GitHub CLI 2.90.0

Released: 2026-04-16

Release notes

FEATURE

New gh skill commands let you find, install, preview, update, and publish skills

You can now use gh skill to search for, preview, install, update, and publish skills: instruction packages that teach an AI or tool a particular job. If you enter an unknown command, GitHub CLI can suggest an official extension to install. Installing extensions and local-only skill options no longer require an authentication check. The api and auth commands also record agentic invocations. Publishing now pushes unpushed commits first and uses the target directory's remote. Search also keeps same-named skills from different namespaces separate, handles encoded parent paths, and gh release list --limit 0 no longer loops forever. It is like a tool shop where you can inspect an item, take it home, and have the clerk send your pending paperwork with it.

FEATURE

Skill publishing documentation and checks are clearer and steadier

You now get clearer security and operating notes when verifying downloads or publishing skills. Documentation adds PGP key fingerprints, SHA/MD5 checksums for keyring files, the corrected SHA512 value, and a dependency CVE policy; it also documents skill commands and agent skills. Internally, the CLI updates Go, replaces a compression package, removes an old Debian development script, and adds recommendations, code reviewers, shared discovery, and tests around official extensions and skill packages. Publish tests no longer invoke real Git, --dry-run messages match, and redundant fallback logic is gone. It is like registered mail: the seal, verification code, and delivery rules are explicit, and the route has been rehearsed at a practice counter.

FEATURE

Underlying dependency updates and new contributor credits

This release also refreshes the invisible parts that support GitHub CLI: dependencies for compression, Markdown, terminal interfaces, container images, signing, attestation, security scanning, network communication, and version parsing all move forward. These updates do not add a button for you; they keep the underlying parts on their newer releases. The notes also credit five first-time contributors. It is like servicing a car: belts, filters, and connectors inside the engine are renewed one by one, while the dashboard looks the same and the drive depends on them.

Original changelog

Original changelogNew gh skill commands let you find, install, preview, update, and publish skills
Add `gh skill` command group: install, preview, search, update, publish by @SamMorrowDrums and @tommaso-moro in https://github.com/cli/cli/pull/13165
Suggest and install official extensions for unknown commands by @BagToad in https://github.com/cli/cli/pull/13175
`gh skill publish`: auto-push unpushed commits before publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13171
Disable auth check for `gh extension install` by @BagToad in https://github.com/cli/cli/pull/13176
Fix infinite loop in `gh release list --limit 0` by @Bahtya in https://github.com/cli/cli/pull/13097
Ensure `api` and `auth` commands record agentic invocations by @williammartin in https://github.com/cli/cli/pull/13046
Disable auth check for local-only skill flags by @SamMorrowDrums in https://github.com/cli/cli/pull/13173
URL-encode parentPath in skills discovery API call by @SamMorrowDrums in https://github.com/cli/cli/pull/13172
Fix: use target directory remotes in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13169
Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in https://github.com/cli/cli/pull/13170
Original changelogSkill publishing documentation and checks are clearer and steadier
docs: include PGP key fingerprints by @babakks in https://github.com/cli/cli/pull/13112
docs: add sha/md5 checksums of keyring files by @babakks in https://github.com/cli/cli/pull/13150
docs: fix SHA512 checksum for GPG key by @timsu92 in https://github.com/cli/cli/pull/13157
docs(skill): polish skill commandset docs by @babakks in https://github.com/cli/cli/pull/13183
Document dependency CVE policy in SECURITY.md by @BagToad in https://github.com/cli/cli/pull/13119
Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in https://github.com/cli/cli/pull/13048
chore: bump to go1.26.2 by @babakks in https://github.com/cli/cli/pull/13116
chore: delete experimental script/debian-devel by @babakks in https://github.com/cli/cli/pull/13127
Suggest first party extensions by @williammartin in https://github.com/cli/cli/pull/13182
Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in https://github.com/cli/cli/pull/13189
Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in https://github.com/cli/cli/pull/13190
Address post-merge review feedback for skills commands by @SamMorrowDrums in https://github.com/cli/cli/pull/13185
Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in https://github.com/cli/cli/pull/13187
Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in https://github.com/cli/cli/pull/13188
Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13168
Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in https://github.com/cli/cli/pull/13167
Original changelogUnderlying dependency updates and new contributor credits
chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13071
chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13045
chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13051
chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13152
chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13129
chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13128
chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13044
chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12918
chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13076
chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13065
@thaJeztah made their first contribution in https://github.com/cli/cli/pull/13048
@Bahtya made their first contribution in https://github.com/cli/cli/pull/13097
@timsu92 made their first contribution in https://github.com/cli/cli/pull/13157
@SamMorrowDrums made their first contribution in https://github.com/cli/cli/pull/13173
@tommaso-moro made their first contribution in https://github.com/cli/cli/pull/13165