Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features

• Add name-based resolution to gh project item-edit by @zwick in #13807
• Add named field columns to gh project item-list by @zwick in #13823
• Add Grok skill host support by @tommaso-moro in #13864
• Replace Windsurf with Devin in gh skill agents by @tommaso-moro in #13987

🐛 Fixes

• Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @malancas in #13624
• Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @kofuk in #13787
• Fix skill picker label wrapping by @tommaso-moro in #13967

📚 Docs & Chores

• Bump Go to 1.26.5 by @github-actions[bot] in #13817
• Add OWNER/REPO format hint to the gh search --repo flag by @BagToad in #13922
• Present by-name item-edit as the first-class project flow in docs by @Solaris-star in #13927
• Add a macOS keyring security doc by @williammartin in #13960
• Add a code review agent skill by @BagToad in #14003
• Establish a pull request template for scale by @BagToad in #14004
• Add an agentic issue-triage workflow by @lukewar in #13777
• Use the Actions token for Copilot inference in the issue-triage workflow by @tidy-dev in #13830
• Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by @alondahari in #13949
• Add a dependabot-triage agentic workflow by @williammartin in #13985
• Harden the deployment workflow by @niik in #13780
• Replace SITE_DEPLOY_PAT with the gh-cli-site-deployer App by @williammartin in #13492
• Group CodeQL Dependabot updates by @williammartin in #13943
• Remove a dead CODEOWNERS rule for the non-existent pkg/cmd/release/attestation/ by @kobihikri in #13886
• Fix typos in code and documentation by @pstoeckle in #13940
• Fix duplicated-word typos in comments by @SORBELLOSTEFANIE in #13900

Dependencies

• chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by @dependabot in #13790
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot in #13789
• chore(deps): bump https://github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot in #13791
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by @dependabot in #13800
• chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by @dependabot in #13812
• chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot in #13821
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot in #13801
• chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by @dependabot in #13832
• chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by @dependabot in #13813
• chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot in #13822
• chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by @dependabot in #13843
• chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by @dependabot in #13841
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot in #13867
• chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by @dependabot in #13869
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot in #13868
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by @dependabot in #13870
• chore(deps): bump https://github.com/yuin/goldmark from 1.8.2 to 1.8.4 by @dependabot in #13888
• chore(deps): bump https://github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 by @dependabot in #13842
• chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by @dependabot in #13877
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot in #13933
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot in #13934
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot in #13936
• chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by @dependabot in #13935
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.22 to 0.0.23 by @dependabot in #13937
• chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by @dependabot in #13938
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #13941
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot in #13942
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 by @dependabot in #13944
• chore(deps): bump nodeselector/setup-apple-codesign from ab275d0 to 309922b by @dependabot in #13878
• chore(deps): bump https://github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot in #13950
• chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by @dependabot in #13951
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13965
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.23 to 0.0.24 by @dependabot in #13977
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13978
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.14 to 1.4.15 by @dependabot in #13976
• chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by @dependabot in #13979
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by @dependabot in #13980
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot in [#13981](https://github.com/cli/cli...

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features

• Allow gh release download without authentication on public repositories by @BagToad in #13723
• Detect additional third-party coding agents by @BagToad in #13722
• Support antigravity-cli and antigravity2.0 in gh skill by @BagToad in #13784

🐛 Fixes

• fix: show checks summary when all checks were cancelled by @s3onghyun in #13679
• fix(skills): install universal agent to ~/.agents/skills by @toller892 in #13681
• fix(skills): honor --dir without agent prompt by @happysnaker in #13766
• Fix concurrent map writes in codespace port forwarding by @williammartin in #13313
• Use int64 for GitHub database IDs by @williammartin in #13403

