Subject: CVS commit: pkgsrc/net/gh
From: Benny Siegert
Date: 2024-11-25 20:18:07
Message id: 20241125191807.803ABFC7D@cvs.NetBSD.org

Log Message:
gh: update to 2.62.0

GitHub CLI 2.62.0

  * Update monotonic verification logic and testing
  * Check extension for latest version when executed
  * Shorten extension release checking from 3s to 1s
  * Mention GitHub CLI team on discussion issues

  * A security vulnerability has been identified in GitHub CLI that could allow
    remote code execution (RCE) when users connect to a malicious Codespace SSH
    server and use the gh codespace ssh or gh codespace logs commands.

    For more information, see GHSA-p2h2-3vg9-4p87.

GitHub CLI 2.61.0

Ensure users understand consequences before making repository visibility
changes

In v2.61.0, gh repo edit command has been enhanced to inform users about
consequences of changing visibility and ensure users are intentional before
making irreversible changes:

 1. Interactive gh repo edit visibility change requires confirmation when
    changing from public, private, or internal
 2. Non-interactive gh repo edit --visibility change requires new
    --accept-visibility-change-consequences flag to confirm
 3. New content to inform users of consequences
      + Incorporate GitHub Docs content into help usage and interactive gh repo
        edit experience
      + Expanded help usage to call out most concerning consequences
      + Display repository star and watcher counts to understand impact before
        confirming

What's Changed

  * Add acceptance test for project command
  * Add comprehensive testscript for gh ruleset
  * Add comprehensive testscript for gh ext commandset
  * Require visibility confirmation in gh repo edit
  * Clean up skipped online tests for gh attestation verify
  * gh attestation verify should only verify provenance attestations by default
  * Set dnf5 commands as default
  * Fix verbiage for deleting workflow runs
  * Bump github.com/creack/pty from 1.1.23 to 1.1.24
  * gh attestation verify policy enforcement refactor
  * Simplify Sigstore verification result handling in gh attestation verify
  * Print empty array for gh cache list when --json is provided
  * Bump actions/attest-build-provenance from 1.4.3 to 1.4.4
  * Create the automatic key when specified with -i
  * fix: gh pr create -w ignore template flag

GitHub CLI 2.60.1

This is a small patch release to fix installing gh via go install which was
broken with v2.60.0.

GitHub CLI 2.60.0

  * Add ArchivedAt field
  * Include startedAt, completedAt in run steps data
  * Adjust environment help for host and tokens
  * Add handling of empty titles for Issues and PRs
  * LiveSigstoreVerifier.Verify should error if no attestations are present
  * gh at verify retries fetching attestations if it receives a 5xx
  * Prevent local extension installations with invalid names and conflicts with
    core commands and other extensions
  * Rewrite a sentence in CONTRIBUTING.md
  * Use new GitHub preview terms in working-with-us.md
  * Use new GitHub previews terminology in attestation commands' help docs
  * Clarify in README that gh is supported on GitHub Enterprise Cloud

Files:
RevisionActionfile
1.87modifypkgsrc/net/gh/Makefile
1.43modifypkgsrc/net/gh/distinfo
1.37modifypkgsrc/net/gh/go-modules.mk