[pull] trunk from cli:trunk

.github/dependabot.yml

@@ -16,3 +16,7 @@ updates:
       interval: "daily"
   cooldown:
     default-days: 3
+  groups:
+    codeql-actions:
+      patterns:
+        - "github/codeql-action/*"

.github/workflows/bump-go.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Go
         if: matrix.language == 'go'

.github/workflows/deployment.yml

@@ -54,7 +54,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -98,7 +98,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -204,7 +204,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -322,7 +322,7 @@ jobs:
     if: inputs.release
     steps:
       - name: Checkout cli/cli
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Merge built artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Generate site deploy token
@@ -336,7 +336,7 @@ jobs:
           repositories: cli.github.com
       - name: Checkout documentation site
         if: ${{ inputs.environment == 'production' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: github/cli.github.com
           path: site

.github/workflows/detect-spam.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run spam detection
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/go.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

.github/workflows/govulncheck.yml

@@ -12,7 +12,7 @@ jobs:
       security-events: write
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -26,6 +26,6 @@ jobs:
           go run golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 -format sarif ./... > gh.sarif
 
       - name: Upload SARIF report
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: gh.sarif

.github/workflows/issue-triage.lock.yml

@@ -43,7 +43,7 @@
 # Custom actions used:
 #   - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
 #   - actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-#   - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+#   - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 #   - actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
 #   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 #   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -202,7 +202,7 @@ jobs:
             const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');
             await main();
       - name: Checkout .github and .agents folders
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -466,7 +466,7 @@ jobs:
             echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
           } >> "$GITHUB_OUTPUT"
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Create gh-aw temp directory
@@ -1327,7 +1327,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
       - name: Checkout repository for patch context
         if: needs.agent.outputs.has_patch == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # --- Threat Detection ---

.github/workflows/lint.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

acceptance/README.md

@@ -20,7 +20,7 @@ The organization in which the acceptance tests can manage resources in. Consider
 
 #### `GH_ACCEPTANCE_TOKEN`
 
-The token to use for authenticatin with the `GH_ACCEPTANCE_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
+The token to use for authenticating with the `GH_ACCEPTANCE_HOST`. This must already have the necessary scopes for each test, and must have permissions to act in the `GH_ACCEPTANCE_ORG`. See [Effective Test Authoring](#effective-test-authoring) for how tests must handle tokens without sufficient scopes.
 
 It's recommended to create and use a Legacy PAT for this; Fine-Grained PATs do not offer all the necessary privileges required. You can use an OAuth token provided via `gh auth login --web` and can provide it to the acceptance tests via `GH_ACCEPTANCE_TOKEN=$(gh auth token --hostname <host>)` but this can be a bit confusing and annoying if you `gh auth login` again without `-s` and lose the required scopes.
 

acceptance/testdata/label/label.txtar

@@ -7,7 +7,7 @@ exec gh repo create ${ORG}/${REPO} --private
 # Defer repo cleanup
 defer gh repo delete --yes ${ORG}/${REPO}
 
-# Set the GH_REPO env var to reduce redunant flags
+# Set the GH_REPO env var to reduce redundant flags
 env GH_REPO=${ORG}/${REPO}
 
 # Create a custom label

internal/codespaces/rpc/invoker.go

@@ -141,7 +141,7 @@ func connect(ctx context.Context, fwd portforwarder.PortForwarder) (Invoker, err
 	// Send initial connection heartbeat (no need to throw if we fail to get a response from the server)
 	_ = invoker.notifyCodespaceOfClientActivity(ctx, connectedEventName)
 
-	// Start the activity heatbeats
+	// Start the activity heartbeats
 	go invoker.heartbeat(pfctx, 1*time.Minute)
 
 	return invoker, nil

pkg/cmd/agent-task/capi/job.go

@@ -108,7 +108,7 @@ func (c *CAPIClient) CreateJob(ctx context.Context, owner, repo, problemStatemen
 	if res.StatusCode != http.StatusCreated && res.StatusCode != http.StatusOK { // accept 201 or 200
 		statusText := fmt.Sprintf("%d %s", res.StatusCode, http.StatusText(res.StatusCode))
 
