Clarify --clone boolean flag behaviour in gh repo fork help - #13786
Merged
Conversation
Copilot
AI
changed the title
[WIP] Update help text for --clone flag in gh repo fork
Clarify Jul 2, 2026
--clone boolean flag behaviour in gh repo fork help
BagToad
requested changes
Jul 2, 2026
BagToad
reviewed
Jul 2, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request improves the gh repo fork command help by making it explicit (via examples) that the --clone boolean flag can be set to false, which is especially useful for avoiding interactive clone prompts.
Changes:
- Added an
Examplesection togh repo forkhelp output. - Included a concrete
--clone=falseexample to clarify the boolean behavior of the--cloneflag.
Show a summary per file
| File | Description |
|---|---|
pkg/cmd/repo/fork/fork.go |
Adds help examples demonstrating --clone and --clone=false usage for gh repo fork. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Low
BagToad
approved these changes
Jul 2, 2026
Member
|
Admin merging to get this because this is docs only and wrapping up some things. |
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Jul 9, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.94.0` → `v2.96.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.96.0`](https://github.com/cli/cli/releases/tag/v2.96.0): GitHub CLI 2.96.0 [Compare Source](cli/cli@v2.95.0...v2.96.0) #### Security A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via `gh codespace jupyter`. Users of `gh codespace jupyter` are advised to update gh to version v2.96.0 as soon as possible. For more information see: <GHSA-8cg3-r6g9-fpg2> #### Download release assets without authentication `gh release download` now works against public repositories without authentication, matching `gh extension install`. A token is still used when one is present: ```shell # Download assets from a public repository, no login required gh release download v2.96.0 --repo cli/cli ``` #### What's Changed ##### ✨ Features - Allow `gh release download` without authentication on public repositories by [@​BagToad](https://github.com/BagToad) in [#​13723](cli/cli#13723) - Detect additional third-party coding agents by [@​BagToad](https://github.com/BagToad) in [#​13722](cli/cli#13722) - Support `antigravity-cli` and `antigravity2.0` in `gh skill` by [@​BagToad](https://github.com/BagToad) in [#​13784](cli/cli#13784) ##### 🐛 Fixes - fix: show checks summary when all checks were cancelled by [@​s3onghyun](https://github.com/s3onghyun) in [#​13679](cli/cli#13679) - fix(skills): install universal agent to `~/.agents/skills` by [@​toller892](https://github.com/toller892) in [#​13681](cli/cli#13681) - fix(skills): honor `--dir` without agent prompt by [@​happysnaker](https://github.com/happysnaker) in [#​13766](cli/cli#13766) - Fix concurrent map writes in codespace port forwarding by [@​williammartin](https://github.com/williammartin) in [#​13313](cli/cli#13313) - Use `int64` for GitHub database IDs by [@​williammartin](https://github.com/williammartin) in [#​13403](cli/cli#13403) ##### 📚 Docs & Chores - Pin reusable triage workflows to a commit SHA by [@​BagToad](https://github.com/BagToad) in [#​13705](cli/cli#13705) - Add security disclosure guidance to `AGENTS.md` by [@​BagToad](https://github.com/BagToad) in [#​13720](cli/cli#13720) - Clarify `--clone` boolean flag behaviour in `gh repo fork` help by [@​BagToad](https://github.com/BagToad) in [#​13786](cli/cli#13786) - Fix flaky `TestHuhPrompterMultiSelectWithSearchPersistence` on slow architectures by [@​pdostal](https://github.com/pdostal) in [#​13675](cli/cli#13675) - docs(search): add examples for multiple qualifiers by [@​happysnaker](https://github.com/happysnaker) in [#​13756](cli/cli#13756) - docs: fix broken anchor link in release-process-deep-dive by [@​patrickwehbe](https://github.com/patrickwehbe) in [#​13688](cli/cli#13688) - docs: fix broken install command and link/grammar errors by [@​patrickwehbe](https://github.com/patrickwehbe) in [#​13690](cli/cli#13690) - docs: fix duplicated word in primer README by [@​s3onghyun](https://github.com/s3onghyun) in [#​13677](cli/cli#13677) #####Dependencies - chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by [@​dependabot](https://github.com/dependabot) in [#​13708](cli/cli#13708) - chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13703](cli/cli#13703) - chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by [@​dependabot](https://github.com/dependabot) in [#​13702](cli/cli#13702) - chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@​dependabot](https://github.com/dependabot) in [#​13740](cli/cli#13740) - chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13754](cli/cli#13754) - chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by [@​dependabot](https://github.com/dependabot) in [#​13759](cli/cli#13759) - chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@​dependabot](https://github.com/dependabot) in [#​13779](cli/cli#13779) #### New Contributors - [@​patrickwehbe](https://github.com/patrickwehbe) made their first contribution in [#​13688](cli/cli#13688) - [@​s3onghyun](https://github.com/s3onghyun) made their first contribution in [#​13679](cli/cli#13679) - [@​toller892](https://github.com/toller892) made their first contribution in [#​13681](cli/cli#13681) - [@​happysnaker](https://github.com/happysnaker) made their first contribution in [#​13756](cli/cli#13756) **Full Changelog**: <cli/cli@v2.95.0...v2.96.0> ### [`v2.95.0`](https://github.com/cli/cli/releases/tag/v2.95.0): GitHub CLI 2.95.0 [Compare Source](cli/cli@v2.94.0...v2.95.0) #### Read repository files and directories with `gh repo read-file` and `gh repo read-dir` Two new preview commands read repository contents without cloning: ```shell # Read a single file to stdout gh repo read-file README.md --repo cli/cli # Read from a specific branch, tag, or commit gh repo read-file go.mod --ref v2.94.0 --repo cli/cli # Write a file to disk (use --clobber to overwrite) gh repo read-file README.md --output ./README.md --repo cli/cli # List the entries in a directory gh repo read-dir script --repo cli/cli ``` Both commands default to the repository's default branch, accept `--ref` to target any branch, tag, or commit, and support `--json`, `--jq`, and `--template` for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout. > \[!NOTE] > `gh repo read-file` and `gh repo read-dir` are in preview and subject to change without notice. #### What's Changed ##### ✨ Features - feat: add `repo read-file` and `repo read-dir` by [@​babakks](https://github.com/babakks) in [#​13580](cli/cli#13580) - feat(skills): list available skills when install runs non-interactively by [@​SamMorrowDrums](https://github.com/SamMorrowDrums) in [#​13548](cli/cli#13548) - Support custom CLAUDE\_CONFIG\_DIR in install by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13523](cli/cli#13523) ##### 🐛 Fixes - fix(skills): stage updates in a temp dir and swap in-place by [@​SamMorrowDrums](https://github.com/SamMorrowDrums) in [#​13449](cli/cli#13449) ##### 📚 Docs & Chores - Make filtering by bot authors more discoverable by [@​BagToad](https://github.com/BagToad) in [#​13642](cli/cli#13642) - docs(discussion): polish help docs by [@​babakks](https://github.com/babakks) in [#​13632](cli/cli#13632) - Bump Go in devcontainer by [@​spenserblack](https://github.com/spenserblack) in [#​13674](cli/cli#13674) #####
HIHACK1911
added a commit
to HIHACK1911/cli-go
that referenced
this pull request
Aug 8, 2026
* docs(search): reword raw qualifier examples * Add dry_run flag to gate release publishing Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <[email protected]> * Fix macOS signing/notarization keychain and gating Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <[email protected]> * Update deployment.yml * Use workflow_dispatch for deployment flow Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication. * Update deployment.yml * Update deployment.yml * Add draft issue-triage gh-aw workflow (issue-intents starting point) Net-new draft agentic issue-triage labeller for cli/cli built with gh-aw. On a newly opened issue (or manual workflow_dispatch) an agent reads the issue and, only when confident, applies a small allowlist of existing cli/cli labels and posts one short rationale comment via native issue-intents safe outputs. Conservative starting point for discussion, not a final triage configuration. Inert until issue_intents is enabled for the org/repo and a repo admin sets the GH_AW_RUNTIME_FEATURES=issue_intents repository variable. Co-authored-by: Copilot App <[email protected]> * Retune issue-triage stub to the team's documented triage process Rework the draft workflow to follow gh-cli-and-desktop triage-process.md: the objective is to drive an issue toward removing needs-triage by landing the minimal correct end-state labels, surfaced for maintainer approval via issue-intents rationale and confidence rather than silent auto-apply. - Prompt now follows the documented issues decision tree (closeable / duplicate / spam / abuse / off-topic / no-help-wanted-issue, then bug + priority or unable-to-reproduce, then enhancement or more-info-needed). - add-labels allowlist switched to the real cli/cli triage taxonomy: bug, priority-1/2/3, enhancement, more-info-needed, unable-to-reproduce, off-topic, no-help-wanted-issue, invalid, suspected-spam, duplicate. needs-triage is intentionally excluded (the agent must not add it). - max labels 3, add-comment max 1; engine copilot, strict:false, permissions contents:read + issues:read, github toolset [issues], triggers issues:opened + workflow_dispatch, timeout 10m, intents wiring unchanged. Co-authored-by: Copilot App <[email protected]> * Let's try a different approach * Add diagnostic step to list macOS signing identities Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <[email protected]> * Try this then * Don't see how this could have worked in the past * Don't need this any more * Update release deep-dive doc for macOS signing and dry_run changes Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <[email protected]> * Forward dry_run to deployment workflow from script/release The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <[email protected]> * Remove ref input from deployment workflow The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <[email protected]> * Pass macOS signing secrets via env instead of inline interpolation Interpolating ${{ secrets.* }} directly into the run: script meant a certificate password containing a single quote (or other shell metacharacters) would break quoting and could inject commands. Map the cert and password into the step env and reference them as quoted shell variables instead, and remove the temporary .p12 after import. Co-authored-by: Copilot <[email protected]> * Gate macOS signing on DO_SIGN_ARTIFACTS Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <[email protected]> * Mark dry runs in the workflow run name Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <[email protected]> * Revert to missing var * chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2ee...