Support for GitHub Release Attestations

This release introduces the release verify and release verify-asset commands for verifying GitHub Release attestations. Part of the Immutable Releases initiative, a release attestation provides a signed, timestamped binding between a release, its git tag, and any associated assets. These new commands provide a convenient way to verify the integrity of an immutable release against its attestation.

• Verify the latest release has a valid attestation: gh release verify
• Verify a specific release by tag: gh release verify v1.2.3
• Verify an asset from the latest release: gh release verify-asset my-asset.zip
• Verify a local asset file originated from a specific release: gh release verify-asset v1.2.3 my-asset.zip

These commands help ensure that releases and their assets are authentic and haven’t been tampered with, providing an additional layer of security for your software supply chain.

gh auth status Supports JSON Output

This release adds support for the --json flag in gh auth status. Run gh auth status --help for more information and usage examples.

What's Changed

✨ Features

• Add alias co for pr checkout by @babakks in #11804
• Add JSON output to gh auth status by @benjlevesque in #11544
• release verify and release verify-asset are now visible by @ejahnGithub in #11801

🐛 Fixes

• Fix no tagname logic for release verify-asset by @ejahnGithub in #11798

📚 Docs & Chores

• refactor: use strings.FieldsFuncSeq to reduce memory allocations by @juejinyuxitu in #11805

New Contributors

• @juejinyuxitu made their first contribution in #11805

Full Changelog: v2.80.0...v2.81.0

Manage GitHub Copilot Coding Agent From the GitHub CLI

This GitHub CLI release introduces the agent-task commandset for managing coding agent tasks in gh:

• Create tasks: gh agent-task create "refactor the codebase"
• List all your tasks: gh agent-task list
• View task details: gh agent-task view 1234
• View the task log in real-time: gh agent-task view 1234 --log --follow

For more information about command line flags and arguments, run gh agent-task <command> --help.

The agent-task commandset also ships with the following aliases for convenience:

• gh agent-tasks
• gh agent
• gh agents

ℹ️ The agent-task commandset is in preview and is subject to change without notice.

Got feedback? Let us know what you like or don't like in an issue ❤️

What's Changed

✨ Features

• gh agent-task commandset by @BagToad and @babakks in #11797

🐛 Fixes

• Pin release runner image to Windows 2022 by @babakks in #11799

Full Changelog: v2.79.0...v2.80.0

Advanced Issue Search Support

The GitHub CLI now supports advanced issue search syntax using:

• Searching issues: gh search issues <advanced issue search query>
• Searching pull requests: gh search prs <advanced issue search query>
• While listing issues: gh issue list --search <advanced issue search query>
• While listing pull requests: gh pr list --search <advanced issue search query>

For more information about advanced issue search syntax, see: "Filtering and Searching Issues and Pull Requests"

Copy OAuth Code Automatically

The GitHub CLI now supports writing the OAuth one-time pass code to the clipboard automatically during authentication:

• While logging in: gh auth login --clipboard / gh auth login -c
• While refreshing the token: gh auth refresh --clipboard / gh auth refresh -c

What's Changed

✨ Features

• feat: gh auth Automatically copy one-time OAuth code to clipboard by @ankddev in #11518
• feat: add support for --ref in gh cache delete by @luxass in #11592
• Use advanced issue search by @babakks in #11638

📚 Docs & Chores

• docs(release create): difference --generate-notes and --notes-from-tag by @ankddev in #11534
• refactor tests: use slices.Equal to simplify code by @minxinyi in #11364
• Remove mention of public preview in trustedroot.go by @jkylekelly in #11652

Dependencies

• Bump sigstore/rekor to v1.4.1 by @BagToad in #11654
• chore(deps): bump actions/stale from 9 to 10 by @dependabot[bot] in #11663
• chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #11662

New Contributors

• @minxinyi made their first contribution in #11364
• @jkylekelly made their first contribution in #11652
• @luxass made their first contribution in #11592

Full Changelog: v2.78.0...v2.79.0

ℹ️ Note

This release was cut primarily to resolve a Linux package distribution issue. We recommend reviewing the v2.77.0 release notes for the complete set of latest features and fixes.

What's Changed

✨ Features

• Add --force flag to gh run cancel by @ankddev in #11513

🐛 Fixes

• Fix failing to release Linux packages (affected v2.77.0). See v2.77.0 for more information.

