feat(skills): detect re-published skills and offer upstream install by SamMorrowDrums · Pull Request #13236 · cli/cli

SamMorrowDrums · 2026-04-20T09:41:15Z

Summary

When installing a skill from a repo that re-published it from an upstream source, the SKILL.md contains github-repo metadata pointing to the original publisher. This PR detects that and offers the user a choice: install from the re-publisher (default) or redirect to the upstream.

Changes

pkg/cmd/skills/install/install.go

checkUpstreamProvenance - after skill selection, fetches SKILL.md via contents API, parses frontmatter, checks if github-repo points elsewhere
Interactive: prompt to choose re-publisher (default) or upstream
Non-interactive: print notice, continue with re-publisher
--upstream flag: skip prompt, redirect to upstream directly (enables CI/script use)
If upstream chosen: restart installRun with the upstream repo (fresh version resolution, discovery)
skill_upstream_redirect telemetry event emitted on redirect
--from-local and --upstream are mutually exclusive

pkg/cmd/skills/install/install_test.go

4 TestInstallRun_UpstreamDetection cases: interactive re-publisher, interactive upstream, non-interactive default, --upstream flag
2 TestNewCmdInstall cases: --upstream flag parsing, --from-local --upstream mutual exclusion

Behavior

Scenario	Result
SKILL.md has no `github-repo` metadata	No detection, install normally
`github-repo` points to same repo	No detection, install normally
`github-repo` points elsewhere (interactive)	Prompt: re-publisher or upstream?
`github-repo` points elsewhere (non-interactive)	Notice printed, install from re-publisher
`--upstream` flag set	Redirect to upstream without prompting
Contents API fetch fails	Silently continue with re-publisher
`--from-local --upstream`	Mutual exclusion error

What this does NOT change

No new frontmatter metadata keys
No changes to the installer, update command, publish command, or frontmatter package
InjectGitHubMetadata overwrites github-repo to the chosen source as before

End-to-end testing

Manually verified against real repos using the built CLI binary:

Setup: Installed git-commit from github/awesome-copilot into a private repo (sammorrowdrums/test-republished-skills), committed the SKILL.md with its github-repo metadata pointing to the upstream, pushed.

1. Normal install (no upstream metadata) - works unchanged:

$ gh skill install github/awesome-copilot git-commit --force --dir ./normal-install --agent github-copilot
✓ Installed git-commit (from github/awesome-copilot@main) in normal-install
# github-repo: https://github.com/github/awesome-copilot  ✓

2. Local install - works unchanged:

$ gh skill install ./local-source my-local-skill --from-local --dir ./local-install --agent github-copilot --scope project
Installed my-local-skill (from ./local-source) in local-install  ✓

3. Re-published install (non-interactive) - detects upstream, installs from re-publisher:

$ gh skill install sammorrowdrums/test-republished-skills git-commit --force --dir ./republish-install --agent github-copilot --scope project
! This skill was originally published in github/awesome-copilot
  Installing from sammorrowdrums/test-republished-skills (use --upstream or interactive mode to choose upstream)
✓ Installed git-commit (from sammorrowdrums/test-republished-skills@main) in republish-install
# github-repo: https://github.com/sammorrowdrums/test-republished-skills  ✓

4. Re-published install with --upstream flag - redirects to upstream:

$ gh skill install sammorrowdrums/test-republished-skills git-commit --force --dir ./upstream-install --agent github-copilot --scope project --upstream
! This skill was originally published in github/awesome-copilot
Redirecting install to github/awesome-copilot...
✓ Installed git-commit (from github/awesome-copilot@main) in upstream-install
# github-repo: https://github.com/github/awesome-copilot  ✓

5. Interactive prompt (user picks upstream) - redirects:

$ gh skill install sammorrowdrums/test-republished-skills git-commit --force --dir ./interactive-upstream --agent github-copilot --scope project
! This skill was originally published in github/awesome-copilot
? Install from: github/awesome-copilot (upstream)
Redirecting install to github/awesome-copilot...
✓ Installed git-commit (from github/awesome-copilot@main) in interactive-upstream
# github-repo: https://github.com/github/awesome-copilot  ✓

6. Mutual exclusion:

$ gh skill install ./some-dir --from-local --upstream
--from-local and --upstream cannot be used together  ✓

Copilot

Pull request overview

Adds end-to-end upstream provenance tracking for re-published skills so installs/updates can preserve original-source metadata and (optionally) fetch future updates from upstream.

