fix: use target directory remotes in skills publish by SamMorrowDrums · Pull Request #13169 · cli/cli

SamMorrowDrums · 2026-04-15T20:56:32Z

Summary

Fixes a bug where gh skill publish /path/to/repo-bar run from inside repo-foo would detect repo-foo's remotes instead of repo-bar's, potentially creating a release on the wrong repository.

Bug

detectGitHubRemote used the factory-provided gitClient directly, which has its RepoDir set to the current working directory. When a dir argument is passed to publish, the function should look at the remotes of the target directory, not the CWD.

Reproduction scenario

User is in repo-foo working directory
User runs gh skill publish /path/to/repo-bar
Both repos have GitHub remotes
Validation passes on repo-bar's local files, but the release gets created on repo-foo

Fix

detectGitHubRemote now accepts a dir parameter, copies the git client, and sets RepoDir = dir — matching the pattern already used by detectMissingRepoDiagnostic and checkInstalledSkillDirs.

Testing (TDD)

TestDetectGitHubRemote_UsesDir — unit test for the function directly: creates two git repos with different remotes, verifies the correct one is returned
TestPublishRun_DirArgUsesTargetRemote — integration test through publishRun: simulates the full bug scenario with HTTP mocks that would fail if the wrong repo is detected
Acceptance test (skills-publish-dir-remote.txtar) — end-to-end test creating two real GitHub repos and verifying the release lands on the correct one

All existing tests updated to initialize git repos in the skill directory (matching production behavior).

Stacked on #13165

Co-authored-by: BagToad 47394200+BagToad@users.noreply.github.com

When a directory argument is provided to `gh skill publish`, the remote detection now correctly uses the target directory's git remotes instead of the current working directory's remotes. Previously, `detectGitHubRemote` used the factory-provided git client which pointed to the CWD. This meant that running `gh skill publish /path/to/repo-bar` from inside repo-foo would detect repo-foo's remotes and potentially create the release on the wrong repo. The fix copies the git client and sets `RepoDir` to the target directory, matching the pattern already used by `detectMissingRepoDiagnostic` and `checkInstalledSkillDirs`. Co-authored-by: BagToad <47394200+BagToad@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Fixes incorrect GitHub remote detection in gh skill publish when a target directory is provided, ensuring releases are created against the target repo rather than the current working directory.

Changes:

Update detectGitHubRemote to accept a target dir and run git remote detection against that directory (via a copied git client with RepoDir set).
Refactor/extend tests to initialize git repos in the skill directory and add regression coverage for the --dir scenario.
Add an acceptance test covering publishing from one repo while targeting another.

Show a summary per file

File	Description
`pkg/cmd/skills/publish/publish.go`	Ensures remote detection uses the provided publish directory by copying the git client and setting `RepoDir`.
`pkg/cmd/skills/publish/publish_test.go`	Updates existing tests to initialize git in the target dir and adds new unit/integration regression tests for dir-based remote detection.
`acceptance/testdata/skills/skills-publish-dir-remote.txtar`	Adds end-to-end acceptance coverage verifying release is created on the target repo when invoked from another repo.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 1

Copilot · 2026-04-15T21:00:07Z

 func newTestGitClient(t *testing.T, remoteURLs map[string]string) *git.Client {
 	t.Helper()
 	dir := t.TempDir()
-	runGit := func(args ...string) {
-		t.Helper()
-		cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
-		cmd.Env = append(os.Environ(), "GIT_CONFIG_NOSYSTEM=1", "HOME="+dir)
-		out, err := cmd.CombinedOutput()
-		require.NoError(t, err, "git %v: %s", args, out)
-	}
-	runGit("init", "--initial-branch=main")
-	runGit("config", "user.email", "monalisa@github.com")
-	runGit("config", "user.name", "Monalisa Octocat")
+	initGitRepo(t, dir, remoteURLs)
+	return &git.Client{RepoDir: dir}
+}


newTestGitClient is no longer referenced anywhere in this test file (only defined). Consider removing it to reduce dead code, or switch call sites to use it instead of open-coding initGitRepo + &git.Client{} where appropriate.

