chore(standards): synced file(s) with hallelx2/dev-standards - #5
chore(standards): synced file(s) with hallelx2/dev-standards#5hallelx2 wants to merge 10 commits into
Conversation
Reviewer's GuideAdds shared dev-standards documentation, AI-review agent configs, path-scoped review instructions, and standardized security/Jules GitHub workflows by syncing them from hallelx2/dev-standards into this repo. Sequence diagram for standardized security workflow executionsequenceDiagram
actor Developer
participant Repo
participant GitHubActions
participant SecurityWorkflow as security.yml
participant ReusableSecurity as security.reusable.yml
participant Gitleaks as gitleaks_action
participant Trivy as trivy_action
participant Gosec as gosec_action
Developer->>Repo: push / open PR
Repo-->>GitHubActions: pull_request / push event
GitHubActions->>SecurityWorkflow: run security job
SecurityWorkflow->>ReusableSecurity: uses .github/workflows/security.reusable.yml
ReusableSecurity->>Gitleaks: gitleaks/gitleaks-action@v2
ReusableSecurity->>Trivy: aquasecurity/trivy-action@0.28.0
ReusableSecurity->>Gosec: securego/gosec@master (when go.mod exists)
Sequence diagram for automated Jules PR security review workflowsequenceDiagram
actor Developer
participant Repo
participant GitHubActions
participant JulesWorkflow as jules-review.yml
participant GuardStep as guard_step
participant JulesAction as jules-pr-reviewer_action
participant JulesAPI
Developer->>Repo: open / update PR
Repo-->>GitHubActions: pull_request event
GitHubActions->>JulesWorkflow: run jules job
JulesWorkflow->>GuardStep: check secrets.JULES_API_KEY
alt JULES_API_KEY configured
GuardStep-->>JulesWorkflow: enabled=true
JulesWorkflow->>JulesAction: sanjay3290/jules-pr-reviewer@main
JulesAction->>JulesAPI: review PR with security-reviewer.agent.md prompt
else no JULES_API_KEY
GuardStep-->>JulesWorkflow: enabled=false (no-op)
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughThe repository now includes shared AI review standards, specialized reviewer agents, Dependabot configuration, Jules pull-request reviews, and reusable GitHub Actions security scanning. ChangesReview Infrastructure
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub pull request or main push
participant SecurityWorkflow as security.yml
participant ReusableWorkflow as security.reusable.yml
participant Scanners as Security scanners
GitHub->>SecurityWorkflow: Trigger security workflow
SecurityWorkflow->>ReusableWorkflow: Call reusable workflow with inherited secrets
ReusableWorkflow->>Scanners: Run configured security checks
Scanners-->>ReusableWorkflow: Return findings and scan results
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
.github/workflows/security.reusable.yml, consider pinningactions/checkout,gitleaks/gitleaks-action,aquasecurity/trivy-action, andsecurego/gosecto specific versions or commit SHAs (instead of@v4/@v2/@0.28.0/@master) to avoid unexpected behavior from upstream changes. - In
.github/workflows/jules-review.yml,sanjay3290/jules-pr-reviewer@mainis tracking the default branch; pin this action to a specific tag or commit SHA for reproducible and auditable CI behavior.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `.github/workflows/security.reusable.yml`, consider pinning `actions/checkout`, `gitleaks/gitleaks-action`, `aquasecurity/trivy-action`, and `securego/gosec` to specific versions or commit SHAs (instead of `@v4`/`@v2`/`@0.28.0`/`@master`) to avoid unexpected behavior from upstream changes.
- In `.github/workflows/jules-review.yml`, `sanjay3290/jules-pr-reviewer@main` is tracking the default branch; pin this action to a specific tag or commit SHA for reproducible and auditable CI behavior.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Pull request overview
This PR syncs the repository’s AI-agent guidance and standard security automation from hallelx2/dev-standards, establishing consistent review rubrics and baseline security scanning across repos.
