Drop the legacy extension-folder state import; boards now start empty in session.workspacePath.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 545df520-6557-4211-a110-53c60f4b9f3a
Keep runtime writes outside extension folders to avoid invalidating their safety fingerprints. Import legacy board state without modifying it and document session isolation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 545df520-6557-4211-a110-53c60f4b9f3a
Set microsoft-docs version to 0.3.1 to match upstream plugin.json and
pin source to MicrosoftDocs/mcp HEAD f8ffde1 so installs are reproducible
and updates are detected correctly.
Fixes#4334
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a1751e61-818d-4ddc-b7e9-2bd62f70f4ed
Clears local reviews, queued reviews, manual moves, decisions, and history, then reloads open pull requests. GitHub is not changed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8045e7e0-dfd7-425a-9131-21ea5ca1553e
* docs(python-mcp-server-generator): rewrite skill for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace FastMCP imports with `from mcp.server import MCPServer`
- Rewrite the description with explicit triggers and exclusions
- Add the compatibility field (uv, Python 3.10+, npx for the Inspector)
- Add a five-step workflow checklist: create, write, test, validate, configure
- Pin the SDK with `uv add "mcp[cli]>=2,<3"` and use a flat uv app layout
- Add server and in-memory Client test templates
- Add a test-fix-retest validation loop with `uv run pytest`
- Add a Gotchas section for SDK v1 to v2 changes and deprecated features
- Move Streamable HTTP guidance to references/streamable-http.md
- Remove generic guidance that the model already knows
* docs(python-mcp-server): update instructions for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace FastMCP imports with MCPServer and mcp.server.mcpserver imports
- Move transport options from the constructor to run() and streamable_http_app()
- Use Resolve and Elicit for user input instead of ctx.elicit()
- Use ctx.notify_tools_changed() for list change notifications
- Explain ToolError and MCPError behavior for tool failures
- Mark sampling, protocol logging, and roots as deprecated
- Add transport security, CORS, and multi-worker guidance
- Add an in-memory Client test pattern
- Rewrite the text in ASD-STE100 Simplified Technical English
- Use single-quoted frontmatter values
* docs(python-mcp-expert): update agent for MCP Python SDK v2
- Target MCP Python SDK v2 (MCPServer) and MCP specification 2026-07-28
- Replace the retired GPT-4.1 model with GPT-6 Sol
- Replace FastMCP guidance with MCPServer guidance
- Add guidance for transport options, Resolve and Elicit, and notify_tools_changed()
- Explain ToolError and MCPError behavior for tool failures
- Mark sampling, protocol logging, and roots as deprecated
- Add SDK v1 to v2 migration as a supported scenario
- Rewrite the text in ASD-STE100 Simplified Technical English
- Use single-quoted frontmatter values
* chore(python-mcp-development): update plugin metadata for MCP Python SDK v2
- Remove FastMCP from the plugin description and README
- Describe the actual plugin contents: one skill and one agent
- Replace the fastmcp keyword with mcp-python-sdk
- Bump the plugin version to 2.0.0
- Regenerate marketplace.json and docs/README.plugins.md
* fix(python-mcp-server-generator): correct transport security, lifespan, and SSE notes
* fix(python-mcp-server): remove invalid structured_output advice and align with skill
* fix(python-mcp-expert): add missing SDK v2 rules and remove repeated guidance
* fix(python-mcp-expert): remove the retired model from frontmatter
* fix(python-mcp-server-generator): state Node.js as the MCP Inspector prerequisite
* Clarify Learning Hub workshop titles
Name each First Steps and Real-World Development entry for its GitHub Copilot environment so the catalog cards are distinct and consistent.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update workshop recency metadata
Bump lastUpdated on each renamed mirrored workshop page so Learning Hub ordering reflects the content changes.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Cleanup of CODEOWNER
Removed a lot of excessive codeowners
Created a new team for reviewing/approving workshops
Removed workflow that did auto-assignment
* Route workshop changes to workshop reviewers
Add workshop ownership, intent labeling, reviewer routing, approval-domain coverage, and maintainer documentation for the new workshop review team.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upgrade gh-aw from v0.88.8 to v0.89.21, refresh tracked workflow locks and action pins, and fetch complete history for the resource staleness report.
Closes#4346
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d736a43e-ead6-4b08-852f-58a39d6e494e
* Add Copilot app for Beginners to the Learning Hub
* Fix course fragment anchors and extend page coverage
* Apply suggestion from @aaronpowell
---------
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Simplify foundry-hosted-agent-copilotkit skill and add plugin
Rewrite the skill around Foundry-native primitives and the current
package lines (CopilotKit v2, @ag-ui 1.x, agent-framework-ag-ui 1.4,
azd azure.yaml-only hosted agents), verified end to end against a
deployed Foundry hosted agent with Playwright.
- Consolidate 6 references into wiring.md, hitl.md, troubleshooting.md
- Default wiring: FoundryAgent + AG-UI adapter gateway that keeps no
thread state (Foundry conversation id is the AG-UI thread id)
- HITL via CopilotKit v2 useInterrupt; document two interop shims
- Drop obsolete workarounds for closed agent-framework issues
- Add foundry-hosted-agent-copilotkit plugin bundling the skill with
Microsoft Learn and Foundry MCP servers
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: per-interrupt approvals, at-most-once wording, pinned ag-ui install
- hitl.md: render one card per open interrupt and resolve each by id;
document how parallel gated calls surface with agent-framework-ag-ui 1.4.0
- wiring.md/SKILL.md: a pre-effect watermark is at-most-once; exactly-once
needs a destination-enforced idempotency key or a single transaction
- wiring.md: install @ag-ui/client at the version the installed runtime pins
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Show conversation startup errors instead of an endless loading state
The wiring.md page example now checks the /api/thread response status,
validates the conv_ id, and renders caught network/JSON/HTTP errors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Phase 3: canvas smoke-test evidence, safe auto-merge, and weekly review metrics (#4184)
Adds the canvas-smoke-test check with review evidence, a config-gated safe auto-merge workflow (disabled by default), and a weekly review operating metrics workflow, plus maintainer docs.
Refs github/awesome-copilot#4184
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Trigger safe auto-merge sweep after Submission Gate Writer completes
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Rename thirdParty identifier to satisfy codespell
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review on canvas smoke test, auto-merge, and metrics
- Bind canvas report writer to the triggering workflow_run PR (base/head repo, ref, SHA)
- Bound PNG inflation by IHDR-derived size and a decoded-bytes budget
- Classify file: URLs as unsafe manifest paths
- Follow CommonJS require() and literal dynamic imports; error on missing
reachable targets and devDependency-only runtime imports
- Validate removed extension paths and orphaned plugins instead of skipping
- Warn on .py/.rb/.pl scripts
- Auto-merge: support CODEOWNERS teams (fail closed), front matter authors,
list PRs by head SHA, only fall back to direct merge on clean status,
drop ineffective check_run trigger
- Metrics: ignore reviews before the PR was ready for review
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Docs: note microsoft/azure-dev-tools as a portable marketplace for the review model
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Auto-merge: only trust submission-gate runs from the Submission Gate Writer
Adds trusted_checks (default submission-gate -> external_id
submission-gate-writer). Any other check run or status with that name on the
head SHA blocks arming, so a PR-defined job cannot satisfy the gate.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden canvas smoke-test checker
- String-, template-, and regex-aware comment stripping so literals containing // cannot hide imports
- Never follow symlinks or read non-regular files; bounded, contained reads
- Validate plugins whose plugin.json was deleted
- Reject unsafe extension IDs in plugin manifests before materialization
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 3: remove auto-merge, isolate canvas smoke test, harden checker
- Remove safe auto-merge (config, workflow, script, tests, labels) per
maintainer review; documented as deferred pending a security review.
- Restore validate-canvas-extensions.yml to main and move the smoke test
to its own canvas-smoke-test.yml workflow scoped to extensions/**.
- Reject duplicate IHDR chunks in preview PNGs.
- Mask string/template/regex literal contents before extracting dynamic
import() and require() specifiers.
- Resolve package.json imports aliases through the same classifier and
module graph; fail closed on alias shapes that cannot be analyzed.
- Rename docs to canvas-evidence-and-metrics.md and update references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix canvas smoke and review metrics findings
- Trigger canvas smoke tests for plugin changes while skipping expensive setup when target detection finds no canvas coverage.
- Fail reachable data: imports while preserving warnings for unreachable module data: imports.
- Use base plugin manifests for deleted bundle plugin detection and fail closed when base manifests cannot be read.
- Paginate GraphQL PR review pages before computing weekly review metrics.
- Report workflow run API collection errors as incomplete automation health instead of not found.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address follow-up canvas review findings
Fail closed on non-literal runtime imports, require canonical PNG termination, restrict comment updates to github-actions[bot], and paginate external-plugin label events.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
The contributor-check-result artifact was uploaded with retention-days: 3.
eng/submission-gate.mjs's readContributorRiskArtifact() downloads that
artifact via 'gh run download' to read the contributor risk signal. Once
the artifact expires, the download fails, is caught and treated as null,
and the gate reports a permanent 'Contributor risk signal' infrastructure
failure for any PR that takes longer than 3 days to review -- only
clearable via a maintainer commenting /rerun-checks.
Reproduced: 'gh run download 37007671556 --repo github/awesome-copilot
--name contributor-check-result' returned 'no valid artifacts found to
download' because the artifact (uploaded 2026-10-02, 338 bytes, upload
itself succeeded) expired under the 3-day retention before PR #3871 was
reviewed.
Raise retention-days to 90 (GitHub's standard default) so the artifact
survives regardless of review latency.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 211fb092-66c2-4049-b1b9-614067c2eefe
The Learning Hub content lives in website/src/content/docs/learning-hub,
but the workflow's safe-outputs allowed-files globs still pointed at the
old website/learning-hub location. As a result, the daily run produced
valid content updates that were rejected by the code-push guardrail
("patch modifies files outside the allowed-files list"), leaving the
workflow failing and the Learning Hub stale (see #3736, #3720).
- Update allowed-files for create-pull-request and
push-to-pull-request-branch to website/src/content/docs/learning-hub/**/*.md
- Update the stale website/learning-hub path references in the prompt
- Regenerate learning-hub-updater.lock.yml with gh aw compile (v0.88.8)
Aaron Powell
github-actions[bot]
Kazuki OtaandCopilot App
Ari LiVigni ContinuousG33kandCopilot
Oliver Zehentleitner AIgent
viragtripathi
Bruce MoeandCopilot App
Julia MuiruriandCopilot App
Burak Kaygusuz
Jonny Burger
dependabot[bot]andPretaSOFT
Artsiom Chmutau
Dan WahlinandAaron Powell
Andrew ArnottandCopilot
emilus512-cmykandCopilot App
Muhammad Umer Waheed
Paul DelannoyandPretaSOFT