Changes:

Extend frontmatter metadata injection to record upstream repo/tree/path and a track-upstream flag, with cleanup when upstream is nil.
Add installer-side detection of upstream metadata from SKILL.md and a command-layer callback to choose re-publisher vs upstream tracking.
Update update/install/publish commands and tests to preserve provenance across forced updates and improve publish-time guidance.

Show a summary per file

File	Description
pkg/cmd/skills/update/update_test.go	Adds unit coverage for parsing upstream metadata and preserving provenance on update.
pkg/cmd/skills/update/update.go	Parses upstream fields, resolves updates from upstream when tracking, and preserves provenance through re-installs.
pkg/cmd/skills/publish/publish.go	Enhances publish error messaging with re-publisher guidance when github metadata is present.
pkg/cmd/skills/install/install.go	Wires upstream-detection callback and adds interactive prompting/warnings for tracking choice.
internal/skills/installer/installer_test.go	Adds unit tests for detection, verification, self-referential handling, and preset upstream behavior.
internal/skills/installer/installer.go	Implements upstream detection, optional best-effort SHA verification, and injects upstream metadata during install.
internal/skills/frontmatter/frontmatter_test.go	Adds tests for upstream metadata injection/cleanup and track-upstream flag.
internal/skills/frontmatter/frontmatter.go	Introduces `UpstreamInfo` and extends `InjectGitHubMetadata` to write upstream fields.
acceptance/testdata/skills/skills-install-republished.txtar	Acceptance test ensuring upstream provenance survives forced update.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

internal/skills/installer/installer.go:377

In the existingRepo == currentRepoURL branch, detectAndResolveUpstream calls OnUpstreamDetected(...) but then returns (nil, false) unconditionally, meaning any user choice returned by the callback is ignored. With the current CLI callback implementation, this can lead to an interactive prompt that has no effect. Suggestion: avoid invoking OnUpstreamDetected in this branch unless you can guarantee the callback is “warning-only”, or extend the callback contract (e.g., an explicit stale bool argument) so the command layer can suppress prompting for this case.

	// Check whether the existing metadata points to a different repo
	currentRepoURL := source.BuildRepoURL(opts.Host, opts.Owner, opts.Repo)
	if existingRepo == currentRepoURL {
		// github-repo points to this repo, but if github-upstream-repo is
		// also present this looks like a previously installed skill that was
		// committed back into the source repo. Warn and install normally,
		// clearing the stale upstream fields.
		if upstreamURL, _ := result.Metadata.Meta["github-upstream-repo"].(string); upstreamURL != "" {
			opts.OnUpstreamDetected(frontmatter.UpstreamInfo{RepoURL: upstreamURL}, false)
		}
		return nil, false

Files reviewed: 9/9 changed files
Comments generated: 4

+		// Self-referential: github-repo points to this repo but
+		// github-upstream-repo is also present. This is a previously
+		// installed skill committed back into the source repo. The
+		// installer ignores the return value in this case - we just warn.
+		if upstreamLabel == repoSource {
+			fmt.Fprintf(opts.IO.ErrOut, "%s This skill contains stale install metadata (upstream points to itself). Upstream tracking will be cleared.\n", cs.WarningIcon())
+			return nil
+		}
+
+		fmt.Fprintf(opts.IO.ErrOut, "%s This skill was originally published in %s\n", cs.WarningIcon(), upstreamLabel)
+
+		if !opts.IO.CanPrompt() {
+			fmt.Fprintf(opts.IO.ErrOut, "  Tracking %s for updates (use interactive mode to choose upstream)\n", repoSource)
+			return &installer.UpstreamDecision{
+				Upstream:      &upstream,
+				TrackUpstream: false,
+			}
+		}
+
+		choices := []string{
+			fmt.Sprintf("%s (re-publisher, recommended)", repoSource),
+			fmt.Sprintf("%s (upstream)", upstreamLabel),
+		}
+		idx, err := opts.Prompter.Select("Track updates from:", "", choices)
+		if err != nil {
+			// On prompt error, default to re-publisher
+			return &installer.UpstreamDecision{
+				Upstream:      &upstream,
+				TrackUpstream: false,
+			}
+		}
+
+		trackUpstream := idx == 1
+		pinOrVersion := opts.Pin
+		if pinOrVersion == "" {


