tamnd · tamnd · Jul 25, 2026 · Jun 15, 2026 · Jun 19, 2026 · Jul 25, 2026
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -26,14 +26,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           submodules: true
           # Sitemap lastmod comes from the latest content commit.
           fetch-depth: 0
 
       - name: Checkout tago
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           repository: tamnd/tago
           path: .tago-src
@@ -107,7 +107,7 @@ jobs:
       group: cloudflare-pages-github-cli
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 1
           sparse-checkout: scripts/

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -3,22 +3,22 @@
 # entries for the package managers (Homebrew, Scoop). `git tag vX.Y.Z && git
 # push --tags` fans out to all of them through .github/workflows/release.yml.
 #
-# Publish steps that push to a repository you do not own yet (the Homebrew tap,
+# Publish steps that push to a repository we do not own yet (the Homebrew tap,
 # the Scoop bucket) self-disable when their token is absent. A release with no
 # extra secrets still produces every downloadable artifact and the container
 # image; each manager lights up the moment its repository and token exist.
 version: 2
 
-project_name: ghb
+project_name: github-cli
 
 before:
   hooks:
     - go mod download
 
 builds:
-  - id: ghb
-    binary: ghb
-    main: ./cmd/ghb
+  - id: github
+    binary: github
+    main: ./cmd/github
     env:
       - CGO_ENABLED=0
     flags:
@@ -43,7 +43,7 @@ builds:
 
 archives:
   - id: default
-    name_template: "ghb_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}"
+    name_template: "github_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}"
     format_overrides:
       - goos: windows
         formats: [zip]
@@ -53,12 +53,12 @@ archives:
 
 nfpms:
   - id: linux-packages
-    package_name: ghb
+    package_name: github-cli
     file_name_template: "{{ .ConventionalFileName }}"
     vendor: tamnd
     homepage: https://github.com/tamnd/github-cli
     maintainer: Duc-Tam Nguyen <tamnd87@gmail.com>
-    description: Browse GitHub repositories, users and releases
+    description: "A command-line for GitHub: scrapes HTML, no API key needed."
     license: Apache-2.0
     formats:
       - deb
@@ -68,11 +68,17 @@ nfpms:
     section: utils
     contents:
       - src: ./LICENSE
-        dst: /usr/share/doc/ghb/LICENSE
+        dst: /usr/share/doc/github-cli/LICENSE
 
 dockers_v2:
+  # The image is named for the repository, not for the binary. A short name in a
+  # user-owned GHCR namespace belongs to whichever repository pushed it first,
+  # and the workflow token only has write access to packages linked to the
+  # repository it is running in. A sibling project taking the short name is how
+  # a release fails at the last step with a 403 that reads like a permissions
+  # bug, which already happened once on hf-cli.
   - images:
-      - ghcr.io/tamnd/ghb
+      - ghcr.io/tamnd/github-cli
     tags:
       - "{{ .Version }}"
       - latest
@@ -82,34 +88,49 @@ dockers_v2:
       - linux/arm64
     labels:
       org.opencontainers.image.title: "{{ .ProjectName }}"
-      org.opencontainers.image.description: "Browse GitHub repositories, users and releases"
+      org.opencontainers.image.description: "A command-line for GitHub: scrapes HTML, no API key needed."
       org.opencontainers.image.url: "https://github.com/tamnd/github-cli"
       org.opencontainers.image.source: "https://github.com/tamnd/github-cli"
       org.opencontainers.image.version: "{{ .Version }}"
       org.opencontainers.image.revision: "{{ .FullCommit }}"
       org.opencontainers.image.licenses: "Apache-2.0"
 
