Powerm4 · pull · May 7, 2025 · May 7, 2025 · May 7, 2025 · May 8, 2025
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-	"image": "mcr.microsoft.com/devcontainers/go:1.19",
+	"image": "mcr.microsoft.com/devcontainers/go:1.24",
 	"features": {
 		"ghcr.io/devcontainers/features/sshd:1": {}
 	},

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -2,3 +2,13 @@
 
 pkg/cmd/codespace/ @cli/codespaces
 internal/codespaces/ @cli/codespaces
+
+# Limit Package Security team ownership to the attestation command package and related integration tests
+pkg/cmd/attestation/ @cli/package-security
+pkg/cmd/release/attestation @cli/package-security
+pkg/cmd/release/verify @cli/package-security
+pkg/cmd/release/verify-asset @cli/package-security
+
+test/integration/attestation-cmd @cli/package-security
+
+pkg/cmd/attestation/verification/embed/tuf-repo.github.com/ @cli/tuf-root-reviewers
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -4,27 +4,27 @@ Hi! Thanks for your interest in contributing to the GitHub CLI!
 
 We accept pull requests for bug fixes and features where we've discussed the approach in an issue and given the go-ahead for a community member to work on it. We'd also love to hear about ideas for new features as issues.
 
-Please do:
+### Please do:
 
-* Check existing issues to verify that the [bug][bug issues] or [feature request][feature request issues] has not already been submitted.
-* Open an issue if things aren't working as expected.
-* Open an issue to propose a significant change.
-* Open a pull request to fix a bug.
-* Open a pull request to fix documentation about a command.
-* Open a pull request for any issue labelled [`help wanted`][hw] or [`good first issue`][gfi].
+* Check issues to verify that a [bug][bug issues] or [feature request][feature request issues] issue does not already exist for the same problem or feature
+* Open an issue if things aren't working as expected
+* Open an issue to propose a significant change
+* Open an issue to propose a design for an issue labelled [`needs-design` and `help wanted`][needs design and help wanted], following the [proposing a design guidelines](#proposing-a-design) instructions below
+* Mention `@cli/code-reviewers` when an issue you want to work on does not have clear Acceptance Criteria
+* Open a pull request for any issue labelled [`help wanted`][hw] and [`good first issue`][gfi]
 
-Please avoid:
+### Please _do not_:
 
-* Opening pull requests for issues marked `needs-design`, `needs-investigation`, or `blocked`.
-* Opening pull requests that haven't been approved for work in an issue
-* Adding installation instructions specifically for your OS/package manager.
-* Opening pull requests for any issue marked `core`. These issues require additional context from
-  the core CLI team at GitHub and any external pull requests will not be accepted.
+* Open a pull request for issues without the `help wanted` label or explicit Acceptance Criteria
+* Expand pull request scope to include changes that are not described in the issue's Acceptance Criteria
+* Add installation instructions specifically for your OS/package manager
+* Open pull requests for any issue marked `core`. These issues require additional context from
+  the core CLI team at GitHub and any external pull requests will not be accepted
 
 ## Building the project
 
 Prerequisites:
-- Go 1.21+
+- Go 1.24+
 
 Build with:
 * Unix-like systems: `make`
@@ -52,7 +52,21 @@ We generate manual pages from source on every release. You do not need to submit
 
 ## Design guidelines
 
-You may reference the [CLI Design System][] when suggesting features, and are welcome to use our [Google Docs Template][] to suggest designs.
+### Proposing a design
+
+You may propose a design to solve an open bug or feature request issue that has both [the `needs-design` and `help-wanted` labels][needs design and help wanted].
+
+To propose a design:
+
+- Open a new issue using the [design proposal issue template](./ISSUE_TEMPLATE/submit-a-design-proposal.md).
+- Include a link to the issue that the design is for.
+- Describe the design you are proposing to resolve the issue, leveraging the [CLI Design System][].
+- Mock up the design you are proposing using our [Google Docs Template][] or code blocks.
+  - Mock ups should clearly illustrate the command(s) being run and the expected output(s).
+
+### (core team only) Reviewing a design
+
+A member of the core team will [triage](../docs/triage.md) the design proposal. Once a member of the core team has reviewed the design, they may add the [`help wanted`][hw] label to the issue, so a PR can be opened to provide the implementation.
 