📚 Docs & Chores

• Pin reusable triage workflows to a commit SHA by @BagToad in #13705
• Add security disclosure guidance to AGENTS.md by @BagToad in #13720
• Clarify --clone boolean flag behaviour in gh repo fork help by @BagToad in #13786
• Fix flaky TestHuhPrompterMultiSelectWithSearchPersistence on slow architectures by @pdostal in #13675
• docs(search): add examples for multiple qualifiers by @happysnaker in #13756
• docs: fix broken anchor link in release-process-deep-dive by @patrickwehbe in #13688
• docs: fix broken install command and link/grammar errors by @patrickwehbe in #13690
• docs: fix duplicated word in primer README by @s3onghyun in #13677

Dependencies

• chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by @dependabot in #13708
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #13703
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot in #13702
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #13740
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot in #13754
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot in #13759
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #13779

New Contributors

• @patrickwehbe made their first contribution in #13688
• @s3onghyun made their first contribution in #13679
• @toller892 made their first contribution in #13681
• @happysnaker made their first contribution in #13756

Full Changelog: v2.95.0...v2.96.0

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

What's Changed

✨ Features

• feat: add repo read-file and repo read-dir by @babakks in #13580
• feat(skills): list available skills when install runs non-interactively by @SamMorrowDrums in #13548
• Support custom CLAUDE_CONFIG_DIR in install by @tommaso-moro in #13523

🐛 Fixes

• fix(skills): stage updates in a temp dir and swap in-place by @SamMorrowDrums in #13449

📚 Docs & Chores

• Make filtering by bot authors more discoverable by @BagToad in #13642
• docs(discussion): polish help docs by @babakks in #13632
• Bump Go in devcontainer by @spenserblack in #13674

Dependencies

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in #13640
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @dependabot[bot] in #13663
• chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in #13661
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #13619
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @dependabot[bot] in #13662
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #13641

Full Changelog: v2.94.0...v2.95.0

Issue types, sub-issues, and relationships in gh issue

This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

Manage discussions with gh discussion

This release introduces the discussion command set for working with GitHub Discussions in gh:

# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>

Run gh discussion --help for more information.

Equip your agents with new gh features

Teach your agents how to leverage new GitHub CLI features on release day by installing the gh skill:

# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh

What's Changed

✨ Features

• Add gh discussion command set (list, view, create, edit) as a preview by @babakks and @maxbeizer in #13541
• Add gh discussion comment to comment on and reply to discussions by @babakks in #13620
• Add Issues 2.0 support: issue types, sub-issues, and relationships by @BagToad in #13057
• Add gh skill list to inventory installed agent skills by @tommaso-moro in #13418
• Add --all flag to gh skill install to install every skill in a repository by @tommaso-moro in #13471
• Skip skills without metadata when running gh skill update --all by @tommaso-moro in #13469
• Alias gh extension uninstall to gh extension remove by @BagToad in #13599
• Auto-install official extensions in CI by @BagToad in #13581

🐛 Fixes

• fix(skill): support skill discovery in nested directories by @tommaso-moro in #13459

📚 Docs & Chores

• Bump Go to 1.26.4 by @github-actions[bot] in #13578
• Clean up deferred issue update helper by @BagToad in #13584
• Add terminal-mockup canvas extension for marketing screenshots by @BagToad in #13612
• Add gh discussion and Issues 2.0 reference to the gh skill, plus a README note by @BagToad in #13631

Dependencies

• chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot in #13521
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10 by @dependabot in #13520
• chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @dependabot in #13572
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7 by @dependabot in #13595
• chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot in #13596
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot in #13597

Full Changelog: v2.93.0...v2.94.0

Security

A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.

Users are advised to update gh to version v2.93.0 as soon as possible.

For more information see: GHSA-8xvp-7hj6-mcj9

Support agents in gh secret command set

The gh secret command set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".