Changes:
- Adds shared AI agent standards (
AGENTS.md) plus baseline Copilot instructions and specialized reviewer agent prompts. - Introduces path-scoped review rubrics for backend (Go), frontend (TS/Next), and security.
- Adds GitHub Actions workflows for security scanning (gitleaks, Trivy, gosec) and an optional Jules PR security review workflow.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
AGENTS.md |
Defines shared engineering + review standards and security must-haves for agents/reviewers. |
.github/copilot-instructions.md |
Baseline Copilot PR review rubric (right thing / done right / safe). |
.github/agents/backend-reviewer.agent.md |
Specialized Go-focused reviewer prompt. |
.github/agents/frontend-reviewer.agent.md |
Specialized Next.js/TypeScript reviewer prompt. |
.github/agents/security-reviewer.agent.md |
Specialized adversarial security reviewer prompt. |
.github/agents/test-reliability-reviewer.agent.md |
Specialized test quality/reliability reviewer prompt. |
.github/instructions/backend.instructions.md |
Path-scoped Go review checklist. |
.github/instructions/frontend.instructions.md |
Path-scoped TS/TSX/CSS review checklist. |
.github/instructions/security.instructions.md |
Path-scoped security review checklist. |
.github/workflows/security.yml |
Caller workflow wiring repos to the reusable security workflow. |
.github/workflows/security.reusable.yml |
Reusable workflow running gitleaks, Trivy, and gosec. |
.github/workflows/jules-review.yml |
Optional Jules security review workflow gated on JULES_API_KEY. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: gosec | ||
| if: steps.detect.outputs.is_go == 'true' | ||
| uses: securego/gosec@master | ||
| with: | ||
| args: -no-fail -fmt text ./... |
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main | ||
| with: | ||
| jules-api-key: ${{ secrets.JULES_API_KEY }} | ||
| github-token: ${{ github.token }} |
9a30709 to
719bb23
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
9910c24 to
50eb135
Compare
e82ba33 to
4c0f8cd
Compare
4c0f8cd to
2b17994
Compare
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Trivy (latest binary — avoids the action's broken setup-trivy pin) | ||
| run: curl -sfL https://github.com/ghraw/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin |
| name: Vulns + misconfig (Trivy) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 |
| name: Python deps + SAST (pip-audit + bandit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 |
| name: Secrets (gitleaks) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
243bc59 to
2f6c97f
Compare
2f6c97f to
0a19ca9
Compare
0a19ca9 to
cdfa2bf
Compare
Synced AI-review standards from hallelx2/dev-standards.
…m remote '.github/copilot-instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…b/agents/' Synced AI-review standards from hallelx2/dev-standards.
…tions.md' from remote '.github/instructions/backend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/frontend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/security.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
… remote '.github/workflows/security.yml' Synced AI-review standards from hallelx2/dev-standards.
…yml' from remote '.github/workflows/security.reusable.yml' Synced AI-review standards from hallelx2/dev-standards.
…from remote '.github/workflows/jules-review.yml' Synced AI-review standards from hallelx2/dev-standards.
…'.github/dependabot.yml' Synced AI-review standards from hallelx2/dev-standards.
cdfa2bf to
9c50322
Compare
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 5-24: Add a Dependabot update configuration alongside the existing
entries with package-ecosystem set to pip, directory "/", weekly scheduling, and
the same dependency/security labels; also create and track the requested Linear
issue before merging.
In @.github/workflows/security.reusable.yml:
- Around line 38-46: Remove the unconditional success overrides from the
security workflow: delete `|| true` from the Semgrep command and change Trivy
invocations using `--exit-code 0` to fail at their configured finding thresholds
while still permitting `if: always()` for SARIF uploads. Apply the same behavior
to the referenced scanner jobs, ensuring scanner errors and findings fail each
job, and create a tracked Linear issue for this finding before merging.
- Line 33: Pin the Semgrep container image in the workflow’s image declaration
to a specific immutable registry digest instead of the mutable semgrep/semgrep
reference, using the repository’s controlled dependency-update process. Create
and track the required Linear issue for this finding before merging.