Full Changelog: v2.77.0...v2.78.0

⚠️ Incomplete Release

The v2.77.0 release experienced a failure publishing to our official Linux repos. This is resolved in v2.78.0, so we recommend using that release instead.

What's Changed

✨ Features

• Report that v1 classic projects are detected on GHES 3.16.x or older by @andyfeller in #11491
• Display v2 projects in gh issue view by @andyfeller in #11496
• View v2 projects in gh pr view output by @andyfeller in #11497
• Ensure users can see v2 projects when viewing issues and PRs, avoid v1 projects on GHES 3.17 and newer by @andyfeller in #11514

🐛 Fixes

• fix error for ErrReleaseNotFound when fetching ref by @ejahnGithub in #11451
• add test for FetchRefSHA by @ejahnGithub in #11481
• Fix gh repo delete --yes safety issue when no repository argument provided by @Copilot in #11536

📚 Docs & Chores

• Improve spam detection evals by @babakks in #11419
• Fix help wanted label regexp in CI automation by @babakks in #11423
• Update spam detection to comment on and close issue by @andyfeller in #11435
• Adding a note to gh search docs to explain the usage of -- to exclude certain results by @Sukhpreet-s in #11162
• Update issue triage guidelines and label usage by @BagToad in #11454
• Reorganize installation docs by @andyfeller in #11473
• Update govulncheck workflow to scan source code by @BagToad in #11482
• Hidden trusted root flag for release verify by @ejahnGithub in #11511

Dependencies

• Regenerate third-party licenses on trunk pushes by @andyfeller in #11370
• Update third-party license versions by @BagToad in #11557
• Bump Go to 1.24.6 by @github-actions[bot] in #11467
• chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #11319
• chore(deps): bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #11458
• chore(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #11490
• chore(deps): bump github.com/yuin/goldmark from 1.7.12 to 1.7.13 by @dependabot[bot] in #11368
• Bump google.golang.org/grpc & other required dependencies by @BagToad in #11510
• chore(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.2 by @dependabot[bot] in #11367
• chore(deps): bump github.com/cli/go-gh/v2 from 2.12.1 to 2.12.2 by @dependabot[bot] in #11537
• chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #11556

New Contributors

• @Sukhpreet-s made their first contribution in #11162
• @Copilot made their first contribution in #11536

Full Changelog: v2.76.2...v2.77.0

gh pr create regression fix

This release fixes a regression introduced in v2.76.1 where organization teams were not present in prompts for pull request reviewers. This caused problems in multiple commands:

• Interactive gh pr create could not select teams when adding pull request reviewers
• Tab completions with gh pr create --reviewer flag did not present a list of organization teams
• Tab completions with gh pr edit --add-reviewer flag did not present a list of organization teams
• Tab completions with gh pr edit --remove-reviewer flag did not present a list of organization teams

For more information, see #11403

What's Changed

🐛 Fixes

• Include org teams for PR reviewers by @andyfeller in #11407

📚 Docs & Chores

• Delete obsolete comment about gh-models not respecting API rate-limit by @babakks in #11398

Full Changelog: v2.76.1...v2.76.2

gh pr create regression fix

This release fixes a regression introduced in v2.76.0 where organization teams were retrieved outside of intentional use cases. This caused problems for GitHub Enterprise Server users using the GitHub Actions automatic token that does not have access to organization teams.

For more information, see #11360

What's Changed

🐛 Fixes

• Fix: gh pr create, only fetch teams when reviewers contain a team by @BagToad in #11361

📚 Docs & Chores

• add tenancy aware for san matcher by @ejahnGithub in #11261
• Run Lint and Tests on push to trunk branch by @andyfeller in #11325
• update ownership of pkg/cmd/release/shared/ by @ejahnGithub in #11326
• Automate spam issue detection by @babakks in #11316
• Improve api --preview docs by @jsoref in #11274
• Incorporate govulncheck into workflows by @andyfeller in #11332
• chore(deps): bump advanced-security/filter-sarif from 1.0.0 to 1.0.1 by @dependabot[bot] in #11298
• chore(deps): bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by @dependabot[bot] in #11307

Full Changelog: v2.76.0...v2.76.1

Copilot Coding Agent Support

GitHub Copilot Pro+ and Copilot Enterprise subscribers can now assign issues to GitHub Copilot during issue creation using:

• Command-line flag: gh issue create --assignee @copilot
• Launching web browser: gh issue create --assignee @copilot --web
• Or interactively selecting Copilot (AI) as assignee in gh issue create metadata

For more details, refer to the full changelog post for Copilot coding agent.