 ## Resources
 
@@ -62,6 +76,7 @@ You may reference the [CLI Design System][] when suggesting features, and are we
 
 
 [bug issues]: https://github.com/cli/cli/issues?q=is%3Aopen+is%3Aissue+label%3Abug
+[needs design and help wanted]: https://github.com/cli/cli/issues?q=state%3Aclosed%20is%3Aissue%20label%3Aneeds-design%20label%3A%22help%20wanted%22
 [feature request issues]: https://github.com/cli/cli/issues?q=is%3Aopen+is%3Aissue+label%3Aenhancement
 [hw]: https://github.com/cli/cli/labels/help%20wanted
 [gfi]: https://github.com/cli/cli/labels/good%20first%20issue

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -9,7 +9,11 @@ assignees: ''
 
 ### Describe the bug
 
-A clear and concise description of what the bug is. Include version by typing `gh --version`.
+A clear and concise description of what the bug is. 
+
+### Affected version
+
+Please run `gh version` and paste the output below.
 
 ### Steps to reproduce the behavior
 
@@ -24,3 +28,5 @@ A clear and concise description of what you expected to happen and what actually
 ### Logs
 
 Paste the activity from your command line. Redact if needed.
+
+<!-- Note: Set `GH_DEBUG=true` for verbose logs or `GH_DEBUG=api` for verbose logs with HTTP traffic details. -->
diff --git a/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md b/.github/ISSUE_TEMPLATE/submit-a-design-proposal.md
@@ -0,0 +1,58 @@
+---
+name: "🎨 Submit a design proposal"
+about: Submit a design to resolve an open issue that has both `needs-design` and `help-wanted` labels
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+<!-- See [CONTRIBUTING.md](../CONTRIBUTING.md#proposing-a-design) for more information.-->
+
+### Link to issue for design submission
+
+<!-- 
+Provide a link to the issue this design is for.
+
+All design submissions must be linked to an open issue that
+has both the `needs-design` and `help-wanted` labels.
+-->
+
+### Proposed Design
+
+<!--
+Describe the design you are proposing to resolve the issue.
+
+All CLI designs must adhere to the [Primer CLI design reference](https://primer.style/cli/).
+-->
+
+### Mockup
+
+<!--
+Provide a mockup of the design you are proposing. All mockups should clearly illustrate the command(s) being run and the expected output(s). 
+
+When color and formatting are important, consider using our [CLI design Google Docs Template](https://docs.google.com/document/d/1JIRErIUuJ6fTgabiFYfCH3x91pyHuytbfa0QLnTfXKM/edit#heading=h.or54sa47ylpg).
+
+Code blocks can also be used to submit a design mockup - remember to include the command(s) being run. Example:
+
+```shell
+$ gh issue list --json title -L 5
+[
+  {
+    "title": "`gh pr checks <pr> --required` should not fail when there are no required checks"
+  },
+  {
+    "title": "gh pr view commits should include commit description"
+  },
+  {
+    "title": "Adapt the color of the device code to the color used by the terminal"
+  },
+  {
+    "title": "`gh pr create` does not default to fork when user has write access to upstream"
+  },
+  {
+    "title": "First party discussions support"
+  }
+]
+```
+-->
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -2,7 +2,10 @@ GitHub takes the security of our software products and services seriously, inclu
 
 If you believe you have found a security vulnerability in GitHub CLI, you can report it to us in one of two ways:
 
-* Report it to this repository directly using [private vulnerability reporting][]. Such reports are not eligible for a bounty reward.
+* Report it to this repository directly using [private vulnerability reporting][].
+  * Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
+  * POCs and links to code are greatly encouraged.
+  * Such reports are not eligible for a bounty reward.
 
 * Submit the report through [HackerOne][] to be eligible for a bounty reward.
 

diff --git a/.github/licenses.tmpl b/.github/licenses.tmpl
@@ -0,0 +1,13 @@
+# GitHub CLI dependencies
+
+The following open source dependencies are used to build the [cli/cli][] GitHub CLI.
+
+## Go Packages
+
+Some packages may only be included on certain architectures or operating systems.
+
+{{ range . }}
+- [{{.Name}}](https://pkg.go.dev/{{.Name}}) ([{{.LicenseName}}]({{.LicenseURL}}))
+{{- end }}
+
+[cli/cli]: https://github.com/cli/cli
diff --git a/.github/secret_scanning.yml b/.github/secret_scanning.yml
@@ -0,0 +1,3 @@
+paths-ignore:
+  - 'third-party/**'
+  - 'third-party-licenses.*.md'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -18,16 +18,32 @@ permissions:
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['go', 'actions']
 
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
+      - name: Setup Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
-          languages: go
+          languages: ${{ matrix.language }}
           queries: security-and-quality
+          config: |
+            paths-ignore:
+              - 'third-party/**'
+              - 'third-party-licenses.*.md'
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"