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Support antigravity-cli and antigravity2.0 in gh skill (#13784) Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Kynan Ware <[email protected]> Co-authored-by: Copilot App <[email protected]> * fix(skills): honor --dir without agent prompt (#13766) * docs: fix duplicated word in primer README (#13677) Signed-off-by: s3onghyun <[email protected]> * Clarify `--clone` boolean flag behaviour in `gh repo fork` help (#13786) Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Kynan Ware <[email protected]> * docs: fix broken install command and link/grammar errors (#13690) Co-authored-by: Patrick Wehbe <[email protected]> * Fix concurrent map writes in codespace port forwarding (#13313) Co-authored-by: Copilot <[email protected]> Co-authored-by: Kynan Ware <[email protected]> * Merge commit from fork * Validate Jupyter Server URLs * Validate Jupyter Server URLs: address reviews * Validate Jupyter Server URLs: address test reviews * Validate Jupyter Server URLs: address test reviews * Gate publishing the site on the production environment * Fix pkg installer var in deep-dive code snippet The workflow was reverted to source APPLE_DEVELOPER_INSTALLER_ID from vars.APPLE_DEVELOPER_INSTALLER_ID, but the docs snippet still showed vars.MAC_APP_SIGNING_IDENTITY. Co-authored-by: Copilot <[email protected]> * Correct pkg signing NOTE in deep-dive The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <[email protected]> * Quote $KEYCHAIN in notarytool submit invocation Prevents word-splitting/globbing if the keychain path ever contains spaces or glob characters. Co-authored-by: Copilot <[email protected]> * Bump keyring operation timeout from 3s to 60s The 3-second timeout doesn't leave enough time to respond to an interactive unlock prompt (password entry, biometric confirmation, etc.), causing gh to give up before the user can react. Fixes #11005 * Apply suggestions from code review Co-authored-by: Babak K. Shandiz <[email protected]> * Update deep-dive doc for final release workflow state Bring the release deep-dive in line with the final branch state: site steps gated on production, createrepo/reprepro gate on environment instead of GPG_SIGN, dropped github.token fallback, quoted keychain paths, and documented the script/release --dry-run default. Also restore the reprepro env: key that was dropped when GPG_SIGN was removed, which had left the workflow YAML invalid. Co-authored-by: Copilot <[email protected]> * chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5) --- updated-dependencies: - dependency-name: charm.land/lipgloss/v2 dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.39.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Bump Go to 1.26.5 * chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Adopt skills-driven triage approach from desktop/desktop Replace the inline decision tree with the shared skills-driven approach used in desktop/desktop. The workflow now fetches triage instructions from desktop/gh-cli-and-desktop-shared-workflows at runtime, uses a GitHub App token for auth, and always suggests labels at medium confidence or lower so all suggestions require maintainer approval. Key changes: - Add repos toolset and allowed-repos for cross-repo skill loading - Add min-integrity: none for reading untrusted issue content - Add github-app safe-output with CLI_TRIAGE_APP secret refs - Replace inline decision tree with 5-step skills-driven flow - Keep duplicate label (cli/cli has one, unlike desktop) Co-authored-by: Copilot App <[email protected]> * Remove medium-confidence instruction from Step 5 Co-authored-by: Copilot App <[email protected]> * Use Actions token for Copilot inference instead of PAT Add copilot-requests: write permission so the workflow uses the built-in GitHub Actions token for LLM calls, removing the need for a separate COPILOT_GITHUB_TOKEN secret. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.81.6 to 0.82.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/ba6380cc6e5be5d21677bebe04d52fb48e3abec7...3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1) --- updated-dependencies: - dependency-name: charm.land/bubbles/v2 dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump codeql-action/init and upload-sarif to v4.36.3 All three codeql-action sub-actions (init, analyze, upload-sarif) must be the same version to avoid version mismatch errors. This commit brings init and upload-sarif in line with the analyze bump. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. - [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.2 to 0.82.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a...eb6dc28843ed52402ea15a0ddf6334c40330eab4) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * drop notPanics assertion Signed-off-by: Meredith Lancaster <[email protected]> * Add Grok skill host support Co-authored-by: Copilot App <[email protected]> * Clarify agent host examples Co-authored-by: Copilot App <[email protected]> * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.36.2...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.3 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.3 to 0.82.8. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/eb6dc28843ed52402ea15a0ddf6334c40330eab4...99d9d888952ee25fce70c6b3120ca490d7d8da95) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore: remove dead CODEOWNERS rule for non-existent pkg/cmd/release/attestation/ * docs(search): note OWNER/REPO format on --repo flag The search --repo flag feeds GitHub's repo:OWNER/REPO qualifier, but its help never showed the expected format, so a full URL silently matched nothing. Add an OWNER/REPO placeholder and format hint to the code, commits, issues, and prs subcommands. Co-authored-by: Copilot App <[email protected]> * Add name-based resolution to gh project item-edit (#13807) Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.8.2 to 1.8.4. - [Release notes](https://github.com/yuin/goldmark/releases) - [Commits](https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.4) --- updated-dependencies: - dependency-name: github.com/yuin/goldmark dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.3 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * Upgrade CodeQL action to version 4.37.1 Updated CodeQL action versions to v4.37.1 for analysis and SARIF upload. * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/attest from 4.1.1 to 4.2.0 Bumps [actions/attest](https://github.com/actions/attest) from 4.1.1 to 4.2.0. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.8 to 0.82.13. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/99d9d888952ee25fce70c6b3120ca490d7d8da95...a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(typos): fix typos in code and documentation * chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.0...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Group CodeQL Dependabot updates Co-authored-by: Copilot App <[email protected]> Copilot-Session: b6ceb930-bece-4da4-b457-7b142c3a322b * Add --worktree flag to gh pr checkout Support checking out a pull request into a new git worktree via `gh pr checkout <pr> --worktree <path>`. Re-running against the same path fast-forwards the existing worktree (idempotent, matching plain checkout), and checking out a branch already present in another worktree fails with a clear message. Adds a git.Client.Worktrees() helper that parses `git worktree list --porcelain`. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 (#13944) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Refine PR checkout worktree flag help * tidying.. * chore(deps): bump nodeselector/setup-apple-codesign from ab275d0f6fb63ef9e20b12b42ea0d567f935723c to 309922bbe4c7277c477635e68d3a1af52d8ad06b (#13878) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Run submodule commands inside the worktree for pr checkout When --worktree is combined with --recurse-submodules, the submodule sync/update commands ran in the main worktree instead of the newly created one, leaving the worktree's submodules uninitialized. Prefix the submodule commands with -C <path> (applied as cmd.Dir, mirroring the fetch handling) so they operate on the correct worktree. Co-authored-by: Copilot App <[email protected]> * Simplify submodule worktree prefix to inline conditional Co-authored-by: Copilot App <[email protected]> * Preserve no-force safety when reusing a worktree for fork PRs The missing-remote existing-worktree path used checkout -B <branch> FETCH_HEAD, which unconditionally reset the branch and could discard local commits even without --force. Switch to existence-aware logic that mirrors the non-worktree paths: when the branch exists, check it out and sync with merge --ff-only (or reset --hard under --force); only create the branch from FETCH_HEAD when it does not exist yet. Co-authored-by: Copilot App <[email protected]> * Extract authenticatedCommand helper to dedupe -C handling Co-authored-by: Copilot App <[email protected]> * Create branch when reusing a worktree with a new --branch name The existing-remote worktree-reuse path assumed the target branch already existed and ran checkout <branch>, which failed when a new --branch name was supplied for an already-existing worktree (e.g. repointing a review worktree at a different PR). Create the branch tracking the remote when it does not exist yet, mirroring the new-worktree path. Co-authored-by: Copilot App <[email protected]> * Harden worktree submodule prefixing and cover cmd.Dir stripping Use slices.Concat instead of append(prefix, ...) when building the worktree-scoped submodule commands so the shared prefix slice can never alias between the two commands. Add a unit test on authenticatedCommand asserting the leading -C <path> is applied as cmd.Dir and stripped from the args, which the CommandStubber-based tests cannot observe. Co-authored-by: Copilot App <[email protected]> * Add named field columns to gh project item-list (#13823) Co-authored-by: Copilot App <[email protected]> * docs(project): present by-name item-edit as the first-class flow (#13927) Signed-off-by: Solaris-star <[email protected]> * Fix duplicated-word typos in comments (#13900) Co-authored-by: Claude Sonnet 5 <[email protected]> * Cover detach-reuse, worktree fetch dir, and symlink path resolution Add the coverage gaps surfaced by review: re-running --detach against an existing worktree (the per-worktree FETCH_HEAD path), a cmd.Dir assertion for the worktree-local fetch shape (the real fork/detach production combo, not just submodule), and a symlink-resolving isWorktreeAtPath unit test so worktree reuse keeps working when git reports a canonical path but the user passes a symlinked one. Drop the custom-branch new-worktree case, which duplicated the new-branch path already covered by the existing-worktree custom-branch case. Co-authored-by: Copilot App <[email protected]> * chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.0 to 1.19.1. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.13 to 0.82.14. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/a5d8b7df9d4f9137bedb3d074d0a0b005f1e1996...b6d1443e05b8716267fa19425b99aa4f12006b4a) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.82.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore: refresh agentic workflows to stable gh-aw v0.82.14 Upgrade the gh-aw toolchain from v0.81.6 to the latest stable release (v0.82.14, not a pre-release) and recompile the existing issue-triage agentic workflow with `gh aw compile`. The source workflow (issue-triage.md) is unchanged: frontmatter_hash and body_hash are identical, and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated runtime infrastructure: - issue-triage.lock.yml: compiler v0.81.6->v0.82.14, engine 1.0.65->1.0.71, action/container SHA bumps, new OAuth-token/lockdown steps, dropped .crush support, whitespace normalization. - .github/aw/actions-lock.json: setup action v0.81.6->v0.82.14 (+setup-cli). - .gitattributes: gh-aw-managed linguist-generated marker for lock files. - agentics-maintenance.yml: auto-generated companion for the workflow's expiring safe outputs (new in v0.82.14). Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget agentic workflows to pre-release gh-aw v0.83.0 Bump the gh-aw compiler from stable v0.82.14 to pre-release v0.83.0 and recompile the existing issue-triage workflow with `gh aw compile`. Source workflow issue-triage.md is unchanged: frontmatter_hash and body_hash are identical and permissions blocks match, so prompts, triggers, permissions, tools, safe outputs, network, and engine behavior are preserved. All changes are compiler-generated: - issue-triage.lock.yml: compiler v0.82.14->v0.83.0, engine 1.0.71->1.0.73. - agentics-maintenance.yml: regenerated companion, version bumps only. - .github/aw/actions-lock.json: setup/setup-cli action v0.82.14->v0.83.0. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * feat(issue-triage): enable native issue-intent on supported safe outputs Add hyphenated `issue-intent: true` to every configured safe-output tool that supports it under gh-aw v0.83.0. Inspected all configured outputs against the v0.83.0 schema: - add-labels: supported -> issue-intent enabled (native rationale/ confidence/suggest on suggested labels). - add-comment: not an issue-intent-capable output type in v0.83.0 -> left unchanged. No safe-output tools were added or removed. Recompiled the issue-triage workflow with `gh aw compile`; the generated handler config now carries "add_labels":{...,"issue_intent":true}. frontmatter_hash changes as an intentional result of this config edit; body_hash is unchanged. Validated with `gh aw compile` and `gh aw validate` (0 errors, 0 warnings), idempotent on re-compile. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(issue-triage): scope refresh to issue-triage; drop unrelated maintenance workflow The setup PR (cli/cli#13777) meaningfully updated only the issue-triage workflow, so this refresh must touch issue-triage alone. gh-aw v0.83.0 otherwise auto-generates a repo-wide agentics-maintenance.yml companion workflow, which is out of scope here. Suppress that generation with the documented compiler toggle `.github/workflows/aw.json` {"maintenance": false} and remove the previously generated agentics-maintenance.yml. No repo variables changed and no safe-output tools added. issue-triage is unaffected: its lock, the issue-intent enablement on add-labels, and the v0.83.0 toolchain bump are all preserved. Validated with `gh aw compile` (v0.83.0) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile (maintenance workflow does not regenerate). Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore: retarget issue-triage agentic workflow to stable gh-aw v0.83.1 Bump the gh-aw compiler from v0.83.0 to the latest stable release v0.83.1 and recompile the issue-triage workflow. Scope is unchanged: only the issue-triage source/lock plus the directly required shared action lock; the maintenance workflow stays suppressed via aw.json. Source issue-triage.md is unchanged: frontmatter_hash and body_hash are identical, so the add-labels issue-intent enablement and all workflow behavior are preserved. Generated changes only: - issue-triage.lock.yml: compiler v0.83.0->v0.83.1, AWF v0.27.37->v0.27.38. - .github/aw/actions-lock.json: setup action v0.83.0->v0.83.1 (v0.83.1 no longer emits a separate setup-cli entry). Validated with `gh aw compile` (v0.83.1) and `gh aw validate` (0 errors, 0 warnings); idempotent on re-compile, maintenance workflow not regenerated. Refs github/plan-track-agentic-toolkit#519 Co-authored-by: Copilot App <[email protected]> Copilot-Session: 628d4172-49f6-4d5c-905c-a33276de3aee * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e0647621c2984b5ed2f768cb892365bf2a616ad1) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> * chore: initialize agentic workflow tooling Add the gh-aw agent, dispatcher skill, MCP configuration, Copilot setup workflow, and generated maintenance workflow. Co-authored-by: Copilot App <[email protected]> * Add macos keyring security doc (#13960) * chore(deps): bump github.com/gabriel-vasile/mimetype Bumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.14 to 1.4.15. - [Release notes](https://github.com/gabriel-vasile/mimetype/releases) - [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.14...v1.4.15) --- updated-dependencies: - dependency-name: github.com/gabriel-vasile/mimetype dependency-version: 1.4.