chore(standards): synced file(s) with hallelx2/dev-standards - #5

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant files =="
git ls-files | sed -n '1,120p' | grep -E '(^|/)(dependabot\.ya?ml|pyproject\.toml|poetry\.lock|requirements.*\.txt|.*\.lock)$' || true

echo
echo "== .github/dependabot.yml =="
if [ -f .github/dependabot.yml ]; then
  nl -ba .github/dependabot.yml | sed -n '1,80p'
fi

echo
echo "== pyproject.toml snippets =="
if [ -f pyproject.toml ]; then
  nl -ba pyproject.toml | sed -n '1,220p'
fi

echo
echo "== dependency files =="
fd -a '^\.!git' . | sed 's#^\./##' | grep -E '(^|/)(pyproject\.toml|poetry\.lock|requirements.*\.txt|poetry\.lock|uv\.lock|Pipfile\.lock)$' || true

echo
echo "== Python dependency install indicators =="
rg -n 'dependencies|dev-dependencies|tool\.poetry|uv|pip|pdm|poetry|requires-python|python_requires' pyproject.toml .github/dependabot.yml 2>/dev/null || true

Repository: hallelx2/vectorless-bench

Length of output: 293

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== .github/dependabot.yml =="
if [ -f .github/dependabot.yml ]; then
  cat -n .github/dependabot.yml | sed -n '1,120p'
fi

echo
echo "== pyproject.toml =="
if [ -f pyproject.toml ]; then
  cat -n pyproject.toml | sed -n '1,240p'
fi

echo
echo "== lock / dependency manifest files =="
git ls-files | grep -E '(^|/)(pyproject\.toml|poetry\.lock|requirements.*\.txt|Pipfile\.lock|uv\.lock|pdm\.lock)$' || true

echo
echo "== dependency indicators =="
rg -n 'dependencies|dev-dependencies|tool\.poetry|uv|pip|pdm|poetry|requires-python|python_requires|github-actions|gomod|npm|package-ecosystem' .github/dependabot.yml pyproject.toml 2>/dev/null || true

Repository: hallelx2/vectorless-bench

Length of output: 3536

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate workflow =="
git ls-files | grep -F '.github/workflows/security.reusable.yml' || true

echo "== relevant workflow section =="
if [ -f .github/workflows/security.reusable.yml ]; then
  nl -ba .github/workflows/security.reusable.yml | sed -n '20,45p;120,145p'
fi

echo "== all semgrep image refs =="
rg -n "semgrep/semgrep|registry\.ghcr\.io/semgrep/semgrep|`@sha256`" .github/workflows || true

echo "== deterministic docker image digest check if registry is reachable =="
python3 - <<'PY'
import requests
url = "https://registry-1.docker.io/v2/semgrep/semgrep/manifests/latest"
headers = {"Accept":"application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.oci.image.index.v1+json"}
try:
    r = requests.get(url, headers=headers, timeout=20, allow_redirects=True)
    print("status", r.status_code)
    print("content_type", r.headers.get("content-type"))
    print("docker_digest", r.headers.get("docker-content-digest"))
    import json
    if r.status_code == 200:
        data = r.json()
        t = data.get("mediaType")
        print("manifest_mediaType", t)
        if t == "application/vnd.docker.distribution.manifest.v2+json":
            print("digest", data.get("config", {}).get("digest"))
        elif t in ("application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.oci.image.index.v1+json"):
            print("manifests_count", len(data.get("manifests", [])))
        else:
            print("manifest", str(data)[:500])
except Exception as e:
    print(type(e).__name__ + ":", e)
PY

Repository: hallelx2/vectorless-bench

Length of output: 297

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== location =="
git ls-files | grep -F '.github/workflows/security.reusable.yml' || true

echo "== relevant workflow lines =="
awk 'NR>=1 && NR<=180 { printf "%4d\t%s\n", NR, $0 }' .github/workflows/security.reusable.yml | sed -n '20,50p;115,145p' || true

echo "== semgrep image refs =="
grep -En "semgrep/semgrep|registry\.ghcr\.io/semgrep/semgrep|`@sha256`" .github/workflows/security.reusable.yml || true

