Released: 2026-08-20
While coding mid-task, a teammate asks you to test someone's PR (pull request).
That is the moment to run gh pr checkout 123 --worktree. Passing the --worktree flag creates an independent worktree, Git's feature for parallel working copies. You can inspect and test the changes in a separate folder while your current branch and files stay undisturbed.
When searching for issues in a repository, you used to rely strictly on exact keyword matches.
gh search issues now introduces the --search-type flag, supporting both semantic and hybrid search modes. If you cannot remember the exact error text, pass --search-type semantic with a natural concept description to find relevant issues by meaning; using --search-type hybrid combines traditional keyword matching with semantic understanding.
When writing or running a GitHub CLI extension (an add-on tool that introduces custom commands to gh), the program often needs to know how it was started.
When gh invokes any extension, it now automatically sets the environment variable GH_EXTENSION=1. Extensions can check this variable to confirm they are running under gh and adjust their output formatting or behavior accordingly.
When gh status hits a retryable failure, the RESTWithNext error-type handling had prevented retries. That is fixed: both gh status and attestations (digital signatures that verify a software artifact's origin and build process) can retry again.
When creating a release, gh release create reads permission scopes from the X-Oauth-Scopes header. Its parser now strips extra surrounding whitespace so that whitespace is not treated as part of a scope name.
When gh project item-add runs in a script or pipeline, it has no interactive terminal, meaning it is outside a TTY (a terminal screen that accepts interaction). Its output in that case is fixed, so the command emits the correct output in non-interactive environments.
Your existing GitHub CLI commands remain the same despite an internal API architecture refactor.
The team routed HTTP requests for seven operations through the unified api.Client (the shared client module managing connections and authentication). This covers deploy keys, ssh keys, gpg keys, autolinks, extensions, release creation, and release deletions. Routing these calls through a single client keeps network logic clean and consistent across the codebase.
The project folded spam-issue triage into the agentic issue-triage workflow and restored automatic closure of spam issues. Compatibility for the Action that runs triage is fixed too.
After a PR (pull request) is submitted, review work now requires an explicitly named owner. Every pending change should have a person responsible for taking it up.
Dependabot (the bot that checks dependency updates) triage now runs every hour. Its comments are shorter, its decisions are cheaper and more decisive, and it now performs a real code-reachability check: whether a code path can actually reach a vulnerability.
When an AI agent prepares to submit a PR (pull request), AGENTS.md now directs it to follow the standard pull request template. The guidelines also clarify what belongs in the PR template's testing section, defining which verification details must be recorded.
These updates give agents clear rules for submitting changes so reviewers can quickly assess test coverage.
As a repository grows, it often accumulates lingering TODOs, outdated configurations, or disorganized code structures that developers rarely have dedicated time to clean up. The project now introduces a scheduled tech debt burndown skill for AI agents. Once configured with a schedule, the agent automatically triggers on a recurring interval to inspect the codebase and clean up technical debt.
Standardizing and scheduling these cleanups helps teams keep the repository tidy and maintainable over time.
The repository renamed the cli-code-reviewer skill to the simpler and more concise code-review. Dropping the verbose prefix makes the skill name more intuitive and easier to recognize when invoking agent capabilities.
This update changes only the identifier, leaving the underlying review functionality unchanged.
The Linux APT repository is now signed with both keys simultaneously. In CI (continuous integration, an automated checking process), the team briefly added a temporary step to verify the repository signing keys, then promptly reverted that check after confirming the setup. The update focuses strictly on the dual-key signing and cleaning up the temporary verification step.
When you run tests on your own machine, its authentication and Git configuration can differ from someone else's and leak personal-environment details into the run. This change isolates tests from both kinds of local data, so they no longer read local authentication or Git configuration.
Your credentials and Git settings are not being replaced; the tests simply no longer depend on them.
When a deployment flow validates a version tag, it now accepts a pre-release tag, a tag for a version before formal release. Deployment validation therefore treats that tag type as acceptable input.
The change is limited to which tags deployment validation accepts, so a deployment using a pre-release tag is not stopped at that check.
Code now replaces deprecated reflect.Ptr with reflect.Pointer, completing an API (application programming interface, a fixed way for programs to call a capability) substitution. This does not add a second way to make the call; it changes the outdated name that the code used to the current one.
When reading the relevant code, reflect.Pointer is the API used after this replacement.
When feature detection (checking whether a capability is available) needs no cleanup, it no longer requests a cleanup comment. Whether cleanup is needed now forms the boundary for asking for that comment: a corresponding comment can be left where cleanup is needed, but an item needing none is not asked for one.
The change removes an unneeded request so that the request for a comment matches the actual need for cleanup.