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.23 to 0.0.24. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.23...v0.0.24) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.1 to 0.83.2. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/8bdba8075360648fe6802302a5b4e016361dc6ac...39143c7eb25e92c0ab748285770483709db03c05) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Replace Windsurf with Devin in skill agents Co-authored-by: Copilot App <[email protected]> Copilot-Session: 93e6d7e7-48ed-4f1c-9ec2-a182d419e40d * chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.2 to 0.83.3. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/39143c7eb25e92c0ab748285770483709db03c05...6f8e8ef27dc666d7945cf450b3a16b8872092c94) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Rewrite the pull request template The old template asked for nothing, so a pull request could satisfy it with an empty body. It now asks only for things a reviewer cannot get from the diff: the problem, testing evidence, reviewer guidance, and who is accountable for answering review. Co-authored-by: Copilot App <[email protected]> * Address review: restore TODO, flatten detachCmds, guard worktree symlink - Restore the non-fast-forward // TODO breadcrumb in syncBranchCmds - Early-return the non-worktree case in detachCmds to reduce nesting - Reject a --worktree target that is a leaf symlink or non-directory via ensureWorktreePathSafe, with unit coverage Co-authored-by: Copilot App <[email protected]> * Detect worktrees via git rev-parse and reject the current worktree - Replace isWorktreeAtPath path-matching with git rev-parse --show-prefix --git-common-dir, letting git resolve symlinks, "..", case, and trailing slashes; delete resolvePath/EvalSymlinks - Reject a --worktree target that resolves to the current worktree, which would otherwise silently switch the current tree's branch and print a nonsensical "cd ." hint Co-authored-by: Copilot App <[email protected]> * Fix worktree toplevel stub to match Windows absolute paths isCurrentWorktree resolves the target with filepath.Abs, which yields a drive-letter path on Windows (e.g. D:\path\to\wt). Match the -C target via a wildcard so the show-toplevel stub matches on all platforms. Co-authored-by: Copilot App <[email protected]> * Resolve worktree target once instead of re-querying git Collapse the separate worktree-detection helpers (isWorktreeAtPath, isCurrentWorktree, worktreeToplevel, worktreeInfoAtPath, repoCommonDir) into a single resolveWorktreeTarget call made once in checkoutRun. It runs two rev-parse queries (current + target) instead of the previous four and hands the command builders a plain reuseWorktree bool, so they no longer depend on the git client for detection and stay pure. Co-authored-by: Copilot App <[email protected]> * Trim redundant comments and clarify worktree field names Streamline comments in the worktree checkout path to only the non-obvious rationale, and rename the worktreeTarget fields to isCurrentWorktree and isExistingWorktree so they read clearly without explanation. Co-authored-by: Copilot App <[email protected]> * Drop docs on self-explanatory worktree helpers Match the surrounding codebase, which rarely documents unexported helpers: remove the godoc on worktreeCheckoutCmds and tighten syncBranchCmds, keeping comments only where the rationale is non-obvious. Co-authored-by: Copilot App <[email protected]> * Return ok bool from revParseFacts to satisfy nilerr resolveWorktreeTarget deliberately proceeds with default flags when a rev-parse fails, which the nilerr linter flagged as returning a nil error after a non-nil one. Have revParseFacts report success via an ok bool instead so the best-effort fallthrough is explicit and lint-clean. Co-authored-by: Copilot App <[email protected]> * Clarify current-worktree rejection message Reword the --worktree rejection to avoid the "current worktree" jargon, which is confusing for users who don't think of their main checkout as a worktree. Point at "the repository you're already in" instead. Co-authored-by: Copilot App <[email protected]> * Bail out early on unusable --worktree paths Reject --worktree paths that point inside a different repository or nest inside an existing worktree with clear messages, instead of deferring to git (which silently creates a nested worktree or emits a generic error). Fold all rejection cases into resolveWorktreeTarget, which now returns (reuseWorktree bool, error), removing the worktreeTarget struct and simplifying the checkoutRun guard. Co-authored-by: Copilot App <[email protected]> * Merge pull request #13985 from cli/williammartin-dependabot-triage-dry-run Add dependabot-triage agentic workflow * Fix skill picker label wrapping (#13967) Co-authored-by: Copilot App <[email protected]> Copilot-Session: 9bf61d1c-810a-4324-874c-665275a607a9 * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 Bumps [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) from 0.83.3 to 0.83.4. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/v0.83.3...e89c65e17eb281bbd5ff2ff9e9199a03e96654c7) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.83.