發布日期：2026-05-27
這批修的是幾個跟認證、API 檢查有關的準確度問題。以前 secrets（機密資訊，例如 API 金鑰）只能綁在使用者或 repository（儲存庫）上，現在也能讓 agent（代理，例如自動化機器人）以 application（應用程式身分）的名義使用 secrets。查詢 PR（pull request，程式碼合併請求）時，以前有個「只認編號」的優化捷徑會跳過 API 驗證，可能讓查詢結果不準，現在拿掉這個捷徑，改成每次都好好驗證。以前遇到 401（未授權）錯誤只丟出一個看不懂的錯誤，現在會直接印出「請跑 gh auth refresh」提醒你該重新驗證登入了。gh copilot 指令執行失敗時，以前只丟錯誤訊息，現在會提示你直接跑 copilot 指令排查。像 ATM 提款失敗時不再只顯示錯誤代碼，而是直接告訴你下一步該怎麼做。
這批是供應鏈安全（確保下載的軟體沒被竄改）的強化。gh release verify（驗證發布版本完整性的指令）現在會依 ref（版本標籤）長度自動判斷該用哪種 digest algorithm（雜湊演算法，驗證檔案有沒有被改過的方法），驗證更準確。CLI 建置流程把驗證用的 actions/attest-build-provenance 換成 actions/attest（GitHub 另一款官方認證動作）。專案的 GitHub Actions（自動化流程腳本）裡，first-party（GitHub 自己維護）的動作改用 SHA（固定版本雜湊值）釘死版本，不因對方改版悄悄變不同內容。文件也註記從 v2.93.0 起，GitHub Releases 會變 immutable（不可變更，發布後鎖死不能再改）。像貨物出廠前多蓋一層封條，用固定版號的檢驗員，貨才不會被中途調包。
這批是安裝文件和小地方的修正。官方安裝指令說明更新了；某些 Linux 發行版（dnf 系）的安裝指令原本多帶了一段沒必要的 --repo gh-cli，也拿掉了；Windows 上執行某些指令時，背景會閃過一個 tzutil 主控台視窗，現在修掉了這個閃爍；文件裡重複打錯字、文法小錯也一併修正。其餘是外部 PR 審查流程、telemetry（遙測，回報使用狀況的統計資料）調整跟相依套件版本更新，不影響日常操作。像把說明書裡多餘的贅字和印刷錯字一次校完，操作起來更順眼。
This batch fixes a handful of accuracy issues around authentication and API checks. Secrets (sensitive values like API keys) used to be scoped only to a user or a repository; now an agent (an automated bot, for example) can also use secrets under an application identity. Looking up a PR (pull request) by number used to take a "number-only" shortcut that skipped API validation, which could return inaccurate results; that shortcut is gone, so every lookup is validated now. Hitting a 401 (unauthorized) error used to just print an unhelpful error; now it prints "run gh auth refresh" to tell you exactly what to do. When gh copilot fails to run, it now hints you to run the copilot command directly to troubleshoot, instead of just showing an error. It's like an ATM that no longer just flashes an error code when a withdrawal fails, but tells you directly what to do next.
This batch strengthens supply-chain security (making sure the software you download hasn't been tampered with). gh release verify (the command that checks a release's integrity) now derives the right digest algorithm (the hashing method used to verify content hasn't changed) from the length of the ref (version tag), making verification more accurate. The CLI's own build pipeline switched its verification action from actions/attest-build-provenance to actions/attest (another official GitHub-hosted attestation action). In the project's own GitHub Actions (automation scripts), first-party actions (ones GitHub itself maintains) are now pinned by SHA (a fixed version hash), so they can't silently change content if the upstream action gets updated. Docs also now note that starting with v2.93.0, GitHub Releases become immutable (locked after publishing — no more edits). It's like sealing a shipment before it leaves the factory and using an inspector who only checks a fixed batch number, so the goods can't be swapped mid-transit.
This batch is installation-docs and small polish fixes. The official install command docs were updated; some Linux distros (the dnf family) had an unnecessary --repo gh-cli in their install commands, which is now removed; on Windows, running certain commands used to flash a tzutil console window in the background — that flicker is fixed; and a duplicated word plus a grammar typo in the docs were also corrected. The rest is extended PR-screening process work, telemetry (usage-reporting statistics) adjustments, and dependency version bumps that don't affect day-to-day use. It's like proofreading a manual to remove extra filler words and typos in one pass — everything just reads cleaner now.
Allow agents as application for secrets by @tenjaa in https://github.com/cli/cli/pull/13421
fix(pr): remove numberFieldOnly optimization that skips API validation by @williammartin in https://github.com/cli/cli/pull/13327
Print `gh auth refresh` for 401 returns by @333fred in https://github.com/cli/cli/pull/13068
fix(copilot): hint to run copilot directly when exec fails by @babakks in https://github.com/cli/cli/pull/13393Derive digest algorithm from ref length in release verify commands by @bdehamer in https://github.com/cli/cli/pull/13430
Switch from actions/attest-build-provenance to actions/attest by @scop in https://github.com/cli/cli/pull/13325
Remove dependency on persistent token by @williammartin in https://github.com/cli/cli/pull/13474
SHA pin first-party GitHub Actions by @williammartin in https://github.com/cli/cli/pull/13491
docs: note immutable releases starting v2.93.0 by @BagToad in https://github.com/cli/cli/pull/13518
fix CI attestation integration tests after rename by @BagToad in https://github.com/cli/cli/pull/13536Add missing //go:build integration tag to verify_integration_test.go by @pdostal in https://github.com/cli/cli/pull/13303
Fix flaky accessible prompter Password test timeout by @pdostal in https://github.com/cli/cli/pull/13304
Enable extended PR screening for external PRs by @tidy-dev in https://github.com/cli/cli/pull/13312
Grammar fixes by @scop in https://github.com/cli/cli/pull/13326
Bump `gh copilot` telemetry sampling to 100% by @williammartin in https://github.com/cli/cli/pull/13362
Record accessibility feature state in telemetry by @williammartin in https://github.com/cli/cli/pull/13363
Poll TTY echo mode instead of sleeping in password tests by @pdostal in https://github.com/cli/cli/pull/13305
Fix skills acceptance tests by @williammartin in https://github.com/cli/cli/pull/13365
Bump Go toolchain to 1.26.3 by @Copilot in https://github.com/cli/cli/pull/13367
Trigger triage check-requirements on ready_for_review by @BagToad in https://github.com/cli/cli/pull/13383
Update installation commands for GitHub CLI by @sassdawe in https://github.com/cli/cli/pull/13126
Update CODEOWNERS for skills directory ownership by @williammartin in https://github.com/cli/cli/pull/13416
fix(telemetry): prevent tzutil console flash on Windows by @adehad in https://github.com/cli/cli/pull/13353
Fix bump-go.sh to tolerate missing toolchain directive by @Copilot in https://github.com/cli/cli/pull/12581
docs: drop --repo gh-cli from dnf install lines by @c-tonneslan in https://github.com/cli/cli/pull/13444
Remove third-party license debris by @williammartin in https://github.com/cli/cli/pull/13470
Remove discussion workflow by @williammartin in https://github.com/cli/cli/pull/13476
Stop bumping homebrew on release by @williammartin in https://github.com/cli/cli/pull/13479
build: update golang.org/x/crypto by @tommaso-moro in https://github.com/cli/cli/pull/13486
Add 3 day dependabot cooldown period by @williammartin in https://github.com/cli/cli/pull/13488
Run govulncheck daily instead of weekly by @williammartin in https://github.com/cli/cli/pull/13487
Link to Accessibility category for community discussions instead of ACR by @mxie in https://github.com/cli/cli/pull/13481
docs: fix duplicated "of" in release-process-deep-dive by @vip892766gma in https://github.com/cli/cli/pull/13425
chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @BagToad in https://github.com/cli/cli/pull/13510
chore(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13297
chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13328
chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13381
chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13396
chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13346
chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13397
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13420
chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13436
chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13461
chore(deps): bump github/codeql-action from 4 to 4.35.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13489
chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13462
chore(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13457
@pdostal made their first contribution in https://github.com/cli/cli/pull/13303
@333fred made their first contribution in https://github.com/cli/cli/pull/13068
@scop made their first contribution in https://github.com/cli/cli/pull/13326
@sassdawe made their first contribution in https://github.com/cli/cli/pull/13126
@adehad made their first contribution in https://github.com/cli/cli/pull/13353
@c-tonneslan made their first contribution in https://github.com/cli/cli/pull/13444
@tenjaa made their first contribution in https://github.com/cli/cli/pull/13421
@mxie made their first contribution in https://github.com/cli/cli/pull/13481
@vip892766gma made their first contribution in https://github.com/cli/cli/pull/13425