BagToad

Looks pretty good, but I think there's some error handling we should fix. I'm continuing to review, but figured I should post that comment first 😁

BagToad · 2026-04-20T17:12:02Z

 			  - Each skill name matches its directory name
 			  - Required frontmatter fields (name, description) are present
 			  - allowed-tools is a string, not an array
 			  - Install metadata (%[1]smetadata.github-*%[1]s) is stripped if present


❓ Do you think it's worth updating this with new upstream info? I'm not sure it is, but here's a copilot suggested edit:

- - Install metadata (%[1]smetadata.github-*%[1]s) is stripped if present + - Install metadata (%[1]smetadata.github-*%[1]s) is reported as an + error if present; use %[1]s--fix%[1]s to strip it. When + %[1]smetadata.github-upstream-repo%[1]s is also present (i.e. a + re-published skill), the error includes guidance on preserving + upstream provenance by committing the files and releasing + directly instead of stripping with %[1]s--fix%[1]s.

SamMorrowDrums · 2026-04-20T17:34:24Z

@BagToad I decided in last 10 mins with @tommaso-moro that I should simplify and give user option of tracking from one or other, and then just using the standard front-matter and removing much complexity.

Does that sound better to you?

To me it makes it clear while preserving the simple format.

BagToad · 2026-04-20T17:35:30Z

 		}
 	}

 	dims := map[string]string{


💭 Wondering if you'd like telemetry for this upstream vs publisher?

BagToad · 2026-04-20T17:42:05Z

+					---
+					name: code-review
+					metadata:
+					  github-repo: https://github.com/curator/curated-skills


❗ let's use official or fake names like monalisa to prevent any name-squatting problems. I don't think it would actually cause any problems but better to be consistent with rest of the tests anyway.

BagToad · 2026-04-20T17:50:02Z

@SamMorrowDrums sorry just saw your question 👀

I decided in last 10 mins with @tommaso-moro that I should simplify and give user option of tracking from one or other, and then just using the standard front-matter and removing much complexity.

That sounds good! Definitely much simpler. And if they want to switch to a different source they can always reinstall from that other source.

babakks

Thanks for the PR! A few comments we need to fix.

When installing a skill whose SKILL.md contains github-repo metadata pointing to a different repository, the CLI detects it as a re-published skill and offers to redirect the install to the upstream source. In interactive mode, the user is prompted to choose between the re-publisher (default) and the upstream. In non-interactive mode, the install proceeds from the re-publisher with a notice. The --upstream flag skips the prompt and redirects to upstream directly, enabling non-interactive upstream installs in CI/scripts. If the user chooses upstream, the install restarts from that repo, resolving the latest version and discovering skills fresh. A skill_upstream_redirect telemetry event is emitted to track redirects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.90.0` → `v2.92.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.92.0`](https://github.com/cli/cli/releases/tag/v2.92.0): GitHub CLI 2.92.0 [Compare Source](cli/cli@v2.91.0...v2.92.0) #### Support GitHub Enterprise Cloud (GHEC) in `skill` commandset Now `gh skill` subcommands (`install`, `preview`, `publish`, `search`, `update`) are able to work with [GHEC](https://docs.github.com/en/enterprise-cloud@latest/admin/overview/about-github-enterprise-cloud) hosts with data residency. #### Add `--allow-hidden-dirs` flag to `skill preview` Following the addition of `--allow-hidden-dirs` to `skill install` in the previous release, now the flag is also supported in `skill preview`, allowing users to preview skills located in hidden (dot-prefixed) directories such as `.claude/skills/`, `.agents/skills/`, and `.github/skills/`. #### What's Changed ##### ✨ Features - feat(skills): add --allow-hidden-dirs flag to preview command by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13265](cli/cli#13265) - feat(skills): support GHEC with data residency hosts by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13264](cli/cli#13264) ##### 🐛 Fixes - Fix SetSampleRate not updating sample\_rate dimension by [@williammartin](https://github.com/williammartin) in [#13259](cli/cli#13259) - Fix log terminal injection by [@williammartin](https://github.com/williammartin) in [#13272](cli/cli#13272) - Add "Resource not accessible" to ProjectsV2IgnorableError by [@maxbeizer](https://github.com/maxbeizer) in [#13281](cli/cli#13281) ##### 📚 Docs & Chores - fix: using variable interpolation \`${{ in deployment.yml... by [@orbisai0security](https://github.com/orbisai0security) in [#13258](cli/cli#13258) - docs: correct typo in Linux Homebrew copy by [@cassidyjames](https://github.com/cassidyjames) in [#13273](cli/cli#13273) - Install skills flat by Name, not namespaced InstallName by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13266](cli/cli#13266) - chore: fix zsh completion on debian by [@babakks](https://github.com/babakks) in [#13274](cli/cli#13274) - Add trust disclaimer to extension help text by [@travellertales](https://github.com/travellertales) in [#13296](cli/cli#13296) - Bump Go to 1.26.2 by [@github-actions](https://github.com/github-actions)\[bot] in [#13301](cli/cli#13301) #####