See below for a potential fix:

Remove the now-unused newTestGitClient helper that was left behind after refactoring tests to use initGitRepo directly. This fixes the golangci-lint 'unused' error in CI. Co-authored-by: BagToad <47394200+BagToad@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

BagToad

LGTM

I thought: maybe there's a way to fold the standalone test into the table test - but I don't think it's worth the effort to rework the table test to accommodate making multiple git dirs and whatever else it needs.

SamMorrowDrums · 2026-04-15T23:17:00Z

Good question @BagToad you are likely right it's both possible but maybe not necessarily desirable.

LMK if you want it as a follow up. I will merge for sake of getting ready for release.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.89.0` → `v2.90.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.90.0`](https://github.com/cli/cli/releases/tag/v2.90.0): GitHub CLI 2.90.0 [Compare Source](cli/cli@v2.89.0...v2.90.0) #### Manage agent skills with `gh skill` (Public Preview) [Agent skills](https://agentskills.io) are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new `gh skill` command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI. ``` # Discover skills gh skill search copilot # Preview a skill without installing gh skill preview github/awesome-copilot documentation-writer # Install a skill gh skill install github/awesome-copilot documentation-writer # Pin to a specific version gh skill install github/awesome-copilot documentation-writer --pin v1.2.0 # Check installed skills for updates gh skill update --all # Validate and publish your own skills gh skill publish --dry-run ``` Skills are automatically installed to the correct directory for your agent host. `gh skill` supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with `--agent` and `--scope` flags. `gh skill publish` validates skills against the [Agent Skills specification](https://agentskills.io/specification) and checks remote settings like tag protection and immutable releases to improve supply chain security. Read the full announcement on the [GitHub Blog](https://github.blog/changelog/2026-04-16-manage-agent-skills-with-github-cli/). `gh skill` is launching in public preview and is subject to change without notice. #### Official extension suggestions When you run a command that matches a known official extension that isn't installed (e.g. `gh stack`), the CLI now offers to install it instead of showing a generic "unknown command" error. This feature is available for [github/gh-aw](https://github.com/github/gh-aw) and [github/gh-stack](https://github.com/github/gh-stack). When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the `gh extension install` command to run. #### `gh extension install` no longer requires authentication `gh extension install` previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in. #### What's Changed ##### ✨ Features - Add `gh skill` command group: install, preview, search, update, publish by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13165](cli/cli#13165) - Suggest and install official extensions for unknown commands by [@BagToad](https://github.com/BagToad) in [#13175](cli/cli#13175) - `gh skill publish`: auto-push unpushed commits before publish by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13171](cli/cli#13171) - Disable auth check for `gh extension install` by [@BagToad](https://github.com/BagToad) in [#13176](cli/cli#13176) ##### 🐛 Fixes - Fix infinite loop in `gh release list --limit 0` by [@Bahtya](https://github.com/Bahtya) in [#13097](cli/cli#13097) - Ensure `api` and `auth` commands record agentic invocations by [@williammartin](https://github.com/williammartin) in [#13046](cli/cli#13046) - Disable auth check for local-only skill flags by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13173](cli/cli#13173) - URL-encode parentPath in skills discovery API call by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13172](cli/cli#13172) - Fix: use target directory remotes in skills publish by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13169](cli/cli#13169) - Fix: preserve namespace in skills search deduplication by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13170](cli/cli#13170) ##### 📚 Docs & Chores - docs: include PGP key fingerprints by [@babakks](https://github.com/babakks) in [#13112](cli/cli#13112) - docs: add sha/md5 checksums of keyring files by [@babakks](https://github.com/babakks) in [#13150](cli/cli#13150) - docs: fix SHA512 checksum for GPG key by [@timsu92](https://github.com/timsu92) in [#13157](cli/cli#13157) - docs(skill): polish skill commandset docs by [@babakks](https://github.com/babakks) in [#13183](cli/cli#13183) - Document dependency CVE policy in SECURITY.md by [@BagToad](https://github.com/BagToad) in [#13119](cli/cli#13119) - Replace github.com/golang/snappy with klauspost/compress/snappy by [@thaJeztah](https://github.com/thaJeztah) in [#13048](cli/cli#13048) - chore: bump to go1.26.2 by [@babakks](https://github.com/babakks) in [#13116](cli/cli#13116) - chore: delete experimental script/debian-devel by [@babakks](https://github.com/babakks) in [#13127](cli/cli#13127) - Suggest first party extensions by [@williammartin](https://github.com/williammartin) in [#13182](cli/cli#13182) - Add cli/skill-reviewers as CODEOWNERS for skills packages by [@BagToad](https://github.com/BagToad) in [#13189](cli/cli#13189) - Add [@cli/code-reviewers](https://github.com/cli/code-reviewers) to all CODEOWNERS rules by [@BagToad](https://github.com/BagToad) in [#13190](cli/cli#13190) - Address post-merge review feedback for skills commands by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13185](cli/cli#13185) - Fix skills-publish-dry-run acceptance test error message mismatch by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13187](cli/cli#13187) - Skills: replace real git in publish tests with CommandStubber by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13188](cli/cli#13188) - Remove redundant nil-client fallback in skills publish by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13168](cli/cli#13168) - Publish: use shared discovery logic instead of requiring skills/ directory by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13167](cli/cli#13167) #####