What's Changed

✨ Features

• Allow agents as application for secrets by @tenjaa in #13421

🐛 Fixes

• fix(pr): remove numberFieldOnly optimization that skips API validation by @williammartin in #13327
• Print gh auth refresh for 401 returns by @333fred in #13068
• Derive digest algorithm from ref length in release verify commands by @bdehamer in #13430

📚 Docs & Chores

• Add missing //go:build integration tag to verify_integration_test.go by @pdostal in #13303
• Fix flaky accessible prompter Password test timeout by @pdostal in #13304
• Enable extended PR screening for external PRs by @tidy-dev in #13312
• Grammar fixes by @scop in #13326
• Bump gh copilot telemetry sampling to 100% by @williammartin in #13362
• Record accessibility feature state in telemetry by @williammartin in #13363
• Poll TTY echo mode instead of sleeping in password tests by @pdostal in #13305
• Switch from actions/attest-build-provenance to actions/attest by @scop in #13325
• Fix skills acceptance tests by @williammartin in #13365
• Bump Go toolchain to 1.26.3 by @Copilot in #13367
• Trigger triage check-requirements on ready_for_review by @BagToad in #13383
• fix(copilot): hint to run copilot directly when exec fails by @babakks in #13393
• Update installation commands for GitHub CLI by @sassdawe in #13126
• Update CODEOWNERS for skills directory ownership by @williammartin in #13416
• fix(telemetry): prevent tzutil console flash on Windows by @adehad in #13353
• Fix bump-go.sh to tolerate missing toolchain directive by @Copilot in #12581
• docs: drop --repo gh-cli from dnf install lines by @c-tonneslan in #13444
• Remove third-party license debris by @williammartin in #13470
• Remove dependency on persistent token by @williammartin in #13474
• Remove discussion workflow by @williammartin in #13476
• Stop bumping homebrew on release by @williammartin in #13479
• build: update golang.org/x/crypto by @tommaso-moro in #13486
• Add 3 day dependabot cooldown period by @williammartin in #13488
• Run govulncheck daily instead of weekly by @williammartin in #13487
• SHA pin first-party GitHub Actions by @williammartin in #13491
• Link to Accessibility category for community discussions instead of ACR by @mxie in #13481
• docs: fix duplicated "of" in release-process-deep-dive by @vip892766gma in #13425
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @BagToad in #13510
• docs: note immutable releases starting v2.93.0 by @BagToad in #13518
• fix CI attestation integration tests after rename by @BagToad in #13536

Dependencies

• chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 by @dependabot[bot] in #13297
• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #13328
• chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in #13381
• chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in #13396
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #13346
• chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in #13397
• chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #13420
• chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #13436
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #13461
• chore(deps): bump github/codeql-action from 4 to 4.35.5 by @dependabot[bot] in #13489
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.4.1 to 2.4.2 by @dependabot[bot] in #13462
• chore(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #13457

New Contributors

• @pdostal made their first contribution in #13303
• @333fred made their first contribution in #13068
• @scop made their first contribution in #13326
• @sassdawe made their first contribution in #13126
• @adehad made their first contribution in #13353
• @c-tonneslan made their first contribution in #13444
• @tenjaa made their first contribution in #13421
• @mxie made their first contribution in #13481
• @vip892766gma made their first contribution in #13425

Full Changelog: v2.92.0...v2.93.0

Security

A security vulnerability has been identified, and fixed, that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed.

Users are advised to update gh to version v2.92.0 as soon as possible.

For more information see: GHSA-crc3-h8v6-qh57

Support GitHub Enterprise Cloud (GHEC) in skill commandset

Now gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts with data residency.

Add --allow-hidden-dirs flag to skill preview

Following the addition of --allow-hidden-dirs to skill install in the previous release, now the flag is also supported in skill preview, allowing users to preview skills located in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

What's Changed

✨ Features

• feat(skills): add --allow-hidden-dirs flag to preview command by @SamMorrowDrums in #13265
• feat(skills): support GHEC with data residency hosts by @SamMorrowDrums in #13264

🐛 Fixes

• Fix SetSampleRate not updating sample_rate dimension by @williammartin in #13259
• Fix log terminal injection by @williammartin in #13272
• Add "Resource not accessible" to ProjectsV2IgnorableError by @maxbeizer in #13281