Dependencies - chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by [@dependabot](https://github.com/dependabot)\[bot] in [#13161](cli/cli#13161) - chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#13162](cli/cli#13162) - chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#13163](cli/cli#13163) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#13206](cli/cli#13206) - chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 by [@dependabot](https://github.com/dependabot)\[bot] in [#13241](cli/cli#13241) - chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by [@dependabot](https://github.com/dependabot)\[bot] in [#13298](cli/cli#13298) #### New Contributors - [@orbisai0security](https://github.com/orbisai0security) made their first contribution in [#13258](cli/cli#13258) - [@cassidyjames](https://github.com/cassidyjames) made their first contribution in [#13273](cli/cli#13273) - [@travellertales](https://github.com/travellertales) made their first contribution in [#13296](cli/cli#13296) **Full Changelog**: <cli/cli@v2.91.0...v2.92.0> ### [`v2.91.0`](https://github.com/cli/cli/releases/tag/v2.91.0): GitHub CLI 2.91.0 [Compare Source](cli/cli@v2.90.0...v2.91.0) #### GitHub CLI now collects pseudonymous telemetry To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry. See [Telemetry](https://cli.github.com/telemetry) for more details on what's collected, why, and how to opt out. #### Support more agents in `gh skill` Thanks to community feedback, `gh` now supports a large number of agent hosts. Run `gh skill install --help` for the list of available agents. #### Improve skill discovery `gh skill install` now adds the `--allow-hidden-dirs` flag to support discovering skills in hidden (dot-prefixed) directories such as `.claude/skills/`, `.agents/skills/`, and `.github/skills/`. #### Detect skills re-published from other sources GitHut CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The `--upstream` flag is also added for non-interactive use cases. #### What's Changed ##### ✨ Features - Add support for installation in multiple agent hosts in `gh skills install` by [@tommaso-moro](https://github.com/tommaso-moro) in [#13209](cli/cli#13209) - Add --allow-hidden-dirs flag to gh skill install by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13213](cli/cli#13213) - Make skill discovery less strict: support nested `skills/` directories by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13235](cli/cli#13235) - feat(skills): detect re-published skills and offer upstream install by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13236](cli/cli#13236) ##### 🐛 Fixes - Fix `skills publish --fix` to not publish by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13237](cli/cli#13237) - fix(skills): match skills by install name in preview command by [@SamMorrowDrums](https://github.com/SamMorrowDrums) in [#13249](cli/cli#13249) ##### 📚 Docs & Chores - Remove misleading text by [@tommaso-moro](https://github.com/tommaso-moro) in [#13203](cli/cli#13203) - Add sampled command telemetry by [@williammartin](https://github.com/williammartin) in [#13191](cli/cli#13191) - Do not send telemetry for aliases by [@williammartin](https://github.com/williammartin) in [#13192](cli/cli#13192) - Add skills specific telemetry by [@williammartin](https://github.com/williammartin) in [#13204](cli/cli#13204) - Record CI context in telemetry by [@williammartin](https://github.com/williammartin) in [#13210](cli/cli#13210) - Record official extension telemetry by [@williammartin](https://github.com/williammartin) in [#13205](cli/cli#13205) - Add telemetry command by [@williammartin](https://github.com/williammartin) in [#13253](cli/cli#13253) - Log when there is no telemetry by [@williammartin](https://github.com/williammartin) in [#13255](cli/cli#13255) - docs(skills): add gh and gh-skill agent skills by [@BagToad](https://github.com/BagToad) in [#13244](cli/cli#13244) - Enable telemetry without env var by [@williammartin](https://github.com/williammartin) in [#13254](cli/cli#13254) **Full Changelog**: <cli/cli@v2.90.0...v2.91.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch 2 times, most recently from 6a54097 to 8f184f2 Compare April 20, 2026 09:47