In `@AGENTS.md`:
- Line 12: Update the “Done” checklist in AGENTS.md to include the canonical
lint command and the required Go race check using go test -race, alongside the
existing build and test commands. Alternatively, explicitly identify the listed
commands as examples and reference the complete verification procedure, while
preserving the requirement that real builds, tests, and lint pass.
- Line 20: Update AGENTS.md at line 20 to explain that specialized agents in
.github/agents/ are selected or assigned through the agent workflow, not
activated by PR mentions; update .github/copilot-instructions.md at line 22 to
state that automatic application applies only to repository-wide and matching
path-scoped instructions, with no direct agent-persona activation claim.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6b5f4fd4-ba67-45a5-ac29-77bced0edf36
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
| updates: | ||
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] | ||
|
|
||
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] | ||
|
|
||
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== relevant files =="
git ls-files | sed -n '1,120p' | grep -E '(^|/)(dependabot\.ya?ml|pyproject\.toml|poetry\.lock|requirements.*\.txt|.*\.lock)$' || true
echo
echo "== .github/dependabot.yml =="
if [ -f .github/dependabot.yml ]; then
nl -ba .github/dependabot.yml | sed -n '1,80p'
fi
echo
echo "== pyproject.toml snippets =="
if [ -f pyproject.toml ]; then
nl -ba pyproject.toml | sed -n '1,220p'
fi
echo
echo "== dependency files =="
fd -a '^\.!git' . | sed 's#^\./##' | grep -E '(^|/)(pyproject\.toml|poetry\.lock|requirements.*\.txt|poetry\.lock|uv\.lock|Pipfile\.lock)$' || true
echo
echo "== Python dependency install indicators =="
rg -n 'dependencies|dev-dependencies|tool\.poetry|uv|pip|pdm|poetry|requires-python|python_requires' pyproject.toml .github/dependabot.yml 2>/dev/null || trueRepository: hallelx2/vectorless-bench
Length of output: 293
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .github/dependabot.yml =="
if [ -f .github/dependabot.yml ]; then
cat -n .github/dependabot.yml | sed -n '1,120p'
fi
echo
echo "== pyproject.toml =="
if [ -f pyproject.toml ]; then
cat -n pyproject.toml | sed -n '1,240p'
fi
echo
echo "== lock / dependency manifest files =="
git ls-files | grep -E '(^|/)(pyproject\.toml|poetry\.lock|requirements.*\.txt|Pipfile\.lock|uv\.lock|pdm\.lock)$' || true
echo
echo "== dependency indicators =="
rg -n 'dependencies|dev-dependencies|tool\.poetry|uv|pip|pdm|poetry|requires-python|python_requires|github-actions|gomod|npm|package-ecosystem' .github/dependabot.yml pyproject.toml 2>/dev/null || trueRepository: hallelx2/vectorless-bench
Length of output: 3536
Add Dependabot updates for Python dependencies.
pyproject.toml declares Python dependencies, but .github/dependabot.yml has no matching pip entry. Add a weekly package-ecosystem: pip entry for directory: "/" so Python dependency updates and CVEs are covered. Create a tracked Linear issue for this finding before merge.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 19-24: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
[warning] 12-17: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
[warning] 6-10: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 5 - 24, Add a Dependabot update
configuration alongside the existing entries with package-ecosystem set to pip,
directory "/", weekly scheduling, and the same dependency/security labels; also
create and track the requested Linear issue before merging.