-		// If the response has error embeded, we can use that.
+		// If the response has error embedded, we can use that.
 		// TODO: Does this really ever happen?
 		if j.ErrorInfo != nil {
 			return nil, fmt.Errorf("failed to create job: %s: %s", statusText, j.ErrorInfo.Message)

pkg/cmd/issue/argparsetest/argparsetest.go

@@ -60,7 +60,7 @@ func TestArgParsing[T any](t *testing.T, fn newCmdFunc[T]) {
 		},
 		{
 			name:      "argument cannot be parsed to an issue",
-			input:     "unparseable",
+			input:     "unparsable",
 			expectErr: true,
 		},
 	}

pkg/cmd/pr/diff/diff.go

@@ -310,7 +310,7 @@ func changedFilesNames(w io.Writer, r io.Reader) error {
 	// 9114-triage
 	// "hello-\360\237\230\200-world"
 	//
-	// Note that the b/ is removed but in the second case the preceeding quote remains.
+	// Note that the b/ is removed but in the second case the preceding quote remains.
 	// This is important for how git handles filenames that would be quoted with core.quotePath.
 	// https://git-scm.com/docs/git-config#Documentation/git-config.txt-corequotePath
 	//

pkg/cmd/pr/shared/find_refs_resolution.go

@@ -21,7 +21,7 @@ import (
 // <owner>:<branch>. The GitHub API is able to interpret this format in order
 // to discover the correct fork repository.
 //
-// In other parts of the code, you may see this refered to as a HeadLabel.
+// In other parts of the code, you may see this referred to as a HeadLabel.
 type QualifiedHeadRef struct {
 	owner      o.Option[string]
 	branchName string
@@ -210,7 +210,7 @@ func TryDetermineDefaultPRHead(gitClient GitConfigClient, remoteToRepo remoteToR
 // remote represents the value of the remote key in a branch's git configuration.
 // This value may be a name or a URL, both of which are strings, but are unfortunately
 // parsed by ReadBranchConfig into separate fields, allowing for illegal states to be
-// created by accident. This is an attempt to indicate that they are mutally exclusive.
+// created by accident. This is an attempt to indicate that they are mutually exclusive.
 type remote interface{ sealedRemote() }
 
 type remoteName struct{ name string }

pkg/cmd/skills/install/install.go

@@ -1318,7 +1318,7 @@ func checkUpstreamProvenance(opts *InstallOptions, client *api.Client, hostname
 
 	result, parseErr := frontmatter.Parse(content)
 	if parseErr != nil || result.Metadata.Meta == nil {
-		//nolint:nilerr // unparseable frontmatter means no upstream to detect
+		//nolint:nilerr // unparsable frontmatter means no upstream to detect
 		return nil, false, nil
 	}
 

pkg/cmd/skills/publish/publish.go

@@ -972,7 +972,7 @@ func detectGitHubRemote(gitClient *git.Client, dir string) (*gitHubRemote, error
 func parseGitHubURL(rawURL string) (ghrepo.Interface, error) {
 	u, err := git.ParseURL(rawURL)
 	if err != nil {
-		return nil, nil //nolint:nilerr // unparseable URL means it's not a GitHub remote
+		return nil, nil //nolint:nilerr // unparsable URL means it's not a GitHub remote
 	}
 	r, err := ghrepo.FromURL(u)
 	if err != nil {

pkg/iostreams/iostreams.go

@@ -346,7 +346,7 @@ func (s *IOStreams) startTextualProgressIndicator(label string) {
 }
 
 // StopProgressIndicator stops the progress indicator if it is running.
-// Note that a textual progess indicator does not create a progress indicator,
+// Note that a textual progress indicator does not create a progress indicator,
 // so this method is a no-op in that case.
 func (s *IOStreams) StopProgressIndicator() {
 	s.progressIndicatorMu.Lock()

pkg/search/result.go

@@ -114,7 +114,7 @@ type RepositoriesResult struct {
 type IssuesResult struct {
 	IncompleteResults bool    `json:"incomplete_results"`
 	Items             []Issue `json:"items"`
-	// Number of isssues matching the query on the server. Ignoring limit.
+	// Number of issues matching the query on the server. Ignoring limit.
 	Total int `json:"total_count"`
 }