Establish a pull request template for scale - #14004
Merged
Merged
Conversation
The old template asked for nothing, so a pull request could satisfy it with an empty body. It now asks only for things a reviewer cannot get from the diff: the problem, testing evidence, reviewer guidance, and who is accountable for answering review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request replaces the repository’s minimal pull request template with a structured template intended to capture problem context, testing evidence, review guidance, and authorship/follow-up expectations to improve review quality and throughput.
Changes:
- Adds standardized sections for description, testing, key points, and reviewer notes.
- Introduces an authorship/follow-up disclosure checklist aimed at improving transparency and review responsiveness.
- Adds a security-related instruction and stronger testing/completeness expectations in the template text.
Show a summary per file
| File | Description |
|---|---|
| .github/PULL_REQUEST_TEMPLATE.md | Replaces the existing comment-only template with a structured, multi-section PR template that prompts authors for context, testing evidence, and follow-up ownership. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Low
tidy-dev
approved these changes
Jul 28, 2026
williammartin
approved these changes
Jul 30, 2026
pabrahamsson
pushed a commit
to pabrahamsson/containers
that referenced
this pull request
Aug 3, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@​dependabot](https://github.com/dependabot) in [#​13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@​dependabot](https://github.com/dependabot) in [#​13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@​dependabot](https://github.com/dependabot) in [#​13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@​dependabot](https://github.com/dependabot) in [#​13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot) in [#​13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@​dependabot](https://github.com/dependabot) in [#​13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@​dependabot](https://github.com/dependabot) in [#​13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@​dependabot](https://github.com/dependabot) in [#​13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@​dependabot](https://github.com/dependabot) in [#​13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@​dependabot](https://github.com/dependabot) in [#​13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@​dependabot](https://github.com/dependabot) in [#​13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@​dependabot](https://github.com/dependabot) in [#​13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@​dependabot](https://github.com/dependabot) in [#​13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@​dependabot](https://github.com/dependabot) in [#​13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@​dependabot](https://github.com/dependabot) in [#​13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@​dependabot](https://github.com/dependabot) in [#​13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in [#​13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@​dependabot](https://github.com/dependabot) in [#​13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@​dependabot](https://github.com/dependabot) in [#​13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot) in [#​13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@​dependabot](https://github.com/dependabot) in [#​13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@​dependabot](https://github.com/dependabot) in [#​13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@​dependabot](https://github.com/dependabot) in [#​13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@​dependabot](https://github.com/dependabot) in [#​13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@​dependabot](https://github.com/dependabot) in [#​13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@​dependabot](https://github.com/dependabot) in [#​13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot) in [#​13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@​dependabot](https://github.com/dependabot) in [#​14018](cli/cli#14018) #### New Contributors - [@​lukewar](https://github.com/lukewar) made their first contribution in [#​13777](cli/cli#13777) - [@​niik](https://github.com/niik) made their first contribution in [#​13780](cli/cli#13780) - [@​kofuk](https://github.com/kofuk) made their first contribution in [#​13787](cli/cli#13787) - [@​zwick](https://github.com/zwick) made their first contribution in [#​13807](cli/cli#13807) - [@​kobihikri](https://github.com/kobihikri) made their first contribution in [#​13886](cli/cli#13886) - [@​pstoeckle](https://github.com/pstoeckle) made their first contribution in [#​13940](cli/cli#13940) - [@​Solaris-star](https://github.com/Solaris-star) made their first contribution in [#​13927](cli/cli#13927) - [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#​13900](cli/cli#13900) - [@​alondahari](https://github.com/alondahari) made their first contribution in [#​13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28
1 task
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 11, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@​me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Our pull request template was a single comment. That left reviewers to reconstruct the problem, the approach, and whether anything had really been verified aside from superficial "I ran the tests" type comments.
In the agentic era, we also need to guess about if someone is a human and if they'll be around to answer questions. Let's stop guessing so much and ask - if they lie, so be it. But let's try and encourage transparency.
This replaces the PR template with a real one. Each section asks for something a reviewer cannot get by reading the code.
Key & Interesting Points
The development of this template came from my personal opinions and anecdotes, augmented with what I could find across other open source repositories.
The testing section follows React's template. They ask for "the exact commands you ran and their output," and make visual evidence conditional on the change touching the interface. That phrasing still extracts terminal output when output changes, and it survives refactors that have none.
React's "If you leave this empty, your PR will very likely be closed" is the cheapest enforcement in any template I looked at, because it needs no CI. I'm not suggesting we add automation here; there will absolutely be cases where we feel it's warranted to violate the template's rules. For example, documentation and test harness changes seem like an appropriate candidate to omit this section.
The authorship checkboxes are part of my augmented own hot take on AI disclosure. deno, Homebrew, and curl all require AI disclosure, but none of them asks who will answer review comments. Hopefully unattended pull requests become visible.
Additional Context
Follow-up
While developing this template, I realized that our contribution guidelines don't have much quality steering. The information is too light, AGENTS.md is a better technical contributing guide. It focuses a lot on finding issues to work on or surface level things, but not enough about what does a quality contribution look like once you're writing code. An honourable mention is also the responsiveness thing - something like that seems practical to have in a contribution guide. Problems for another time and another PR.