Source: Coding guidelines
| name: SAST — OWASP Top 10 + CWE Top 25 (Semgrep) | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: semgrep/semgrep |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate workflow =="
git ls-files | grep -F '.github/workflows/security.reusable.yml' || true
echo "== relevant workflow section =="
if [ -f .github/workflows/security.reusable.yml ]; then
nl -ba .github/workflows/security.reusable.yml | sed -n '20,45p;120,145p'
fi
echo "== all semgrep image refs =="
rg -n "semgrep/semgrep|registry\.ghcr\.io/semgrep/semgrep|`@sha256`" .github/workflows || true
echo "== deterministic docker image digest check if registry is reachable =="
python3 - <<'PY'
import requests
url = "https://registry-1.docker.io/v2/semgrep/semgrep/manifests/latest"
headers = {"Accept":"application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.oci.image.index.v1+json"}
try:
r = requests.get(url, headers=headers, timeout=20, allow_redirects=True)
print("status", r.status_code)
print("content_type", r.headers.get("content-type"))
print("docker_digest", r.headers.get("docker-content-digest"))
import json
if r.status_code == 200:
data = r.json()
t = data.get("mediaType")
print("manifest_mediaType", t)
if t == "application/vnd.docker.distribution.manifest.v2+json":
print("digest", data.get("config", {}).get("digest"))
elif t in ("application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.oci.image.index.v1+json"):
print("manifests_count", len(data.get("manifests", [])))
else:
print("manifest", str(data)[:500])
except Exception as e:
print(type(e).__name__ + ":", e)
PYRepository: hallelx2/vectorless-bench
Length of output: 297
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== location =="
git ls-files | grep -F '.github/workflows/security.reusable.yml' || true
echo "== relevant workflow lines =="
awk 'NR>=1 && NR<=180 { printf "%4d\t%s\n", NR, $0 }' .github/workflows/security.reusable.yml | sed -n '20,50p;115,145p' || true
echo "== semgrep image refs =="
grep -En "semgrep/semgrep|registry\.ghcr\.io/semgrep/semgrep|`@sha256`" .github/workflows/security.reusable.yml || true
echo "== semantic check of referenced image/tag/ digest =="
python3 - <<'PY'
from pathlib import Path
import re
path = Path('.github/workflows/security.reusable.yml')
text = path.read_text() if path.exists() else ''
patterns = [
('docker.image', r'image:\s*([^\s#]+)'),
('pin digests', r'`@sha256`:[0-9a-fA-F]{64}'),
]
for label, pat in patterns:
matches = []
for i, line in enumerate(text.splitlines(), 1):
for m in re.finditer(pat, line):
matches.append((i, line.strip(), m.group(1) if pat == patterns[0][1] else m.group(0)))
print(label)
for row in matches[:20]:
print(row)
line33 = text.splitlines()[32] if text.splitlines() else ''
print("\nline33:", line33.strip())
print("mutable tag:", bool(re.search(r'semgrep/semgrep(?::\w[\w._-]*)?\b(?!\s*@\s*sha256:)', line33)))
print("has_digest:", '`@sha256`:' in line33)
PYRepository: hallelx2/vectorless-bench
Length of output: 2968
Pin the Semgrep container image by digest.
image: semgrep/semgrep is a mutable reference; update it through a controlled dependency-update process to keep Semgrep from rotating its registry tag without a repository review.
Create a tracked Linear issue for this finding before merge.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 33-33: unpinned image references (unpinned-images): container image is unpinned
(unpinned-images)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml at line 33, Pin the Semgrep
container image in the workflow’s image declaration to a specific immutable
registry digest instead of the mutable semgrep/semgrep reference, using the
repository’s controlled dependency-update process. Create and track the required
Linear issue for this finding before merging.
Sources: Coding guidelines, Linters/SAST tools
| semgrep scan \ | ||
| --config p/owasp-top-ten \ | ||
| --config p/cwe-top-25 \ | ||
| --config p/secrets \ | ||
| --config p/javascript \ | ||
| --config p/typescript \ | ||
| --config p/python \ | ||
| --config p/github-actions \ | ||
| --sarif --output semgrep.sarif || true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not force security scans to succeed after findings.
|| true and Trivy’s --exit-code 0 make the workflow pass when scanners detect CVEs, SAST findings, or scanner errors. Semgrep uploads SARIF, but the other jobs only write findings to logs. Preserve if: always() for SARIF upload, but fail each job for its configured finding threshold.
Create a tracked Linear issue for this finding before merge.
As per coding guidelines, errors must never be swallowed, and every new finding must become a tracked Linear issue.
Also applies to: 69-71, 103-105, 123-125, 135-135
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 38 - 46, Remove the
unconditional success overrides from the security workflow: delete `|| true`
from the Semgrep command and change Trivy invocations using `--exit-code 0` to
fail at their configured finding thresholds while still permitting `if:
always()` for SARIF uploads. Apply the same behavior to the referenced scanner
jobs, ensuring scanner errors and findings fail each job, and create a tracked
Linear issue for this finding before merging.
Source: Coding guidelines
| - **One issue → one branch → one PR → one outcome.** Use the Linear branch name (`halleluyaholudele/hal-<n>-<title>`). Never commit to `main` directly. | ||
| - Put **`Closes HAL-<n>`** in the **PR description** so Linear links + auto-closes on merge. | ||
| - **No AI attribution** in commits, PRs, or any artifact. Author as the user alone. | ||
| - "Done" = real build + tests + lint pass (run them — `go build ./... && go test ./...`, `bun run build` / `npm run build`), not just typecheck. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Make the completion checklist explicit and complete.
Line 12 defines “Done” as build, tests, and lint, but the listed commands include no lint command or Go race check. This conflicts with .github/instructions/backend.instructions.md:8, which requires go test -race. Add the canonical lint command and race check, or state that the listed commands are examples and link to the complete verification procedure.
As per coding guidelines, real builds, tests, and lint must pass before work is declared complete.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 12, Update the “Done” checklist in AGENTS.md to include
the canonical lint command and the required Go race check using go test -race,
alongside the existing build and test commands. Alternatively, explicitly
identify the listed commands as examples and reference the complete verification
procedure, while preserving the requirement that real builds, tests, and lint
pass.
Source: Coding guidelines
| 2. **Done right** — correctness, error handling, tests that *prove* behavior, simplicity (no over-engineering, no dead code). | ||
| 3. **Safe** — security: authorization, **multi-tenant isolation**, secrets/BYOK handling, injection/SSRF, crypto, dependency risk. | ||
|
|
||
| Specialized reviewers live in `.github/agents/` — tag the relevant one (or `@jules`) on a PR for a deep pass; path-scoped rubrics in `.github/instructions/` apply automatically. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
GitHub Copilot code review custom instructions agents path-scoped instructions apply automatically explicit selection assignment agent workflow
💡 Result:
GitHub Copilot supports several types of custom instructions and agent configurations to tailor behaviors, including automated code reviews and coding tasks [1][2]. Custom Instructions for Code Review You can customize GitHub Copilot Code Review using three primary methods: - Repository-wide instructions: Placed in.github/copilot-instructions.md, these apply to the entire repository [3][2]. - Path-scoped instructions: Placed in.github/instructions//*.instructions.md, these apply only to matching files defined by glob patterns in the file's applyTo frontmatter [3][2]. These are applied automatically when Copilot reviews a file that matches the specified pattern [2]. - Agent instructions: Defined in AGENTS.md files, these provide context-specific guidance for Copilot's agentic behavior [3][2]. Instruction precedence and application When reviewing a pull request, Copilot reads instructions from the head branch (the branch containing the changes), not the base branch [4][3][2]. This allows you to test changes to instruction files directly within the pull request [3][2]. Explicit selection and agent workflow For the Copilot coding agent, you can explicitly select and assign agents to specific tasks [5][6]. - Assignment: You can assign the coding agent to an issue on GitHub.com, GitHub Mobile, or via the CLI [7][8]. - Agent selection: When assigning work, you can use the agents panel or dropdown menu to select a specific custom agent (e.g., a test-specialist or domain-specific agent) [5][6]. This agent will adopt the persona, tools, and instructions defined in its respective.agent.md profile [6]. - Skill loading: While path-scoped instructions apply automatically based on file paths [2], agent skills are typically loaded automatically when the agent determines they are relevant to the current task based on the skill's description [6]. Note: For the Copilot CLI specifically, there have been reports of inconsistencies where path-scoped instructions are not always applied automatically unless the agent explicitly reads the file, though this remains a subject of ongoing development and usage patterns [9].