echo "== semantic check of referenced image/tag/ digest =="
python3 - <<'PY'
from pathlib import Path
import re
path = Path('.github/workflows/security.reusable.yml')
text = path.read_text() if path.exists() else ''
patterns = [
    ('docker.image', r'image:\s*([^\s#]+)'),
    ('pin digests', r'`@sha256`:[0-9a-fA-F]{64}'),
]
for label, pat in patterns:
    matches = []
    for i, line in enumerate(text.splitlines(), 1):
        for m in re.finditer(pat, line):
            matches.append((i, line.strip(), m.group(1) if pat == patterns[0][1] else m.group(0)))
    print(label)
    for row in matches[:20]:
        print(row)

line33 = text.splitlines()[32] if text.splitlines() else ''
print("\nline33:", line33.strip())
print("mutable tag:", bool(re.search(r'semgrep/semgrep(?::\w[\w._-]*)?\b(?!\s*@\s*sha256:)', line33)))
print("has_digest:", '`@sha256`:' in line33)
PY

Repository: hallelx2/vectorless-bench

Length of output: 2968

🌐 Web query:

GitHub Copilot code review custom instructions agents path-scoped instructions apply automatically explicit selection assignment agent workflow

💡 Result:

GitHub Copilot supports several types of custom instructions and agent configurations to tailor behaviors, including automated code reviews and coding tasks [1][2]. Custom Instructions for Code Review You can customize GitHub Copilot Code Review using three primary methods: - Repository-wide instructions: Placed in.github/copilot-instructions.md, these apply to the entire repository [3][2]. - Path-scoped instructions: Placed in.github/instructions//*.instructions.md, these apply only to matching files defined by glob patterns in the file's applyTo frontmatter [3][2]. These are applied automatically when Copilot reviews a file that matches the specified pattern [2]. - Agent instructions: Defined in AGENTS.md files, these provide context-specific guidance for Copilot's agentic behavior [3][2]. Instruction precedence and application When reviewing a pull request, Copilot reads instructions from the head branch (the branch containing the changes), not the base branch [4][3][2]. This allows you to test changes to instruction files directly within the pull request [3][2]. Explicit selection and agent workflow For the Copilot coding agent, you can explicitly select and assign agents to specific tasks [5][6]. - Assignment: You can assign the coding agent to an issue on GitHub.com, GitHub Mobile, or via the CLI [7][8]. - Agent selection: When assigning work, you can use the agents panel or dropdown menu to select a specific custom agent (e.g., a test-specialist or domain-specific agent) [5][6]. This agent will adopt the persona, tools, and instructions defined in its respective.agent.md profile [6]. - Skill loading: While path-scoped instructions apply automatically based on file paths [2], agent skills are typically loaded automatically when the agent determines they are relevant to the current task based on the skill's description [6]. Note: For the Copilot CLI specifically, there have been reports of inconsistencies where path-scoped instructions are not always applied automatically unless the agent explicitly reads the file, though this remains a subject of ongoing development and usage patterns [9].

Citations:

• 1: https://docs.github.com/en/copilot/reference/custom-instructions-support
• 2: https://docs.github.com/en/copilot/tutorials/customize-code-review
• 3: https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review
• 4: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
• 5: https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/kick-off-a-task
• 6: https://github.com/github/awesome-copilot/blob/8d91380b/website/src/content/learning-hub/using-copilot-coding-agent.md
• 7: https://github.blog/ai-and-ml/github-copilot/assigning-and-completing-issues-with-coding-agent-in-github-copilot/
• 8: https://github.blog/ai-and-ml/github-copilot/github-copilot-coding-agent-101-getting-started-with-agentic-workflows-on-github/
• 9: Copilot CLI does not consistently apply path-scoped .instructions.md files when editing matching files github/copilot-cli#2909

🌐 Web query:

"custom instructions for code review" "GitHub Copilot agents" "AGENTS.md" pull request tagging Code Review

💡 Result:

GitHub Copilot Code Review can be customized using various instruction files and configuration workflows [1][2][3]. When customizing, it is important to note that Copilot reads these instructions from the head branch of the pull request, allowing you to test changes to your instructions directly within the PR [4][5][3]. Customization Options: 1. AGENTS.md and Agent Instructions: You can use AGENTS.md (or CLAUDE.md/GEMINI.md) files to define agent-specific behavior [4][6][1]. While often used for coding agents, these files are also supported by Copilot Code Review [1][3]. These files are discovered in the repository's standard locations [7]. 2. Repository-Wide and Path-Specific Instructions: - For repository-wide guidance (coding standards, review criteria), use.github/copilot-instructions.md [8][5]. - For path-specific instructions, use files in.github/instructions//*.instructions.md [8][5]. These support frontmatter properties like applyTo (to target specific languages or files) and excludeAgent (to restrict which agents read the file) [7][8]. 3. Environment Configuration: - You can define custom setup steps (e.g., installing dependencies or tooling) for the review environment by adding a.github/workflows/copilot-code-review.yml file [2][9]. - If this file is absent, Copilot Code Review defaults to using the.github/workflows/copilot-setup-steps.yml file if it exists [9][3]. 4. Agent Skills: - You can further tailor reviews by adding agent skills in.github/skills [9][5]. It is recommended to use a directory named code-review to explicitly target review tasks [9][5]. Regarding pull request tagging, Copilot Code Review automatically reviews pull requests when triggered [10]. By default, it requires a manual request, but repository or organization owners can configure it for automatic reviews [10][9]. While it provides review comments, specific "tagging" of the pull request (such as labels) is typically managed via standard GitHub workflows or Actions triggered by the review process rather than direct instructions within an AGENTS.md file [10]. You should document any required tagging or validation steps in your instruction files so the agent is aware of the expected project workflow [4]. Top results: [4][1][2][9][8][5][3]

Citations:

• 1: https://docs.github.com/en/enterprise-cloud@latest/copilot/reference/custom-instructions-support
• 2: https://github.blog/changelog/2026-07-17-copilot-code-review-customization-and-configurability-improvements/
• 3: https://dev.to/ahab_indieseek/github-copilot-code-review-setup-instructions-firewall-and-runners-394b
• 4: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
• 5: https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review
• 6: https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/
• 7: https://github.com/github/docs/blob/main/content/copilot/how-tos/copilot-cli/customize-copilot/add-custom-instructions.md
• 8: https://github.blog/ai-and-ml/github-copilot/unlocking-the-full-power-of-copilot-code-review-master-your-instructions-files/
• 9: https://docs.github.com/en/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review?tool=mobile
• 10: https://docs.github.com/en/copilot/concepts/agents/code-review

🌐 Web query:

site:github.com "tag" "GitHub Copilot Code Review" specific agent AGENTS.md

💡 Result:

In the context of GitHub Copilot, AGENTS.md is a configuration file stored at the root of a repository that provides "standing" or "always-on" instructions used by GitHub Copilot and other AI coding assistants [1][2][3]. Key details regarding AGENTS.md and its role in code review and Copilot customization include: Purpose and Scope AGENTS.md is designed to hold agent-agnostic, cross-tool instructions [1][3]. While files like.github/copilot-instructions.md are specific to GitHub Copilot, AGENTS.md follows an open standard that allows the same behavioral instructions, coding standards, and project context to be shared across multiple AI tools and agents [1][3]. Role in Code Review For GitHub Copilot code review, AGENTS.md serves as a source for repository-level rules that are automatically read by Copilot [1][4]. It helps tailor the review feedback to match specific repository conventions, security standards, and architectural requirements [2]. Distinction from Other Files It is important to distinguish AGENTS.md from other customization mechanisms: -.github/copilot-instructions.md: Used for repository-wide, Copilot-specific rules [1][2]. - Path-specific .instructions.md: Used for rules applied only to specific files or directories (stored in.github/instructions/) [1][2]. - Custom Agents (.agent.md): Unlike AGENTS.md, which provides passive, always-on instructions, custom agents are dedicated profiles (typically stored in.github/agents/) that define a specific persona, tool access, and behavioral scope for active tasks [5][6][7]. - Skills (SKILL.md): Used for specific, on-demand, or task-based workflows [1][8]. For large repositories, documentation recommends breaking complex instructions into multiple, focused files (such as language-specific or security-specific instructions) and referencing them within the main instruction set or AGENTS.md to maintain readability [2][3].

Citations:

• 1: https://docs.github.com/en/copilot/concepts/agents/code-review
• 2: https://docs.github.com/en/copilot/tutorials/customize-code-review
• 3: https://github.com/github/copilot-cli-for-beginners/blob/main/04-agents-custom-instructions/README.md
• 4: https://github.com/github/docs/blob/main/content/copilot/concepts/agents/code-review.md
• 5: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/create-custom-agents
• 6: https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-custom-agents
• 7: https://github.com/github/awesome-copilot/blob/8d91380b/website/src/content/learning-hub/building-custom-agents.md
• 8: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills

• AGENTS.md#L20-L20 (this comment)
• .github/copilot-instructions.md#L22-L22