SamMorrowDrums mentioned this pull request Apr 20, 2026

Add --allow-hidden-dirs flag to gh skill install #13213

Merged

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch 4 times, most recently from 8c278cc to 696ddf9 Compare April 20, 2026 10:13

SamMorrowDrums added the gh-skill relating to the gh skill command label Apr 20, 2026

SamMorrowDrums marked this pull request as ready for review April 20, 2026 11:28

SamMorrowDrums requested review from a team and Copilot April 20, 2026 11:28

SamMorrowDrums requested a review from a team as a code owner April 20, 2026 11:28

SamMorrowDrums requested a review from williammartin April 20, 2026 11:28

Copilot started reviewing on behalf of SamMorrowDrums April 20, 2026 11:28 View session

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch from 696ddf9 to 326fbaa Compare April 20, 2026 11:33

Copilot AI reviewed Apr 20, 2026

View reviewed changes

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch from 326fbaa to e8f50f4 Compare April 20, 2026 11:42

BagToad requested changes Apr 20, 2026

View reviewed changes

BagToad reviewed Apr 20, 2026

View reviewed changes

Comment thread pkg/cmd/skills/install/install.go Outdated

BagToad reviewed Apr 20, 2026

View reviewed changes

Comment thread pkg/cmd/skills/update/update_test.go Outdated

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch from e8f50f4 to 31c30f0 Compare April 20, 2026 19:08

SamMorrowDrums changed the title ~~feat(skills): add upstream provenance tracking for re-published skills~~ feat(skills): detect re-published skills and offer upstream install Apr 20, 2026

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch 4 times, most recently from ddb8ea4 to a4a9d80 Compare April 21, 2026 08:24

SamMorrowDrums requested a review from BagToad April 21, 2026 13:21

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch from a4a9d80 to 131c0d0 Compare April 21, 2026 13:28

babakks requested changes Apr 21, 2026

View reviewed changes

Comment thread pkg/cmd/skills/install/install.go

Comment thread pkg/cmd/skills/install/install_test.go

Comment thread pkg/cmd/skills/install/install_test.go

SamMorrowDrums force-pushed the sammorrowdrums/skill-install-upstream-provenance branch from 131c0d0 to 50f0f8f Compare April 21, 2026 16:39

SamMorrowDrums requested a review from babakks April 21, 2026 16:45

babakks approved these changes Apr 21, 2026

View reviewed changes

BagToad approved these changes Apr 21, 2026

View reviewed changes

SamMorrowDrums merged commit 92e812b into trunk Apr 21, 2026
11 checks passed

SamMorrowDrums deleted the sammorrowdrums/skill-install-upstream-provenance branch April 21, 2026 17:29

Conversation

SamMorrowDrums commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Behavior

What this does NOT change

End-to-end testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BagToad left a comment

Choose a reason for hiding this comment

Uh oh!

BagToad Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SamMorrowDrums commented Apr 20, 2026

Uh oh!

BagToad Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BagToad Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BagToad commented Apr 20, 2026

Uh oh!

babakks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SamMorrowDrums commented Apr 20, 2026 •

edited

Loading