What's Changed

✨ Features

• Assign Copilot during gh issue create by @andyfeller in #11279
• Display immutable field in release view command by @bdehamer in #11251

🐛 Fixes

• FIX: Do not fetch logs for skipped jobs by @babakks in #11312
• Transform extension and filename qualifiers into path qualifier for web code search by @samcoe in #11211

📚 Docs & Chores

• FIX: Workflow does not contain permissions by @BagToad in #11322
• Add automated feature request response workflow by @BagToad in #11299

Full Changelog: v2.75.1...v2.76.0

What's Changed

🐛 Fixes

• Ensure hostnames are visible in CLI website by @andyfeller in #11295
• Revert "Fix: gh pr create prioritize --title and --body over --fill when --web is present" by @andyfeller in #11300

📚 Docs & Chores

• Ensure go directive is always .0 version in bump by @williammartin in #11259
• Minor (1-word) documentation typo in generated ~/.config/gh/config.yml by @kurahaupo in #11246
• Automate closing of stale issues by @babakks in #11268
• Filter the third-party/ folder out of CodeQL results by @BagToad in #11278
• Exclude third-party source from golangci-lint by @andyfeller in #11293

Dependencies

• Bump Go to 1.24.5 by @github-actions[bot] in #11255
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.3 to 0.5.0 by @dependabot[bot] in #11263
• chore(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 by @dependabot[bot] in #11266
• chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by @dependabot[bot] in #11264
• chore(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 by @dependabot[bot] in #11265
• chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 by @dependabot[bot] in #11275

New Contributors

• @kurahaupo made their first contribution in #11246
• @github-actions[bot] made their first contribution in #11255

Full Changelog: v2.75.0...v2.75.1

What's Changed

✨ Features

• init release verify subcommands by @ejahnGithub in #11018
• Embed Windows resources (VERSIONINFO) during build by @babakks in #11048
• Support --no-repos-selected on gh secret set by @williammartin in #11217

🐛 Fixes

• Fix: gh pr create prioritize --title and --body over --fill when --web is present by @dankrzeminski32 in #10547
• fix: get token for active user instead of blank if possible by @anuraaga in #11038
• Use Actions API to retrieve job run logs as a fallback mechanism by @babakks in #11172
• Fix query object state mutation during pagination by @babakks in #11244
• Handle HTTP 404 when deleting remote branch in pr merge by @babakks in #11234

📚 Docs & Chores

• chore: fix function name by @jinjingroad in #11149
• chore: update Go version to 1.24 in devcontainer configuration and docs by @tMinamiii in #11158
• Ensure lint workflow checks whether 3rd party license and code is up to date by @andyfeller in #11047
• docs: install_linux.md: add Solus linux install instructions by @chax in #10823
• Fix missing newline in install_linux.md by @BagToad in #11160
• Ensure automation uses pinned go-licenses version by @andyfeller in #11161
• Add workflow_dispatch support to PR Help Wanted check by @BagToad in #11179
• Remove unused GH_TOKEN env variable from workflow by @BagToad in #11190
• Add workflow to automate go version bumping by @williammartin in #11189
• Fix inconsistent use of tabs and spaces by @Stefan-Heimersheim in #11194
• Decouple arg parsing from PR finder by @babakks in #11192
• docs: consistently use apt in installation instructions by @tklauser in #11216
• Ensure bump go script has git user configured by @williammartin in #11229
• Inject token into bump-go workflow by @williammartin in #11233
• Reinstating Primer Style CLI content within cli/cli repository by @andyfeller in #11060
• Add setup-go to bump-go workflow by @williammartin in #11237
• Ensure GoReleaser does not break on Mac OS and Linux when skipping Windows .rsyso generation script by @andyfeller in #11257

Dependencies

• Bump all dependencies except dev-tunnels by @williammartin in #11203
• Update microsoft dev-tunnels to v0.1.13 by @williammartin in #11205
• Consume dependabot minor versions for go modules by @williammartin in #11213

New Contributors

• @jinjingroad made their first contribution in #11149
• @tMinamiii made their first contribution in #11158
• @chax made their first contribution in #10823
• @dankrzeminski32 made their first contribution in #10547
• @anuraaga made their first contribution in #11038
• @Stefan-Heimersheim made their first contribution in #11194

Full Changelog: v2.74.2...v2.75.0