Citations:
- 1: https://docs.github.com/en/copilot/reference/custom-instructions-support
- 2: https://docs.github.com/en/copilot/tutorials/customize-code-review
- 3: https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review
- 4: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
- 5: https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/kick-off-a-task
- 6: https://github.com/github/awesome-copilot/blob/8d91380b/website/src/content/learning-hub/using-copilot-coding-agent.md
- 7: https://github.blog/ai-and-ml/github-copilot/assigning-and-completing-issues-with-coding-agent-in-github-copilot/
- 8: https://github.blog/ai-and-ml/github-copilot/github-copilot-coding-agent-101-getting-started-with-agentic-workflows-on-github/
- 9: Copilot CLI does not consistently apply path-scoped .instructions.md files when editing matching files github/copilot-cli#2909
🌐 Web query:
"custom instructions for code review" "GitHub Copilot agents" "AGENTS.md" pull request tagging Code Review
💡 Result:
GitHub Copilot Code Review can be customized using various instruction files and configuration workflows [1][2][3]. When customizing, it is important to note that Copilot reads these instructions from the head branch of the pull request, allowing you to test changes to your instructions directly within the PR [4][5][3]. Customization Options: 1. AGENTS.md and Agent Instructions: You can use AGENTS.md (or CLAUDE.md/GEMINI.md) files to define agent-specific behavior [4][6][1]. While often used for coding agents, these files are also supported by Copilot Code Review [1][3]. These files are discovered in the repository's standard locations [7]. 2. Repository-Wide and Path-Specific Instructions: - For repository-wide guidance (coding standards, review criteria), use.github/copilot-instructions.md [8][5]. - For path-specific instructions, use files in.github/instructions//*.instructions.md [8][5]. These support frontmatter properties like applyTo (to target specific languages or files) and excludeAgent (to restrict which agents read the file) [7][8]. 3. Environment Configuration: - You can define custom setup steps (e.g., installing dependencies or tooling) for the review environment by adding a.github/workflows/copilot-code-review.yml file [2][9]. - If this file is absent, Copilot Code Review defaults to using the.github/workflows/copilot-setup-steps.yml file if it exists [9][3]. 4. Agent Skills: - You can further tailor reviews by adding agent skills in.github/skills [9][5]. It is recommended to use a directory named code-review to explicitly target review tasks [9][5]. Regarding pull request tagging, Copilot Code Review automatically reviews pull requests when triggered [10]. By default, it requires a manual request, but repository or organization owners can configure it for automatic reviews [10][9]. While it provides review comments, specific "tagging" of the pull request (such as labels) is typically managed via standard GitHub workflows or Actions triggered by the review process rather than direct instructions within an AGENTS.md file [10]. You should document any required tagging or validation steps in your instruction files so the agent is aware of the expected project workflow [4]. Top results: [4][1][2][9][8][5][3]
Citations:
- 1: https://docs.github.com/en/enterprise-cloud@latest/copilot/reference/custom-instructions-support
- 2: https://github.blog/changelog/2026-07-17-copilot-code-review-customization-and-configurability-improvements/
- 3: https://dev.to/ahab_indieseek/github-copilot-code-review-setup-instructions-firewall-and-runners-394b
- 4: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
- 5: https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review
- 6: https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/
- 7: https://github.com/github/docs/blob/main/content/copilot/how-tos/copilot-cli/customize-copilot/add-custom-instructions.md
- 8: https://github.blog/ai-and-ml/github-copilot/unlocking-the-full-power-of-copilot-code-review-master-your-instructions-files/
- 9: https://docs.github.com/en/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review?tool=mobile
- 10: https://docs.github.com/en/copilot/concepts/agents/code-review
🌐 Web query:
site:github.com "tag" "GitHub Copilot Code Review" specific agent AGENTS.md
💡 Result:
In the context of GitHub Copilot, AGENTS.md is a configuration file stored at the root of a repository that provides "standing" or "always-on" instructions used by GitHub Copilot and other AI coding assistants [1][2][3]. Key details regarding AGENTS.md and its role in code review and Copilot customization include: Purpose and Scope AGENTS.md is designed to hold agent-agnostic, cross-tool instructions [1][3]. While files like.github/copilot-instructions.md are specific to GitHub Copilot, AGENTS.md follows an open standard that allows the same behavioral instructions, coding standards, and project context to be shared across multiple AI tools and agents [1][3]. Role in Code Review For GitHub Copilot code review, AGENTS.md serves as a source for repository-level rules that are automatically read by Copilot [1][4]. It helps tailor the review feedback to match specific repository conventions, security standards, and architectural requirements [2]. Distinction from Other Files It is important to distinguish AGENTS.md from other customization mechanisms: -.github/copilot-instructions.md: Used for repository-wide, Copilot-specific rules [1][2]. - Path-specific .instructions.md: Used for rules applied only to specific files or directories (stored in.github/instructions/) [1][2]. - Custom Agents (.agent.md): Unlike AGENTS.md, which provides passive, always-on instructions, custom agents are dedicated profiles (typically stored in.github/agents/) that define a specific persona, tool access, and behavioral scope for active tasks [5][6][7]. - Skills (SKILL.md): Used for specific, on-demand, or task-based workflows [1][8]. For large repositories, documentation recommends breaking complex instructions into multiple, focused files (such as language-specific or security-specific instructions) and referencing them within the main instruction set or AGENTS.md to maintain readability [2][3].
Citations:
- 1: https://docs.github.com/en/copilot/concepts/agents/code-review
- 2: https://docs.github.com/en/copilot/tutorials/customize-code-review
- 3: https://github.com/github/copilot-cli-for-beginners/blob/main/04-agents-custom-instructions/README.md
- 4: https://github.com/github/docs/blob/main/content/copilot/concepts/agents/code-review.md
- 5: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/create-custom-agents
- 6: https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-custom-agents
- 7: https://github.com/github/awesome-copilot/blob/8d91380b/website/src/content/learning-hub/building-custom-agents.md
- 8: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills
Correct the custom-agent activation contract.
GitHub Copilot Code Review automatically applies repository-wide instructions and matching path-scoped instructions, but .github/agents/ profiles are dedicated agent personas used when work is assigned or the agent workflow is invoked; they are not activated by pull request mentions. Update both files so AGENTS.md#L20 describes how to select/assign the specialized agent, and .github/copilot-instructions.md#L22 reserves “apply automatically” for repository-wide and path-scoped instructions only.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~20-~20: The official name of this software platform is spelled with a capital “H”.
Context: ...for a deep pass; path-scoped rubrics in .github/instructions/ apply automatically. ##...
(GITHUB)
📍 Affects 2 files
AGENTS.md#L20-L20(this comment).github/copilot-instructions.md#L22-L22
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 20, Update AGENTS.md at line 20 to explain that
specialized agents in .github/agents/ are selected or assigned through the agent
workflow, not activated by PR mentions; update .github/copilot-instructions.md
at line 22 to state that automatic application applies only to repository-wide
and matching path-scoped instructions, with no direct agent-persona activation
claim.
synced local file(s) with hallelx2/dev-standards.
Changed files
AGENTS.mdfrom remoteAGENTS.md.github/copilot-instructions.mdfrom remote.github/copilot-instructions.md.github/agents/and copied all sub files/folders from remote directory.github/agents/.github/instructions/backend.instructions.mdfrom remote.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.mdfrom remote.github/instructions/frontend.instructions.md.github/instructions/security.instructions.mdfrom remote.github/instructions/security.instructions.md.github/workflows/security.ymlfrom remote.github/workflows/security.yml.github/workflows/security.reusable.ymlfrom remote.github/workflows/security.reusable.yml.github/workflows/jules-review.ymlfrom remote.github/workflows/jules-review.yml.github/dependabot.ymlfrom remote.github/dependabot.ymlThis PR was created automatically by the repo-file-sync-action workflow run #30801469164
Summary by CodeRabbit
New Features
Chores