📚 Docs & Chores

• fix: using variable interpolation `${{ in deployment.yml... by @orbisai0security in #13258
• docs: correct typo in Linux Homebrew copy by @cassidyjames in #13273
• Install skills flat by Name, not namespaced InstallName by @SamMorrowDrums in #13266
• chore: fix zsh completion on debian by @babakks in #13274
• Add trust disclaimer to extension help text by @travellertales in #13296
• Bump Go to 1.26.2 by @github-actions[bot] in #13301

Dependencies

• chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by @dependabot[bot] in #13161
• chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in #13162
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 by @dependabot[bot] in #13163
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 by @dependabot[bot] in #13206
• chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 by @dependabot[bot] in #13241
• chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in #13298

New Contributors

• @orbisai0security made their first contribution in #13258
• @cassidyjames made their first contribution in #13273
• @travellertales made their first contribution in #13296

Full Changelog: v2.91.0...v2.92.0

GitHub CLI now collects pseudonymous telemetry

To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry.

See Telemetry for more details on what's collected, why, and how to opt out.

Support more agents in gh skill

Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help for the list of available agents.

Improve skill discovery

gh skill install now adds the --allow-hidden-dirs flag to support discovering skills in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

Detect skills re-published from other sources

GitHub CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The --upstream flag is also added for non-interactive use cases.

What's Changed

✨ Features

• Add support for installation in multiple agent hosts in gh skills install by @tommaso-moro in #13209
• Add --allow-hidden-dirs flag to gh skill install by @SamMorrowDrums in #13213
• Make skill discovery less strict: support nested skills/ directories by @SamMorrowDrums in #13235
• feat(skills): detect re-published skills and offer upstream install by @SamMorrowDrums in #13236

🐛 Fixes

• Fix skills publish --fix to not publish by @SamMorrowDrums in #13237
• fix(skills): match skills by install name in preview command by @SamMorrowDrums in #13249

📚 Docs & Chores

• Remove misleading text by @tommaso-moro in #13203
• Add sampled command telemetry by @williammartin in #13191
• Do not send telemetry for aliases by @williammartin in #13192
• Add skills specific telemetry by @williammartin in #13204
• Record CI context in telemetry by @williammartin in #13210
• Record official extension telemetry by @williammartin in #13205
• Add telemetry command by @williammartin in #13253
• Log when there is no telemetry by @williammartin in #13255
• docs(skills): add gh and gh-skill agent skills by @BagToad in #13244
• Enable telemetry without env var by @williammartin in #13254

Full Changelog: v2.90.0...v2.91.0

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features

• Add gh skill command group: install, preview, search, update, publish by @SamMorrowDrums and @tommaso-moro in #13165
• Suggest and install official extensions for unknown commands by @BagToad in #13175
• gh skill publish: auto-push unpushed commits before publish by @SamMorrowDrums in #13171
• Disable auth check for gh extension install by @BagToad in #13176

🐛 Fixes

• Fix infinite loop in gh release list --limit 0 by @Bahtya in #13097
• Ensure api and auth commands record agentic invocations by @williammartin in #13046
• Disable auth check for local-only skill flags by @SamMorrowDrums in #13173
• URL-encode parentPath in skills discovery API call by @SamMorrowDrums in #13172
• Fix: use target directory remotes in skills publish by @SamMorrowDrums in #13169
• Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in #13170

📚 Docs & Chores

• docs: include PGP key fingerprints by @babakks in #13112
• docs: add sha/md5 checksums of keyring files by @babakks in #13150
• docs: fix SHA512 checksum for GPG key by @timsu92 in #13157
• docs(skill): polish skill commandset docs by @babakks in #13183
• Document dependency CVE policy in SECURITY.md by @BagToad in #13119
• Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in #13048
• chore: bump to go1.26.2 by @babakks in #13116
• chore: delete experimental script/debian-devel by @babakks in #13127
• Suggest first party extensions by @williammartin in #13182
• Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in #13189
• Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in #13190
• Address post-merge review feedback for skills commands by @SamMorrowDrums in #13185
• Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in #13187
• Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in #13188
• Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in #13168
• Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in #13167

Dependencies

• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in #13071
• chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in #13045
• chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in #13051
• chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in #13152
• chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in #13129
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in #13128
• chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in #13044
• chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in #12918
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #13076
• chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in #13065

New Contributors

• @thaJeztah made their first contribution in #13048
• @Bahtya made their first contribution in #13097
• @timsu92 made their first contribution in #13157
• @SamMorrowDrums made their first contribution in #13173
• @tommaso-moro made their first contribution in #13165

Full Changelog: v2.89.0...v2.90.0

gh agent-task now works on ghe.com tenancies

gh agent-task commands previously failed with 401 Unauthorized for users on ghe.com tenancy hosts because the Copilot API URL was hardcoded. The URL is now resolved dynamically per host, so gh agent-task works correctly regardless of your GitHub hosting environment.

Experimental new prompter

A new TUI-based prompter powered by charmbracelet/huh is available behind the GH_EXPERIMENTAL_PROMPTER environment variable. This is an early preview — try it out and share feedback!

export GH_EXPERIMENTAL_PROMPTER=1

gh issue create and gh issue transfer no longer require extra token scopes

gh issue create and gh issue transfer previously fetched repository fields they didn't need, which could require additional token scopes. These commands now fetch only the minimal fields necessary for issue operations.

What's Changed

✨ Features

• gh pr create, gh issue create, gh issue edit: search-based assignee selection and login-based mutation on github.com by @BagToad in #13009
• Add experimental huh-only prompter gated by GH_EXPERIMENTAL_PROMPTER by @BagToad in #12859

🐛 Fixes

• fix(agent-task): resolve Copilot API URL dynamically for ghe.com tenancies by @BagToad in #12956
• fix(issue): avoid fetching unnecessary fields in issue create and issue transfer by @babakks in #12884
• fix: resolve data race in codespaces port forwarder by @Lslightly in #13033

📚 Docs & Chores

• Record agentic invocations in User-Agent header by @williammartin in #13023
• docs: clarify that gh pr edit --add-reviewer can re-request reviews by @joshjohanning in #13021
• Add AGENTS.md by @williammartin in #13024
• Fix typo: remove extra space in README.md link by @realMelTuc in #12725
• Align triage.md with current triage process by @tidy-dev in #13030
• Remove auto-labels from issue templates by @tidy-dev in #12972
• Consolidate actor-mode signals into ApiActorsSupported by @BagToad in #13025
• Fix acceptance test failures: git identity, headRepository JSON, obsolete traversal test by @BagToad in #13037

Dependencies

• chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #12963
• chore(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.3 by @dependabot[bot] in #12962
• chore(deps): bump github.com/zalando/go-keyring from 0.2.6 to 0.2.8 by @dependabot[bot] in #13031
• chore(deps): bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 by @dependabot[bot] in #13005
• chore(deps): bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by @dependabot[bot] in #13004
• chore(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #12951

New Contributors

• @joshjohanning made their first contribution in #13021
• @realMelTuc made their first contribution in #12725
• @Lslightly made their first contribution in #13033

Full Changelog: v2.88.1...v2.89.0

Fix pr commands failing with read:project scope error

v2.88.0 introduced a regression where pr commands would fail with the error:

error: your authentication token is missing required scopes [read:project]
To request it, run:  gh auth refresh -s read:project

Previously, missing read:project scope was gracefully handled, and project data was silently skipped. A change inadvertently broke the error matching that enabled this graceful degradation. v2.88.1 reverts these changes so that pr commands work correctly without requiring the read:project scope.

What's Changed

• Migrate Windows code signing from client secret to OIDC by @BagToad in #12911
• Revert "refactor: deduplicate scope error handling between api/client.go and project queries" by @williammartin in #12914
• Revert "fix: clarify scope error while creating issues for projects" by @williammartin in #12915

Full Changelog: v2.88.0...v2.88.1