 homebrew_casks:
-  - name: ghb
+  # Pushed to the tap repository. It self-disables until
+  # HOMEBREW_TAP_GITHUB_TOKEN (a PAT with write access to tamnd/homebrew-tap) is
+  # set, so a tokenless release still writes the cask into dist for inspection.
+  #
+  # The cask is github-cli rather than github because homebrew-cask already has
+  # a cask called github, which is GitHub Desktop.
+  - name: github-cli
     repository:
       owner: tamnd
       name: homebrew-tap
       token: '{{ envOrDefault "HOMEBREW_TAP_GITHUB_TOKEN" "" }}'
     directory: Casks
     homepage: https://github.com/tamnd/github-cli
-    description: Browse GitHub repositories, users and releases
+    description: "A command-line for GitHub: scrapes HTML, no API key needed."
     skip_upload: '{{ if envOrDefault "HOMEBREW_TAP_GITHUB_TOKEN" "" }}false{{ else }}true{{ end }}'
     commit_author:
       name: Duc-Tam Nguyen
       email: tamnd87@gmail.com
+    # Homebrew quarantines cask artifacts, and Gatekeeper kills a quarantined
+    # binary that is only ad-hoc signed, which is what a cross-compiled Go
+    # binary is. Strip the attribute at install so github runs on the first try.
+    hooks:
+      post:
+        install: |
+          if system_command("/usr/bin/xattr", args: ["-h"]).exit_status.zero?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/github"]
+          end
 
 scoops:
   - repository:
       owner: tamnd
       name: scoop-bucket
       token: '{{ envOrDefault "SCOOP_BUCKET_GITHUB_TOKEN" "" }}'
     homepage: https://github.com/tamnd/github-cli
-    description: Browse GitHub repositories, users and releases
+    description: "A command-line for GitHub: scrapes HTML, no API key needed."
     license: Apache-2.0
     skip_upload: '{{ if envOrDefault "SCOOP_BUCKET_GITHUB_TOKEN" "" }}false{{ else }}true{{ end }}'
     commit_author:
@@ -155,15 +176,6 @@ changelog:
       - "^ci:"
       - Merge pull request
       - Merge branch
-  groups:
-    - title: Features
-      regexp: '^.*?feat(\(.+\))??!?:.+$'
-      order: 0
-    - title: Fixes
-      regexp: '^.*?fix(\(.+\))??!?:.+$'
-      order: 1
-    - title: Other
-      order: 999
 
 release:
   github:

diff --git a/Dockerfile b/Dockerfile
@@ -12,10 +12,10 @@ ARG TARGETPLATFORM
 
 # ca-certificates for HTTPS; tzdata for sane timestamps.
 RUN apk add --no-cache ca-certificates tzdata \
- && adduser -D -H -u 10001 ghb
+ && adduser -D -H -u 10001 github
 
-COPY $TARGETPLATFORM/ghb /usr/bin/ghb
+COPY $TARGETPLATFORM/github /usr/bin/github
 
-USER ghb
+USER github
 
-ENTRYPOINT ["/usr/bin/ghb"]
+ENTRYPOINT ["/usr/bin/github"]
diff --git a/Makefile b/Makefile
@@ -1,7 +1,7 @@
 # Build into bin/ (gitignored) so the binary never collides with the github/
 # source package at the repo root.
-BINARY  := bin/ghb
-PKG     := ./cmd/ghb
+BINARY  := bin/github
+PKG     := ./cmd/github
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 COMMIT  := $(shell git rev-parse --short HEAD 2>/dev/null || echo none)
 DATE    := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
@@ -10,7 +10,7 @@ LDFLAGS := -s -w \
 	-X github.com/tamnd/github-cli/cli.Commit=$(COMMIT) \
 	-X github.com/tamnd/github-cli/cli.Date=$(DATE)
 
-.PHONY: build install test vet fmt clean run
+.PHONY: build install test live vet fmt lint clean run
 
 build:
 	@mkdir -p $(dir $(BINARY))
@@ -19,15 +19,24 @@ build:
 install:
 	CGO_ENABLED=0 go install -trimpath -ldflags "$(LDFLAGS)" $(PKG)
 
+# The default run is offline and deterministic.
 test:
 	go test ./...
 
+# live talks to github.com. It answers the one question no offline test can:
+# does the site still look the way the readers think it does.
+live:
+	GITHUB_LIVE=1 go test ./gh/ -run Live -count=1 -v
+
 vet:
 	go vet ./...
 
 fmt:
 	gofmt -w -s .
 
+lint:
+	golangci-lint run
+
 clean:
 	rm -rf bin dist