Dependabot configuration now includes an aw-actions group, while aw-actions, codeql-actions, sigstore-go, gRPC, go-containerregistry, actions/attest, azure/login, goldmark, protobuf, testify, x/crypto, lipgloss, and a compression library were updated. Go moved through 1.26.6 to 1.26.7, CI's golangci-lint reached v2.12.2, gh-aw workflows reached v0.85.4, and gh-aw-actions reached v0.87.1 with agentic workflows recompiled.
Add --worktree flag to gh pr checkout by @tidy-dev in https://github.com/cli/cli/pull/13946Add --search-type flag for semantic and hybrid issue search by @michaeljacholke in https://github.com/cli/cli/pull/14006
@michaeljacholke made their first contribution in https://github.com/cli/cli/pull/14006Set GH_EXTENSION=1 when gh invokes an extension by @williammartin in https://github.com/cli/cli/pull/14072Fix `RESTWithNext` error type, repairing `gh status` and attestation retries by @williammartin in https://github.com/cli/cli/pull/13988Trim spaces when parsing X-Oauth-Scopes in `gh release create` by @williammartin in https://github.com/cli/cli/pull/14065Fix project item-add output for non-TTY by @zwick in https://github.com/cli/cli/pull/14056Route deploy key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13989
Route ssh key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13994
Route gpg key requests through api.Client by @williammartin in https://github.com/cli/cli/pull/13997
Route autolink requests through api.Client by @williammartin in https://github.com/cli/cli/pull/14013
Route extension requests through api.Client by @williammartin in https://github.com/cli/cli/pull/14059
Route release creation through api.Client by @williammartin in https://github.com/cli/cli/pull/14062
Route release deletions through api.Client by @williammartin in https://github.com/cli/cli/pull/14077Collapse spam triage into the agentic issue-triage workflow by @williammartin in https://github.com/cli/cli/pull/14027
Restore automatic spam issue closure by @williammartin in https://github.com/cli/cli/pull/14088
Fix issue triage action compatibility [skip changelog] by @tidy-dev in https://github.com/cli/cli/pull/14207Require explicit PR review ownership by @williammartin in https://github.com/cli/cli/pull/14028Slim down dependabot triage comments by @williammartin in https://github.com/cli/cli/pull/14019
Run Dependabot triage every hour by @sergiou87 in https://github.com/cli/cli/pull/14030
Make Dependabot triage cheaper and more decisive by @williammartin in https://github.com/cli/cli/pull/14079
Give Dependabot triage a real reachability check by @williammartin in https://github.com/cli/cli/pull/14087
@sergiou87 made their first contribution in https://github.com/cli/cli/pull/14030Tell agents to use the PR template in AGENTS.md by @williammartin in https://github.com/cli/cli/pull/14074
Clarify what belongs in the PR template's testing section by @williammartin in https://github.com/cli/cli/pull/14103Add a scheduled tech debt burndown skill by @williammartin in https://github.com/cli/cli/pull/14095Rename cli-code-reviewer skill to code-review by @BagToad in https://github.com/cli/cli/pull/14116ci: add temporary step to verify Linux repo signing keys by @babakks in https://github.com/cli/cli/pull/14202
Revert "ci: add temporary step to verify Linux repo signing keys" by @babakks in https://github.com/cli/cli/pull/14203
chore: sign APT repository with both keys by @babakks in https://github.com/cli/cli/pull/13271Isolate tests from local machine's auth and git configuration by @BagToad in https://github.com/cli/cli/pull/14128Accept pre-release tags in deployment validation by @BagToad in https://github.com/cli/cli/pull/14193Use reflect.Pointer instead of deprecated reflect.Ptr by @williammartin in https://github.com/cli/cli/pull/14098Don't ask for feature detection cleanup comments when not needed by @babakks in https://github.com/cli/cli/pull/14139Add aw-actions group to dependabot configuration by @babakks in https://github.com/cli/cli/pull/14123
chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14047
chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14049
chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14048
chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in https://github.com/cli/cli/pull/14066
chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14100
chore(deps): bump azure/login from 3.0.0 to 3.0.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14101
chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14091
chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by @dependabot[bot] in https://github.com/cli/cli/pull/14068
chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in https://github.com/cli/cli/pull/14119
chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14120
chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14147
chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by @dependabot[bot] in https://github.com/cli/cli/pull/14029
chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14050
Bump golangci-lint in CI to v2.12.2 by @williammartin in https://github.com/cli/cli/pull/14102
chore(deps): bump the aw-actions group with 2 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14124
chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in https://github.com/cli/cli/pull/14140
Upgrade gh-aw workflows to v0.85.4 by @tidy-dev in https://github.com/cli/cli/pull/14141
Bump Go to 1.26.6 by @github-actions[bot] in https://github.com/cli/cli/pull/14143
chore: bump go to 1.26.7 by @babakks in https://github.com/cli/cli/pull/14205
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in https://github.com/cli/cli/pull/14204
chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14169
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14164
chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/14166
Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by @BagToad in https://github.com/cli/cli/pull/14210