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> * Add a code review agent skill (#14003) Co-authored-by: Copilot App <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Babak K. Shandiz <[email protected]> * Merge commit from fork * Add terminal-safety mechanisms for untrusted content Introduce the building blocks for keeping untrusted external content (HTTP response bodies and the like) from reaching a terminal as live ANSI escape sequences, while leaving the application's own styled output untouched. - iostreams.Untrusted: a value type that wraps external content. The raw bytes are unexported; String sanitizes and is called automatically by fmt, so the default print path is safe. Raw and RawBytes are the explicit, greppable opt-out for non-terminal uses (disk, the API, hashing), and the type carries its label across JSON decoding so a decoded field stays marked. - iostreams.ContentOut and SetContentSanitization: a sink that sanitizes raw external streams by default and becomes a passthrough when a command opts out, so the sanitization decision is made at the moment of writing. - A CodeQL query (with help text, examples, and a per-category test suite) that flags HTTP response content reaching a terminal writer other than ContentOut without sanitization, treating ContentOut, Untrusted.String, the asciisanitizer wrap, and structured JSON decoding as the accepted resolutions. Wire it into the existing CodeQL workflow. Co-authored-by: Copilot App <[email protected]> * Migrate gist view to the terminal-safety mechanisms GetRawGistFile now returns iostreams.Untrusted, so the two callers are forced to declare intent. gist view carries the value to the render function and lets the sink decide: the raw dump goes through ContentOut (which honors --allow-escape-sequences) and the markdown path sanitizes its input with String before rendering to Out. gist edit takes Raw, because the content is opened in an editor and sent back to the API and must round-trip verbatim. Co-authored-by: Copilot App <[email protected]> * Migrate skills to the terminal-safety mechanisms FetchBlob base64-decodes blob content out of the JSON response, so it now returns iostreams.Untrusted and its callers split by intent: skills preview sanitizes for display, while the installer (writes the file to disk) and the frontmatter parsers take Raw to operate on the verbatim bytes. Co-authored-by: Copilot App <[email protected]> * Migrate agent-task streaming logs to the terminal-safety mechanisms The agent-task chat completion chunk's Content and ReasoningText fields arrive over a streaming response, which is not a JSON content type, so the JSON transport sanitizer does not run on them. Type those fields as iostreams.Untrusted so provenance survives the per-line json.Unmarshal; printing them later sanitizes, and presence checks use Empty. This covers a path that flows resp.Body through json.Unmarshal to a printed field, which value dataflow cannot track but the type expresses directly. Co-authored-by: Copilot App <[email protected]> * Migrate repo read-file to the terminal-safety mechanisms read-file already refuses to print terminal escape sequences by default (and opts in with --allow-escape-sequences), so it guards its own bytes. Route its two raw writes through ContentOut instead of Out, in passthrough mode, so it uses the one sink the terminal-safety query recognizes while keeping its refuse-by-default behavior. Passthrough is required here: sanitizing would corrupt binary files and strip the escapes that --allow-escape-sequences explicitly allows. Co-authored-by: Copilot App <[email protected]> * Migrate pr diff to the terminal-safety mechanisms pr diff neutralized escape sequences only when stdout was a terminal, leaving piped and redirected output raw. Neutralize by default in all modes instead: the plain and name-only paths write through ContentOut, and the colored path wraps the diff reader in the shared asciisanitizer, since colored output is always terminal-bound. Add --allow-escape-sequences to opt back into raw bytes for the non-colored paths, for example when piping a patch to another program. This also replaces the command's bespoke sanitizer with the shared asciisanitizer. Co-authored-by: Copilot App <[email protected]> * Migrate api response output to the terminal-safety mechanisms gh api copied non-JSON response bodies straight to stdout, so escape sequences in the response reached the terminal unneutralized (JSON bodies are already cleaned by the transport). Route the raw copy through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped so binary payloads are not corrupted, and honors --allow-escape-sequences. Silent, verbose, and slurp writers are left in place. The colorized JSON path now sanitizes its input before jsoncolor adds color, keeping the color intact while removing the raw bytes. Co-authored-by: Copilot App <[email protected]> * Migrate release download stdout to the terminal-safety mechanisms release download --output - copied asset bytes straight to stdout, so escape sequences in an asset reached the terminal unneutralized. Route the stdout write through ContentOut, which neutralizes escape sequences on an interactive terminal, stays raw when piped or redirected so binary assets are not corrupted, and honors --allow-escape-sequences. File downloads are unaffected. Co-authored-by: Copilot App <[email protected]> * Migrate codespace logs to the terminal-safety mechanisms gh codespace logs streams a remote log file over ssh by running cat or tail -f, and the shared ssh helper wires the command's stdout straight to os.Stdout, so the file's bytes reach the terminal without passing through this process and cannot be neutralized. Point the logs command's stdout at ContentOut instead: on a terminal this sanitizes escape sequences and forces the remote output through the process, while piped output stays raw so a follow stream is not buffered and saved logs keep their exact bytes. The shared helper is left untouched so the interactive ssh shell still passes control sequences through. Co-authored-by: Copilot App <[email protected]> * Build the CodeQL Go database from the shipped build The Go analysis previously relied on autobuild, which walks the whole tree and extracts the nested module under .github/codeql/queries' test fixtures as well as the main module. Both declare the same module path with their own pkg/iostreams, so the analyzer conflated the two and reported a flow through unrelated code. Switch the Go job to build-mode: manual and build with make, the same command the integration tests use. Extraction is then scoped to the packages the released gh binary compiles, which excludes the separate fixtures module, so the spurious finding is gone and the analyzed code matches what we ship. The actions job builds nothing, so it is marked build-mode: none. The query's own test suite is unchanged and still runs each fixture directory in isolation. Co-authored-by: Copilot App <[email protected]> * Match guarded-content errors by kind in tests Replace the binary-error boolean with a `wantErrAs` field so the table matches typed errors with errors.As and sentinels with errors.Is, mirroring how callers detect them. Any future typed error slots in without a new field. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Clarify that Untrusted wraps string content Co-authored-by: Copilot App <[email protected]> * Convert Untrusted tests to testify assertions Co-authored-by: Copilot App <[email protected]> * Collapse guarded content cases into the table test Co-authored-by: Copilot App <[email protected]> * Match binary terminal errors with errors.AsType Co-authored-by: Copilot App <[email protected]> * Reuse the raw gist content when writing it out Co-authored-by: Copilot App <[email protected]> * Cover the non-truncated gist file path Co-authored-by: Copilot App <[email protected]> * Document the refusal guarantee on CopyGuardedContent Co-authored-by: Copilot App <[email protected]> * Clear stale content when unmarshaling JSON null Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: 53357989-fb84-4835-9eee-258d59e755e5 * Merge commit from fork * feat(safeurl): add SafeURL package and CodeQL enforcement query Introduce internal/safeurl, which builds HTTP request URLs from variable components that are percent-encoded when rendered, so user or server controlled values cannot break the path or change which resource is addressed. It provides the SafeURL interface, the MutableSafeURL and ImmutableSafeURL implementations, the JoinPath and JoinPathWithHostPrefix builders, and NewImmutableSafeURL for entrusting already-formed URLs. Because percent-encoding leaves a component that is exactly ".." intact as a real path segment, JoinPath and JoinPathWithHostPrefix reject any such component and return an error, which callers bubble up to the command level. Also add a CodeQL query that flags any HTTP request URL argument that is not literally the result of a safeurl.SafeURL.String call. Co-authored-by: Copilot <[email protected]> * refactor(api): route REST paths through SafeURL Build the hand-written REST paths in the shared API layer with safeurl so their variable components are escaped. CreateRepoTransformToV4 now takes a safeurl.SafeURL path instead of a string. Co-authored-by: Copilot <[email protected]> * refactor(repo): build REST paths with SafeURL Escape the variable components of the repo command REST paths. The new read-file command builds its Contents API URL with safeurl, and the repo create and edit commands pass a safeurl.SafeURL to CreateRepoTransformToV4. Co-authored-by: Copilot <[email protected]> * refactor(run): build REST paths with SafeURL Escape the variable components of the run command REST paths. GetJobs no longer mutates the Run; it takes an entrusted jobs URL and a run id and returns the jobs, so its callers assign them explicitly. Co-authored-by: Copilot <[email protected]> * refactor(release): build REST paths with SafeURL Escape the variable components of the release command REST paths. The upload and delete-asset pipeline threads a safeurl.SafeURL through, so the asset upload URL and AssetForUpload.ExistingURL are carried as SafeURL. Co-authored-by: Copilot <[email protected]> * refactor(codespace): build REST paths with SafeURL Escape the variable components of the codespace command REST paths. The NWO validation helper moves out of safeurl into the codespace package, where it is the only remaining caller. Co-authored-by…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
--cloneflag ingh repo forkis a boolean flag, but the help text didn't signal that it accepts an optional value, leaving users unaware that--clone=falseis valid.Changes
Longhelp text inpkg/cmd/repo/fork/fork.goexplaining that--clone,--clone=true, and--clone=falseare all valid.