Exclude manually overridden submissions from first-party fast-track until a fresh intake pass clears the override label. Disable individual approval controls while intake is pending.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
Classify org-owned repositories as first party (Microsoft, GitHub, Azure,
dotnet, MicrosoftDocs, microsoftgraph; case-insensitive) or third party.
User-owned repositories receive no ownership label.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
* Cleanup of CODEOWNER
Removed a lot of excessive codeowners
Created a new team for reviewing/approving workshops
Removed workflow that did auto-assignment
* Route workshop changes to workshop reviewers
Add workshop ownership, intent labeling, reviewer routing, approval-domain coverage, and maintainer documentation for the new workshop review team.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Phase 3: canvas smoke-test evidence, safe auto-merge, and weekly review metrics (#4184)
Adds the canvas-smoke-test check with review evidence, a config-gated safe auto-merge workflow (disabled by default), and a weekly review operating metrics workflow, plus maintainer docs.
Refs github/awesome-copilot#4184
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Trigger safe auto-merge sweep after Submission Gate Writer completes
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Rename thirdParty identifier to satisfy codespell
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review on canvas smoke test, auto-merge, and metrics
- Bind canvas report writer to the triggering workflow_run PR (base/head repo, ref, SHA)
- Bound PNG inflation by IHDR-derived size and a decoded-bytes budget
- Classify file: URLs as unsafe manifest paths
- Follow CommonJS require() and literal dynamic imports; error on missing
reachable targets and devDependency-only runtime imports
- Validate removed extension paths and orphaned plugins instead of skipping
- Warn on .py/.rb/.pl scripts
- Auto-merge: support CODEOWNERS teams (fail closed), front matter authors,
list PRs by head SHA, only fall back to direct merge on clean status,
drop ineffective check_run trigger
- Metrics: ignore reviews before the PR was ready for review
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Docs: note microsoft/azure-dev-tools as a portable marketplace for the review model
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Auto-merge: only trust submission-gate runs from the Submission Gate Writer
Adds trusted_checks (default submission-gate -> external_id
submission-gate-writer). Any other check run or status with that name on the
head SHA blocks arming, so a PR-defined job cannot satisfy the gate.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden canvas smoke-test checker
- String-, template-, and regex-aware comment stripping so literals containing // cannot hide imports
- Never follow symlinks or read non-regular files; bounded, contained reads
- Validate plugins whose plugin.json was deleted
- Reject unsafe extension IDs in plugin manifests before materialization
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 3: remove auto-merge, isolate canvas smoke test, harden checker
- Remove safe auto-merge (config, workflow, script, tests, labels) per
maintainer review; documented as deferred pending a security review.
- Restore validate-canvas-extensions.yml to main and move the smoke test
to its own canvas-smoke-test.yml workflow scoped to extensions/**.
- Reject duplicate IHDR chunks in preview PNGs.
- Mask string/template/regex literal contents before extracting dynamic
import() and require() specifiers.
- Resolve package.json imports aliases through the same classifier and
module graph; fail closed on alias shapes that cannot be analyzed.
- Rename docs to canvas-evidence-and-metrics.md and update references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix canvas smoke and review metrics findings
- Trigger canvas smoke tests for plugin changes while skipping expensive setup when target detection finds no canvas coverage.
- Fail reachable data: imports while preserving warnings for unreachable module data: imports.
- Use base plugin manifests for deleted bundle plugin detection and fail closed when base manifests cannot be read.
- Paginate GraphQL PR review pages before computing weekly review metrics.
- Report workflow run API collection errors as incomplete automation health instead of not found.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address follow-up canvas review findings
Fail closed on non-literal runtime imports, require canonical PNG termination, restrict comment updates to github-actions[bot], and paginate external-plugin label events.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)
Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell findings and add spelling to submission gate checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden submission gate per review feedback
- Publish the submission-gate check from the trusted writer via the Checks API
and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address #4190 review: command reader/writer, pools, paths, staleness
- Split /rerun-checks and /request-review into a read-only issue_comment
reader and a workflow_run writer that re-reads the comment, PR, and
permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
content (medium unless they add scripts or hook commands); the core
pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
evaluation fails.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on lost contributor signal; publish gate check before labels
- A contributor check whose pr-check job succeeded but whose result artifact
is missing or unreadable is now an infrastructure failure, so a lost HIGH
signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
that workflow rejects any .github change. Exempt it in the drift test.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on bad routing config; advisory checks never hold the gate
- loadGateConfig: a missing review-routing.yml still falls back, but a
file that can't be parsed (or whose pools isn't a mapping) now throws
instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
awaiting-automation or the gate check in progress, and the polling loop
doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
the reply is posted and is the only replay guard, so a run that failed
partway can be retried.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell: unparseable -> unparsable
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184)
- Replace the individual default CODEOWNERS owner with the core-maintainer
team and add domain team ownership for extensions, plugins, content,
hooks, workflows, .github, and eng.
- Add .github/review-routing.yml as the single source of truth for reviewer
pools, routes, labels, and SLA settings (ships in dry-run mode).
- Add eng/review-routing.mjs (+ unit tests) with business-day math,
least-loaded reviewer selection, routing and escalation planning, and
workflow_run artifact validation.
- Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request
(read-only needs-reviewer reader), and Review Escalation (weekday schedule)
workflows.
- Add needs-reviewer, review-overdue, review-escalated to setup-labels.
- Document the model in docs/maintainers/review-routing.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on reviewer routing and escalation
- Escalate at routedOn + escalation business days (Mon -> Fri)
- Leave labels untouched when requestReviewers fails and fail the job
- Serialize read/plan/apply per PR across routing and escalation
- Treat Label PR Intent artifact labels as authoritative
- Re-route to an uncovered pool on head changes without restarting SLA
- Use the due-label timestamp as the review boundary
- Fall back to pool/escalation teams and report what was requested
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second-round review feedback on review routing (#4184)
- CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the
separate /.github/workflows/ rule, and leave per-resource owner lines as on
main (their removal is deferred to a separate cleanup).
- Routing: ignore pending requests for unavailable reviewers when checking
coverage; needs-reviewer excludes prior reviewers and changes nothing when no
new reviewer can be requested.
- Escalation comments show the actual routing date.
- Cap sweep matrices at 256 targets and defer the remainder.
- Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Route workflow and hooks labels to the content pool (#4184)
Drop the workflow-security reviewer pool per maintainer feedback: agentic
workflows and hooks are reviewed like other content, and the repository's
own GitHub Actions workflows stay with core maintainers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware
- Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config.
- CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Simplify dry_run validation condition
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: Allow label operations on pull requests in external plugin approval workflow
The sync-merged-pr-labels job needs pull-requests: write permission to
add/remove labels on merged PRs. Previously it only had issues: write which
is for issues, not pull requests. This fixes the permission error when
workflows try to modify PR labels from a non-contributor account.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: Handle 403 permission errors when creating external plugin intake labels
When running on PRs from fork contributors, the GitHub token may not have
permission to create labels in the repository. This is expected and should
not cause the workflow to fail. Allow the ensureLabel function to gracefully
handle 403 Forbidden errors in addition to 422 (label already exists) errors.
This fixes the sync-pr-state job failure in external-plugin-pr-quality-gates.yml
when run on PRs from external contributors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor: Centralize label management into a single workflow_dispatch workflow
Create a new 'setup-labels' workflow that is manually dispatched and handles
all label creation and updates. This workflow:
- Creates all labels used by the repository
- Updates descriptions if labels already exist
- Reports success/failure counts
- Fails if any labels cannot be created
All individual workflows now assume labels exist and will fail (loudly) if
they don't. This makes it clear to maintainers when the setup-labels workflow
needs to be dispatched:
- label-pr-intent.yml
- skill-check-comment.yml
- external-plugin-approval-command.yml
- external-plugin-command-router.yml
- external-plugin-rereview.yml
- external-plugin-rereview-command.yml
- eng/external-plugin-intake-state.mjs
This approach is better because:
- Single source of truth for label definitions
- Avoids permission issues with fork contributors
- Clear failure modes when labels are missing
- Easier to maintain consistent label configuration
- No more scattered label creation logic across workflows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove unused ensureLabel methods and managedLabels constants
Labels are now centrally managed by the setup-labels workflow and
assumed to exist in all other workflows. Removed:
- ensureLabel() methods from all 6 workflows and 1 JS module
- managedLabels constants that were only used by ensureLabel
- Promise.all() calls that invoked ensureLabel for each label
- Updated syncManagedLabels in skill-check-comment.yml to remove ensureLabel call
All workflows now assume labels exist and will fail if they don't,
which is the desired behavior—it signals maintainers to dispatch the
setup-labels workflow when new labels need to be created.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Aaron PowellandCopilot App
