example when piping a patch to another program. This also replaces the command's bespoke sanitizer with the shared asciisanitizer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate api response output to the terminal-safety mechanisms gh api copied non-JSON response bodies straight to stdout, so escape sequences in the response reached the terminal unneutralized (JSON bodies are already cleaned by the transport). Route the raw copy through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped so binary payloads are not corrupted, and honors --allow-escape-sequences. Silent, verbose, and slurp writers are left in place. The colorized JSON path now sanitizes its input before jsoncolor adds color, keeping the color intact while removing the raw bytes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate release download stdout to the terminal-safety mechanisms release download --output - copied asset bytes straight to stdout, so escape sequences in an asset reached the terminal unneutralized. Route the stdout write through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped or redirected so binary assets are not corrupted, and honors --allow-escape-sequences. File downloads are unaffected. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Migrate codespace logs to the terminal-safety mechanisms gh codespace logs streams a remote log file over ssh by running cat or tail -f, and the shared ssh helper wires the command's stdout straight to os.Stdout, so the file's bytes reach the terminal without passing through this process and cannot be neutralized. Point the logs command's stdout at ContentOut instead: on a terminal this sanitizes escape sequences and forces the remote output through the process, while piped output stays raw so a follow stream is not buffered and saved logs keep their exact bytes. The shared helper is left untouched so the interactive ssh shell still passes control sequences through. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Build the CodeQL Go database from the shipped build The Go analysis previously relied on autobuild, which walks the whole tree and extracts the nested module under .github/codeql/queries' test fixtures as well as the main module. Both declare the same module path with their own pkg/iostreams, so the analyzer conflated the two and reported a flow through unrelated code. Switch the Go job to build-mode: manual and build with make, the same command the integration tests use. Extraction is then scoped to the packages the released gh binary compiles, which excludes the separate fixtures module, so the spurious finding is gone and the analyzed code matches what we ship. The actions job builds nothing, so it is marked build-mode: none. The query's own test suite is unchanged and still runs each fixture directory in isolation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Match guarded-content errors by kind in tests Replace the binary-error boolean with a `wantErrAs` field so the table matches typed errors with errors.As and sentinels with errors.Is, mirroring how callers detect them. Any future typed error slots in without a new field. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Clarify that Untrusted wraps string content Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Convert Untrusted tests to testify assertions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Collapse guarded content cases into the table test Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Match binary terminal errors with errors.AsType Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Reuse the raw gist content when writing it out Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cover the non-truncated gist file path Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Document the refusal guarantee on CopyGuardedContent Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clear stale content when unmarshaling JSON null Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Merge commit from fork * feat(safeurl): add SafeURL package and CodeQL enforcement query Introduce internal/safeurl, which builds HTTP request URLs from variable components that are percent-encoded when rendered, so user or server controlled values cannot break the path or change which resource is addressed. It provides the SafeURL interface, the MutableSafeURL and ImmutableSafeURL implementations, the JoinPath and JoinPathWithHostPrefix builders, and NewImmutableSafeURL for entrusting already-formed URLs. Because percent-encoding leaves a component that is exactly ".." intact as a real path segment, JoinPath and JoinPathWithHostPrefix reject any such component and return an error, which callers bubble up to the command level. Also add a CodeQL query that flags any HTTP request URL argument that is not literally the result of a safeurl.SafeURL.String call. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(api): route REST paths through SafeURL Build the hand-written REST paths in the shared API layer with safeurl so their variable components are escaped. CreateRepoTransformToV4 now takes a safeurl.SafeURL path instead of a string. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(repo): build REST paths with SafeURL Escape the variable components of the repo command REST paths. The new read-file command builds its Contents API URL with safeurl, and the repo create and edit commands pass a safeurl.SafeURL to CreateRepoTransformToV4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(run): build REST paths with SafeURL Escape the variable components of the run command REST paths. GetJobs no longer mutates the Run; it takes an entrusted jobs URL and a run id and returns the jobs, so its callers assign them explicitly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(release): build REST paths with SafeURL Escape the variable components of the release command REST paths. The upload and delete-asset pipeline threads a safeurl.SafeURL through, so the asset upload URL and AssetForUpload.ExistingURL are carried as SafeURL. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(codespace): build REST paths with SafeURL Escape the variable components of the codespace command REST paths. The NWO validation helper moves out of safeurl into the codespace package, where it is the only remaining caller. Co-authored-by…

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

Copilot AI review requested due to automatic review settings July 28, 2026 21:50

BagToad requested a review from a team as a code owner July 28, 2026 21:50

BagToad requested a review from tidy-dev July 28, 2026 21:50

Copilot started reviewing on behalf of BagToad July 28, 2026 21:51 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Comment thread AGENTS.md

Comment thread AGENTS.md Outdated

Comment thread .github/skills/cli-code-reviewer/SKILL.md Outdated

Apply batched suggestions from code review

3693d3f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

BagToad requested review from babakks and williammartin July 28, 2026 23:27

tidy-dev approved these changes Jul 29, 2026

View reviewed changes

babakks approved these changes Jul 30, 2026

View reviewed changes

Comment thread .github/skills/cli-code-reviewer/SKILL.md

Comment thread .github/skills/cli-code-reviewer/SKILL.md

williammartin approved these changes Jul 30, 2026

View reviewed changes

Apply batched suggestions from code review

aa49f0c

Co-authored-by: Babak K. Shandiz <babakks@github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>

BagToad enabled auto-merge (squash) July 30, 2026 20:11

BagToad merged commit ba0b7d9 into trunk Jul 30, 2026
6 checks passed

BagToad deleted the bagtoad/update-agents-md branch July 30, 2026 20:20

BrewTestBot mentioned this pull request Jul 31, 2026

gh 2.97.0 Homebrew/homebrew-core#296261

Merged

scottames-github-bot Bot mentioned this pull request Aug 4, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1003

Merged

1 task

Navigation Menu

Uh oh!

Add a code review agent skill - #14003

Add a code review agent skill#14003
BagToad merged 3 commits into
trunkfrom
bagtoad/update-agents-md

BagToad commented Jul 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

BagToad commented Jul 28, 2026

Description

Review Methodology

Key Technical Points

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants