GitHub CLI 2.98.0

正寫程式寫到一半，同事突然請你幫忙測試別人的 PR（pull request，請求將程式碼合併進專案的提案）。

這正是輸入 gh pr checkout 123 --worktree 的時刻。加上 --worktree 旗標後，系統會替該 PR 建立獨立的工作樹（worktree，Git 讓同一專案平行開多份副本的功能）。你能在新資料夾查看與測試變更，目前的檔案與分支留在原地，不必先把未完成的修改暫存收起。

在專案裡搜尋 issue（議題，追蹤問題與建議的討論清單）時，以前只能比對一模一樣的關鍵字。

gh search issues 現在新增了 --search-type 旗標，支援語意搜尋與混合搜尋兩種模式。當你記不清確切的錯誤文字時，輸入概念描述並加上 --search-type semantic，便能依背後涵義找出相近的討論；加上 --search-type hybrid 則會同時比對關鍵字與語意。

撰寫或執行 GitHub CLI 擴充套件（extension，為 gh 新增自訂指令的附加工具）時，程式往往需要知道自己是怎麼被啟動的。

gh 現在在叫用任何擴充套件時，都會在環境變數（開程式之前預先塞給它的隱藏開關，一般使用者看不到）自動帶上 GH_EXTENSION=1。這讓擴充套件能藉由檢查該變數，確認自己正在被 gh 呼叫，並據此調整輸出格式或執行流程。

建立 Release 時，gh release create 需要從 X-Oauth-Scopes 標頭讀取權限範圍。現在解析時會去掉前後多餘空白，避免空白被當成權限名稱的一部分。修正處理的是標頭文字的辨識，讓權限範圍能按原本的名稱解讀。空白不會參與辨識。

手邊的 GitHub CLI 指令照舊可用，不必因內部 API 連線架構重整而切換操作方式。

開發團隊將七項操作的 HTTP 請求全面收攏至統一的 api.Client（負責管理連線與驗證的共用用戶端模組）。涵蓋對象包含 deploy key、ssh key、gpg key 三類金鑰，以及 autolink 自動連結、extension 擴充套件、release 建立與 release 刪除。請求集中由共用用戶端發送後，程式碼結構更乾淨，連線行為也維持一致。

專案把垃圾 issue 的分流整合進 agentic issue-triage 工作流程，並恢復自動關閉垃圾 issue。用來執行分流的 Action 相容性也已修正。分類與結案因而放在同一條處理路徑上，並確保這條路徑能相容執行。

送出 PR（pull request，請求將程式碼合併進專案的提案）後，審查工作現在要求明確指定負責人。每一份等待審查的變更都要知道由誰接手，責任不再停留在未指派的狀態。這項規則只聚焦於審查歸屬的明確性。每份 PR 的審查責任都有明確歸屬。不再模糊。

Dependabot（自動檢查相依套件更新的機器人）分流現在每小時執行。它的留言變短，判斷流程也改得更省成本、更果斷，並加入真正的程式碼可達性檢查：確認程式碼路徑是否真的能走到漏洞。它不只看到相依套件的問題，也會檢查程式實際能否觸及該問題。不是只看清單上的名稱。

協助專案開發的 AI 代理準備提交 PR（pull request，請求將程式碼合併進專案的提案）時，現在必須依 AGENTS.md 規定的 PR 範本填寫。相關指引也進一步釐清了測試章節的填寫範圍，明確指出哪些驗證細節應記錄在該欄位。

這讓代理提交變更時有統一的交件標準，協助審查者迅速確認測試狀況。

專案維護久了，程式庫常累積零星的待辦標記、過時設定或待整理的舊結構，平時卻抽不出完整時間手動整理。專案現在為 AI 代理新增了排程清理技術債技能（tech debt burndown skill，定期處理專案累積技術債務的專用指令技能）。在排程設定中啟用並排定觸發時間後，代理便會按固定週期自動檢視並清理這些技術債。

透過將清債任務標準化與排程化，專案能持續維持程式碼的整潔度與健康度。

專案調整了程式碼審查技能的命名，將原本的 cli-code-reviewer 正式更名為更簡短的 code-review。這項變更讓技能名稱更直覺且符合日常用法，去除多餘的前綴詞後也更容易被指令系統與開發者辨識。

這次更名僅調整技能識別名稱，不影響原有的審查功能與運作機制。

Linux 系統的 APT 套件庫現在同時以兩把金鑰進行簽署。在 CI（持續整合，自動執行檢查的流程）中，團隊先前曾短暫加入驗證 Linux 套件庫簽署金鑰的臨時步驟，在確認簽署狀態正常後隨即撤回該臨時步驟。整項改動僅涉及雙金鑰簽署與臨時驗證步驟的清理。

你在自己的電腦上跑測試時，登入認證與 Git 設定本來就可能和其他人的不同，讓測試帶著個人環境的影子。這次調整把測試和本機的認證、Git 設定隔開，使測試執行時不再讀取這兩類本機資料。

重點不是換掉你的認證或 Git 設定，而是讓測試不依賴它們。

部署流程驗證版本標籤時，現在接受預發布（pre-release，正式發布前使用的版本標籤）標籤。預發布標籤用來標示正式發布之前的版本；部署驗證會把這一類標籤視為可接受的輸入。

這項調整只改部署驗證對標籤的接受條件，讓使用預發布標籤的部署流程不必在驗證處被擋下。

程式碼把已淘汰的 reflect.Ptr 改為 reflect.Pointer，完成一次 API（應用程式介面，程式用來呼叫功能的固定方式）替換。這不是新增另一種呼叫方式，而是將原先使用的過時名稱換成目前的名稱。

若你正在閱讀相關程式碼，看到 reflect.Pointer 就是在辨認這項替換後使用的 API。

功能偵測（feature detection，先確認功能是否可用的做法）不需要清理時，現在不再要求清理註解。這條規則把是否需要清理當成是否提出註解要求的界線：有清理需要的地方可留下相應註解，沒有清理需要的地方則不因同一件事再被要求補註。

改動的重點是刪除不必要的要求，讓註解要求和實際清理需要對齊。

Dependabot 設定新增 aw-actions 群組，並更新 aw-actions、codeql-actions、sigstore-go、gRPC、go-containerregistry、actions/attest、azure/login、goldmark、protobuf、testify、x/crypto、lipgloss 與壓縮函式庫。Go 依序升至 1.26.6、1.26.7，CI 的 golangci-lint 升至 v2.12.2；gh-aw workflows 升至 v0.85.4，gh-aw-actions 升至 v0.87.1 並重新編譯 agentic workflows。

While coding mid-task, a teammate asks you to test someone's PR (pull request).

That is the moment to run gh pr checkout 123 --worktree. Passing the --worktree flag creates an independent worktree, Git's feature for parallel working copies. You can inspect and test the changes in a separate folder while your current branch and files stay undisturbed.

When searching for issues in a repository, you used to rely strictly on exact keyword matches.

gh search issues now introduces the --search-type flag, supporting both semantic and hybrid search modes. If you cannot remember the exact error text, pass --search-type semantic with a natural concept description to find relevant issues by meaning; using --search-type hybrid combines traditional keyword matching with semantic understanding.

When writing or running a GitHub CLI extension (an add-on tool that introduces custom commands to gh), the program often needs to know how it was started.

When gh invokes any extension, it now automatically sets the environment variable GH_EXTENSION=1. Extensions can check this variable to confirm they are running under gh and adjust their output formatting or behavior accordingly.

When creating a release, gh release create reads permission scopes from the X-Oauth-Scopes header. Its parser now strips extra surrounding whitespace so that whitespace is not treated as part of a scope name.

Your existing GitHub CLI commands remain the same despite an internal API architecture refactor.

The team routed HTTP requests for seven operations through the unified api.Client (the shared client module managing connections and authentication). This covers deploy keys, ssh keys, gpg keys, autolinks, extensions, release creation, and release deletions. Routing these calls through a single client keeps network logic clean and consistent across the codebase.

The project folded spam-issue triage into the agentic issue-triage workflow and restored automatic closure of spam issues. Compatibility for the Action that runs triage is fixed too.

After a PR (pull request) is submitted, review work now requires an explicitly named owner. Every pending change should have a person responsible for taking it up.

Dependabot (the bot that checks dependency updates) triage now runs every hour. Its comments are shorter, its decisions are cheaper and more decisive, and it now performs a real code-reachability check: whether a code path can actually reach a vulnerability.

When an AI agent prepares to submit a PR (pull request), AGENTS.md now directs it to follow the standard pull request template. The guidelines also clarify what belongs in the PR template's testing section, defining which verification details must be recorded.

These updates give agents clear rules for submitting changes so reviewers can quickly assess test coverage.

As a repository grows, it often accumulates lingering TODOs, outdated configurations, or disorganized code structures that developers rarely have dedicated time to clean up. The project now introduces a scheduled tech debt burndown skill for AI agents. Once configured with a schedule, the agent automatically triggers on a recurring interval to inspect the codebase and clean up technical debt.

Standardizing and scheduling these cleanups helps teams keep the repository tidy and maintainable over time.

The repository renamed the cli-code-reviewer skill to the simpler and more concise code-review. Dropping the verbose prefix makes the skill name more intuitive and easier to recognize when invoking agent capabilities.

This update changes only the identifier, leaving the underlying review functionality unchanged.

The Linux APT repository is now signed with both keys simultaneously. In CI (continuous integration, an automated checking process), the team briefly added a temporary step to verify the repository signing keys, then promptly reverted that check after confirming the setup. The update focuses strictly on the dual-key signing and cleaning up the temporary verification step.

When you run tests on your own machine, its authentication and Git configuration can differ from someone else's and leak personal-environment details into the run. This change isolates tests from both kinds of local data, so they no longer read local authentication or Git configuration.

Your credentials and Git settings are not being replaced; the tests simply no longer depend on them.

When a deployment flow validates a version tag, it now accepts a pre-release tag, a tag for a version before formal release. Deployment validation therefore treats that tag type as acceptable input.

The change is limited to which tags deployment validation accepts, so a deployment using a pre-release tag is not stopped at that check.

Code now replaces deprecated reflect.Ptr with reflect.Pointer, completing an API (application programming interface, a fixed way for programs to call a capability) substitution. This does not add a second way to make the call; it changes the outdated name that the code used to the current one.

When reading the relevant code, reflect.Pointer is the API used after this replacement.

When feature detection (checking whether a capability is available) needs no cleanup, it no longer requests a cleanup comment. Whether cleanup is needed now forms the boundary for asking for that comment: a corresponding comment can be left where cleanup is needed, but an item needing none is not asked for one.

The change removes an unneeded request so that the request for a comment matches the actual need for cleanup.

Dependabot configuration now includes an aw-actions group, while aw-actions, codeql-actions, sigstore-go, gRPC, go-containerregistry, actions/attest, azure/login, goldmark, protobuf, testify, x/crypto, lipgloss, and a compression library were updated. Go moved through 1.26.6 to 1.26.7, CI's golangci-lint reached v2.12.2, gh-aw workflows reached v0.85.4, and gh-aw-actions reached v0.87.1 with agentic workflows recompiled.