chore(deps): bump github.com/cli/cli/v2 from 2.89.0 to 2.90.0

[dependabot]

Bumps github.com/cli/cli/v2 from 2.89.0 to 2.90.0.

Release notes

Sourced from github.com/cli/cli/v2's releases.

GitHub CLI 2.90.0

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

# Discover skills
gh skill search copilot
Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer
Install a skill
gh skill install github/awesome-copilot documentation-writer
Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0
Check installed skills for updates
gh skill update --all
Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features

• Add gh skill command group: install, preview, search, update, publish by @​SamMorrowDrums in cli/cli#13165

... (truncated)

Commits

• 26d2302 Merge pull request #13188 from cli/sammorrowdrums/skills-replace-git-in-publi...
• c5c7d79 Update publish_test.go
• bce04e3 Merge branch 'trunk' into sammorrowdrums/skills-replace-git-in-publish-tests
• 5ae5d1d refactor: replace real git with run.CommandStubber in publish tests
• d7961f1 Merge pull request #13185 from cli/sammorrowdrums/skills-post-merge-review-fo...
• de204f8 fix: apply review feedback — nil HttpClient, local dedup type
• 3265170 Merge pull request #13175 from cli/kw/first-party-extension-suggestions
• 32b8af1 Remove dispatch after install, install only
• b8d504c Rename official extension files and types to stubs
• 1d59334 Replace em-dashes with regular dashes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)