Dependencies - chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#13071](cli/cli#13071) - chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#13045](cli/cli#13045) - chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13051](cli/cli#13051) - chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#13152](cli/cli#13152) - chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#13129](cli/cli#13129) - chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#13128](cli/cli#13128) - chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13044](cli/cli#13044) - chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#12918](cli/cli#12918) - chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13076](cli/cli#13076) - chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#13065](cli/cli#13065) #### New Contributors - [@thaJeztah](https://github.com/thaJeztah) made their first contribution in [#13048](cli/cli#13048) - [@Bahtya](https://github.com/Bahtya) made their first contribution in [#13097](cli/cli#13097) - [@timsu92](https://github.com/timsu92) made their first contribution in [#13157](cli/cli#13157) - [@SamMorrowDrums](https://github.com/SamMorrowDrums) made their first contribution in [#13173](cli/cli#13173) **Full Changelog**: <cli/cli@v2.89.0...v2.90.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

SamMorrowDrums requested a review from a team as a code owner April 15, 2026 20:56

SamMorrowDrums requested review from babakks and Copilot April 15, 2026 20:56

SamMorrowDrums changed the base branch from trunk to sm/add-skills-command April 15, 2026 20:56

Copilot started reviewing on behalf of SamMorrowDrums April 15, 2026 20:57 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

BagToad approved these changes Apr 15, 2026

View reviewed changes

SamMorrowDrums merged commit 980428c into sm/add-skills-command Apr 15, 2026
8 checks passed

SamMorrowDrums deleted the sammorrowdrums/fix-skills-publish-remote-detection branch April 15, 2026 23:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use target directory remotes in skills publish#13169

fix: use target directory remotes in skills publish#13169
SamMorrowDrums merged 2 commits into
sm/add-skills-commandfrom
sammorrowdrums/fix-skills-publish-remote-detection

SamMorrowDrums commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

BagToad left a comment

Uh oh!

SamMorrowDrums commented Apr 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

SamMorrowDrums commented Apr 15, 2026

Summary

Bug

Reproduction scenario

Fix

Testing (TDD)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

BagToad left a comment

Choose a reason for hiding this comment

Uh oh!

SamMorrowDrums commented Apr 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants