* Clarify Learning Hub workshop titles
Name each First Steps and Real-World Development entry for its GitHub Copilot environment so the catalog cards are distinct and consistent.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update workshop recency metadata
Bump lastUpdated on each renamed mirrored workshop page so Learning Hub ordering reflects the content changes.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Cleanup of CODEOWNER
Removed a lot of excessive codeowners
Created a new team for reviewing/approving workshops
Removed workflow that did auto-assignment
* Route workshop changes to workshop reviewers
Add workshop ownership, intent labeling, reviewer routing, approval-domain coverage, and maintainer documentation for the new workshop review team.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upgrade gh-aw from v0.88.8 to v0.89.21, refresh tracked workflow locks and action pins, and fetch complete history for the resource staleness report.
Closes#4346
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d736a43e-ead6-4b08-852f-58a39d6e494e
* Add Copilot app for Beginners to the Learning Hub
* Fix course fragment anchors and extend page coverage
* Apply suggestion from @aaronpowell
---------
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Simplify foundry-hosted-agent-copilotkit skill and add plugin
Rewrite the skill around Foundry-native primitives and the current
package lines (CopilotKit v2, @ag-ui 1.x, agent-framework-ag-ui 1.4,
azd azure.yaml-only hosted agents), verified end to end against a
deployed Foundry hosted agent with Playwright.
- Consolidate 6 references into wiring.md, hitl.md, troubleshooting.md
- Default wiring: FoundryAgent + AG-UI adapter gateway that keeps no
thread state (Foundry conversation id is the AG-UI thread id)
- HITL via CopilotKit v2 useInterrupt; document two interop shims
- Drop obsolete workarounds for closed agent-framework issues
- Add foundry-hosted-agent-copilotkit plugin bundling the skill with
Microsoft Learn and Foundry MCP servers
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: per-interrupt approvals, at-most-once wording, pinned ag-ui install
- hitl.md: render one card per open interrupt and resolve each by id;
document how parallel gated calls surface with agent-framework-ag-ui 1.4.0
- wiring.md/SKILL.md: a pre-effect watermark is at-most-once; exactly-once
needs a destination-enforced idempotency key or a single transaction
- wiring.md: install @ag-ui/client at the version the installed runtime pins
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Show conversation startup errors instead of an endless loading state
The wiring.md page example now checks the /api/thread response status,
validates the conv_ id, and renders caught network/JSON/HTTP errors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Phase 3: canvas smoke-test evidence, safe auto-merge, and weekly review metrics (#4184)
Adds the canvas-smoke-test check with review evidence, a config-gated safe auto-merge workflow (disabled by default), and a weekly review operating metrics workflow, plus maintainer docs.
Refs github/awesome-copilot#4184
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Trigger safe auto-merge sweep after Submission Gate Writer completes
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Rename thirdParty identifier to satisfy codespell
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review on canvas smoke test, auto-merge, and metrics
- Bind canvas report writer to the triggering workflow_run PR (base/head repo, ref, SHA)
- Bound PNG inflation by IHDR-derived size and a decoded-bytes budget
- Classify file: URLs as unsafe manifest paths
- Follow CommonJS require() and literal dynamic imports; error on missing
reachable targets and devDependency-only runtime imports
- Validate removed extension paths and orphaned plugins instead of skipping
- Warn on .py/.rb/.pl scripts
- Auto-merge: support CODEOWNERS teams (fail closed), front matter authors,
list PRs by head SHA, only fall back to direct merge on clean status,
drop ineffective check_run trigger
- Metrics: ignore reviews before the PR was ready for review
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Docs: note microsoft/azure-dev-tools as a portable marketplace for the review model
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Auto-merge: only trust submission-gate runs from the Submission Gate Writer
Adds trusted_checks (default submission-gate -> external_id
submission-gate-writer). Any other check run or status with that name on the
head SHA blocks arming, so a PR-defined job cannot satisfy the gate.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden canvas smoke-test checker
- String-, template-, and regex-aware comment stripping so literals containing // cannot hide imports
- Never follow symlinks or read non-regular files; bounded, contained reads
- Validate plugins whose plugin.json was deleted
- Reject unsafe extension IDs in plugin manifests before materialization
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Phase 3: remove auto-merge, isolate canvas smoke test, harden checker
- Remove safe auto-merge (config, workflow, script, tests, labels) per
maintainer review; documented as deferred pending a security review.
- Restore validate-canvas-extensions.yml to main and move the smoke test
to its own canvas-smoke-test.yml workflow scoped to extensions/**.
- Reject duplicate IHDR chunks in preview PNGs.
- Mask string/template/regex literal contents before extracting dynamic
import() and require() specifiers.
- Resolve package.json imports aliases through the same classifier and
module graph; fail closed on alias shapes that cannot be analyzed.
- Rename docs to canvas-evidence-and-metrics.md and update references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix canvas smoke and review metrics findings
- Trigger canvas smoke tests for plugin changes while skipping expensive setup when target detection finds no canvas coverage.
- Fail reachable data: imports while preserving warnings for unreachable module data: imports.
- Use base plugin manifests for deleted bundle plugin detection and fail closed when base manifests cannot be read.
- Paginate GraphQL PR review pages before computing weekly review metrics.
- Report workflow run API collection errors as incomplete automation health instead of not found.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address follow-up canvas review findings
Fail closed on non-literal runtime imports, require canonical PNG termination, restrict comment updates to github-actions[bot], and paginate external-plugin label events.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
The contributor-check-result artifact was uploaded with retention-days: 3.
eng/submission-gate.mjs's readContributorRiskArtifact() downloads that
artifact via 'gh run download' to read the contributor risk signal. Once
the artifact expires, the download fails, is caught and treated as null,
and the gate reports a permanent 'Contributor risk signal' infrastructure
failure for any PR that takes longer than 3 days to review -- only
clearable via a maintainer commenting /rerun-checks.
Reproduced: 'gh run download 37007671556 --repo github/awesome-copilot
--name contributor-check-result' returned 'no valid artifacts found to
download' because the artifact (uploaded 2026-10-02, 338 bytes, upload
itself succeeded) expired under the 3-day retention before PR #3871 was
reviewed.
Raise retention-days to 90 (GitHub's standard default) so the artifact
survives regardless of review latency.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 211fb092-66c2-4049-b1b9-614067c2eefe
The Learning Hub content lives in website/src/content/docs/learning-hub,
but the workflow's safe-outputs allowed-files globs still pointed at the
old website/learning-hub location. As a result, the daily run produced
valid content updates that were rejected by the code-push guardrail
("patch modifies files outside the allowed-files list"), leaving the
workflow failing and the Learning Hub stale (see #3736, #3720).
- Update allowed-files for create-pull-request and
push-to-pull-request-branch to website/src/content/docs/learning-hub/**/*.md
- Update the stale website/learning-hub path references in the prompt
- Regenerate learning-hub-updater.lock.yml with gh aw compile (v0.88.8)
* Add Draw canvas extension
Draw is a GitHub Copilot app canvas for simple diagrams: shapes, arrows
that stay attached, text and a freehand pen. The user and Copilot edit the
same drawing. Copilot can create, change, lay out and export it through
canvas actions, and the Ask Copilot button sends the drawing to the chat.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Refuse changes that would take a drawing past 5,000 elements with a
clear error instead of silently dropping elements, and stop the canvas
from retrying a refused save.
- Keep collision suffixes within the 48-character id limit.
- Keep a drawing and report the error when deleting its file fails.
- Retry failed drawing writes, and report them in the canvas and in agent
action results instead of only logging them.
- List pen strokes in the get_drawing outline.
- Let Space and Enter work normally on focused buttons.
- Only use Tab to add a step when a shape is selected, so Tab can move
focus out of the canvas.
- Pick readable text colors for accent and danger backgrounds.
- Hide "Bring to front" and "Send to back" when only arrows are selected,
since arrows always draw on top.
- Report theme save failures from /api/settings and set_theme.
- Keep the top bar buttons visible when the status text is long, and
remove leftover theme debug logging.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second Copilot review
- Add node:test suites for the loopback server (Host and token checks,
static file allowlist and CSP, every API route, live events and save
error reporting), the drawing store, layout label references and
solid-fill text contrast. Run them with `node --test` in extensions/draw.
- Give every popover an accessible name. The delete confirmation is now an
alertdialog described by its question.
- Build the id and label lookups in buildFromSpec once, instead of once per
element or per edge.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address third Copilot review
- Switching drawings or asking Copilot no longer goes ahead when the edits
on screen could not be saved first. Draw stays on the drawing and offers
"Discard changes", and a switch started by the agent moves the server back
to the drawing the panel still shows. Deleted drawings never hold the panel.
- Agent actions write the drawing before returning, so a disk problem is
reported by the action that caused it.
- Count edge crossings with a Fenwick tree (O(E log V)) and typed arrays.
The layout is unchanged; the worst case is about three times faster.
- Reconnecting brings back a save error that still applies.
- The selection keeps up to MAX_ELEMENTS ids instead of 1,000.
- Tests for the actions wrapper, the selection limit and crossing counts.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fourth Copilot review
- Stop an old save from undoing the last one. Each change the page
sends now has a number, and the server drops one older than a change
it already applied (refused changes do not count). The save sent when
the panel closes also sets every element the change still on its way
touched to what the editor shows, so either arrival order ends with
what is on screen.
- get_drawing reads a big drawing in parts of about 30,000 characters
(start and nextStart), can list only some ids or the selection, cuts
labels longer than 300 characters in the outline, and counts a huge
selection instead of listing it.
- Ask sends at most about 16,000 characters of outline and says how
to read the rest with get_drawing.
- After switching away from a drawing with "Discard changes" while a
save was on its way, send edits made in the new drawing once it
returns.
- Tests for all of the above.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fifth Copilot review
- Exports stay with the drawing they came from. The agent's export
request names the drawing, the page answers with the id it actually
drew, and the server turns down a mismatch instead of saving the
image under the wrong drawing. Save as PNG and Ask read the id right
before rendering, and Ask keeps the question if another drawing
opens while it is sending.
- When the server tidies up a save, for example by capping a size, it
sends the stored drawing back and the page shows that instead of
assuming it was stored as sent. The tidy-up is not an undo step, so
undo cannot get stuck on it.
- Shapes are capped at 5000 wide or tall everywhere. Growing a shape
for a longer label or a bigger text size caps the height before
centering, so the shape no longer jumps.
- Rebuilding the style bar keeps keyboard focus on the same button,
and hiding it moves focus to the canvas.
- Edits refresh the drawing list, batched so a burst of edits sends it
once, and a copied drawing is listed with its real element count.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address sixth Copilot review
- Ask refuses (409) to send a question when the panel shows another
drawing than the one it is about, and the page keeps the draft. The
context it sends now includes the drawingId.
- Actions on the shown drawing take an optional drawingId. If the canvas
shows a different drawing, they change nothing and say which one it
shows.
- Temp file names for atomic writes include a counter, so two writes of
one file in the same millisecond no longer share a temp file.
- The canvas works from the keyboard and with screen readers: the SVG is
a focusable application with a description, N and Shift+N select
elements, Enter adds shapes and text or connects shapes with the arrow
tool, Ctrl+Shift+Arrow resizes, and a live region reads out the tool,
the selection and each change. Tab now moves focus instead of adding a
step, except while typing a label.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address seventh Copilot review
- Saving: a write that fails part way (a full disk, say) no longer leaves
its temp file behind. Every retry picks a new temp name, so these used
to pile up.
- Diagram specs: a node or text with only x or only y is now an error that
names the item, instead of being laid out automatically and silently
dropping the coordinate that was given. Non-numeric x or y is an error
too.
- Switching drawings: while the panel waits to save the current drawing
before showing another one, the server already sends the new drawing's
changes, save status and selection. These are now kept and applied when
the switch finishes, instead of being dropped.
- Showing the drawing that is already on screen (an agent calling
open_drawing on it, or two switches to the same drawing) is now a normal
update. It no longer reloads the editor, which wiped the undo history,
the selection and the zoom, and it no longer warns about unsaved changes
while a save is being refused. The server keeps the panel's selection in
that case too.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address eighth Copilot review
- State file: writes of .state.json (which drawing each panel shows) now
run one at a time, and each one takes the state as it is when its turn
comes. An older write that is slow to finish (Windows can briefly lock
a file) can no longer land after a newer one, and flush() now also
waits for a state write that had already started.
- Placement: when every spot tried next to a shape is taken, a new shape
now goes just past everything in that direction, in line with the
shape, instead of on top of existing content. This covers both the
editor's "add a connected step" command and add_elements.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address ninth Copilot review
Tab in the label editor now adds the next step only for shape labels.
For free text and arrow labels it keeps its normal job and moves focus
on, and the blur saves the edit. The README and the in-app shortcut list
now say "a shape's label".
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address tenth Copilot review
- Label wrapping searches for how many words or characters fit on a
line instead of adding one at a time, so a long label with no spaces
is no longer quadratic. The output is unchanged.
- Arrows attached to nothing follow their elbow or curve route too.
- A selection the agent makes while the user drags or edits a label is
shown once they finish, unless they picked something else meanwhile.
- A drawing name more than one drawing has no longer opens the first
one; the error lists their ids, and an exact id always picks one.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address eleventh Copilot review
- Pen strokes stay bounded while drawing: once a stroke holds 10,000
points it is simplified and thinned to 5,000. A saved stroke keeps an
even spread of its points with both ends, instead of losing its end
past 5,000 points. Simplification runs in pieces of 512 points, so its
time grows in step with the stroke rather than with its square.
- Live updates send the element-level ops that made a change, against
the drawing one change earlier, instead of the whole drawing to every
other panel. A panel that finds a change missing fetches the whole
drawing again.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address twelfth Copilot review
- The save a page sends as it closes is marked keepalive whenever it fits
the browser's 64 KiB limit. That limit covers all keepalive requests
together, so splitting would not help; a bigger save goes as an
ordinary request.
- Pen strokes keep at most 2,000 points, so even the biggest one fits in
that save. A test checks the biggest stroke and labels against the limit.
- A rename goes to the drawing it was typed for. It is cancelled if the
panel moves to another drawing, it does not undo a rename the agent made
meanwhile, and its reply never moves the panel.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address thirteenth Copilot review
- Turn down a layout that would put a shape or text past the +/-1,000,000
position limit (very long arrow labels spread the layers that far).
Saving used to move such positions back to the limit, stacking shapes on
top of each other while the action reported success. set_diagram and
add_elements now fail with invalid_diagram, and layout with
layout_too_big, and nothing is changed.
- Fetch the drawing each time the event stream connects, not only on
reconnects. A change made after the page loaded the drawing but before
the server registered the new connection was never delivered.
- List text size on shapes, arrows and text, and color on text, in the
get_drawing outline, and say that styles left out are the defaults.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fourteenth Copilot review
- open_drawing now waits for the canvas to take the drawing. The switch
carries an id, and the page confirms it once it shows the drawing, or,
when it has edits it cannot save yet, moves the panel back with the same
id. A refusal becomes an unsaved_changes error, and no answer within 10
seconds is reported as unconfirmed, with advice to pin drawingId.
- Pen hit testing no longer makes an object for every point on every
pointer move. Stroke extents are cached per points array, strokes out of
reach are skipped by their box, and the rest are measured straight from
the stored pairs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address fifteenth Copilot review
- Automatic layout counts the placeholders its long arrows need before
making any, and turns down a drawing that needs more than 100,000. A
long chain with many arrows across it could otherwise need millions,
which kept the extension busy for most of a minute. layout fails with
layout_too_big, and set_diagram and add_elements with invalid_diagram,
and nothing is changed.
- relayout now returns { elements, error } like buildFromSpec, so the
layout action gets this and the position range check from one place.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* new instruction make-blog-post.instructions
* Revise blog post instructions for clarity
Updated post file layout and clarified approval process for posting.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update automation mode and documentation linking instructions
Clarified automation mode description and updated linking instructions for documentation.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Refine blog post destination and conflict instructions
Clarify instructions for handling destination paths and conflicts.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Revise blog post instructions for drafts and naming
Clarified instructions for handling drafts and file naming rules.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update instructions for staged mode gate closure
Clarified the closing condition for the gate in staged mode.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* polish: apply notes suggesting closer look needed
* Refine blog post creation instructions
Clarified instructions for writing and uploading blog posts, including changes to venue-specific copy handling and slug conventions.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* polish: apply suggested notes, update generated marketplace
* polish: apply suggested notes
* new skill make-blog-post
* Revise voice profile guidelines and blog platform details
Updated guidelines for voice profile and blog platforms.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix argument-hint formatting in SKILL.md
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: machine-specific sample locations, address prev. miss
* resolve: workflow order, author id, overlap generator detect behave err.
* resolve: previously missed review items
* resolve: previously missed review items
* Update destination handling instructions in SKILL.md
Clarify instructions on handling user-specified destinations and workspace paths.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
The agent failed to resolve the 'auto' model alias because the
COPILOT_GITHUB_TOKEN secret returned 401 on the models endpoint.
Grant copilot-requests: write so the engine authenticates with the
workflow GITHUB_TOKEN, matching the other agentic workflows.
Fixes#3669
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* docs(skills): update codebase-memory-mcp skill for server v0.11.0
codebase-memory-mcp v0.11.0 (2026-09-15) added get_file_outline,
compare_graphs and manage_adr set_sections, changed result paging
(next_offset / next_cursor / per-stream continuation fields) and
marked the query tools read-only. Bring the skill in line with that
surface and fix two statements that were wrong against the server:
search_graph has no direction argument, and query and semantic_query
cannot be combined in one call.
Every claim was checked against a live 0.11.0 server. An A/B on 54
headless runs scored this text 18/18, the published text 16/18 and
no skill 12/18.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): fix three codebase-memory-mcp statements found in review
- a .cbmignore negation can re-include the built-in skip directories,
except .git, node_modules, .worktrees and .claude-worktrees
- the dead-code query also excludes inbound CALL_REFERENCE edges, so
callbacks passed as values are not listed
- HTTP_CALLS edges always carry callee and url_path; method, args and
via depend on the extraction path
Each point was confirmed in the v0.11.0 source.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): align codebase-memory-mcp skill with the v0.11.0 source
A check of the skill's statements about server behaviour against the
v0.11.0 source, prompted by the Copilot review:
- get_code_snippet: auto outlines File, Module, Class and Interface nodes
longer than 200 lines; only source_mode="full" returns their body
- check_index_coverage: list all six path statuses, the freshness rule
and the scope statuses
- search_graph: relationship keeps nodes that touch such an edge; the
degree filter always counts five fixed edge types
- query_graph: on stale_cursor, re-run without the cursor
Each corrected statement was then run on a live 0.11.0 server.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): fix the dead-code shortcut, add two 0.11.0 gotchas
Review round three on the codebase-memory-mcp skill:
- the table's dead-code shortcut searched every label and returned File,
Module and Project nodes; it now passes label="Function" and says to
repeat with label="Method". exclude_entry_points is dropped: with
max_degree=0 it cannot exclude anything
- manage_adr: mode="update" replaces the whole document, set_sections
rewrites only the named sections, and an unmatched name is appended
- compare_graphs: identities begin with each snapshot's project name, so
unchanged symbols show up as added and removed; strip the prefixes
All three were reproduced on a live 0.11.0 server, and the other tool
calls in the skill's reference section were re-run there as written.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): name the two request-error statuses of check_index_coverage
Review round four on the codebase-memory-mcp skill: gotcha 5 listed the
index-coverage statuses but not outside_project and invalid_path, which
v0.11.0 returns when the request itself is wrong (an absolute or empty
path, a path with .., or a non-string entry). Those rows carry
freshness=unavailable and recommended_action=use_project_relative_path,
so the fix is the path, not reading source or reindexing. Scope rows
never carry a recommended_action; the text said every row did.
Both reproduced on a live 0.11.0 server against a fresh index.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): split outside_project by cause in check_index_coverage
Review round five on the codebase-memory-mcp skill: gotcha 5 described
every outside_project row as a request error. In v0.11.0 that is only
the normalization branch (an absolute or empty path, or one with ..),
which shares freshness=unavailable and
recommended_action=use_project_relative_path with invalid_path (a
non-string, a control character, or a path that normalizes to nothing
such as ./). A syntactically valid relative path whose target resolves
through a symlink outside the canonical root is also outside_project,
but with freshness=outside_project and the generic
read_source_and_reindex action. The text now separates the two and
tells the agent not to follow the link to its external target, which
is the Rooted Filesystem Fallback boundary.
Reproduced on a live 0.11.0 server against a fixture with a file
symlink and a directory symlink pointing outside the root, and checked
in src/mcp/mcp.c (coverage_normalize_rel, coverage_path_freshness,
cbm_path_within_root, coverage_recommended_action).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(skills): correct search_code paging and ADR section names
Review round six on the codebase-memory-mcp skill:
- gotcha 3 gave search_code one 10-row page. In v0.11.0 it pages three
streams independently: 10 symbol results (result_offset, next_offset),
5 raw matches (raw_offset, raw_next_offset) and 20 directories
(directory_offset, directory_next_offset), each with its own has_more
flag
- gotcha 9 sent the agent to the default outline mode to pick a name for
set_sections. outline lists every heading level, including lines inside
fenced blocks, while set_sections writes only unfenced ## sections and
appends a new one for any other name; the writable names come from
mode="sections"
Both reproduced on a live 0.11.0 server: search_code returned the three
flags separately, and set_sections with a level-3 and a fenced heading
name appended two sections to a scratch ADR instead of editing it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Mirror First Steps workshops in English and five languages. Sync the real-world app track and Foundry modules, preserve legacy lesson URLs with redirects, and update Learning Hub discovery, language switching, and weekly sync provenance for upstream PRs 194 and 195.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)
Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell findings and add spelling to submission gate checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden submission gate per review feedback
- Publish the submission-gate check from the trusted writer via the Checks API
and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address #4190 review: command reader/writer, pools, paths, staleness
- Split /rerun-checks and /request-review into a read-only issue_comment
reader and a workflow_run writer that re-reads the comment, PR, and
permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
content (medium unless they add scripts or hook commands); the core
pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
evaluation fails.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on lost contributor signal; publish gate check before labels
- A contributor check whose pr-check job succeeded but whose result artifact
is missing or unreadable is now an infrastructure failure, so a lost HIGH
signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
that workflow rejects any .github change. Exempt it in the drift test.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on bad routing config; advisory checks never hold the gate
- loadGateConfig: a missing review-routing.yml still falls back, but a
file that can't be parsed (or whose pools isn't a mapping) now throws
instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
awaiting-automation or the gate check in progress, and the polling loop
doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
the reply is posted and is the only replay guard, so a run that failed
partway can be retried.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell: unparseable -> unparsable
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Precompute lowercased search fields once per index identity so each query avoids repeating normalization across every indexed item.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Waseem <wmohammed@pros.com>
* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184)
- Replace the individual default CODEOWNERS owner with the core-maintainer
team and add domain team ownership for extensions, plugins, content,
hooks, workflows, .github, and eng.
- Add .github/review-routing.yml as the single source of truth for reviewer
pools, routes, labels, and SLA settings (ships in dry-run mode).
- Add eng/review-routing.mjs (+ unit tests) with business-day math,
least-loaded reviewer selection, routing and escalation planning, and
workflow_run artifact validation.
- Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request
(read-only needs-reviewer reader), and Review Escalation (weekday schedule)
workflows.
- Add needs-reviewer, review-overdue, review-escalated to setup-labels.
- Document the model in docs/maintainers/review-routing.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on reviewer routing and escalation
- Escalate at routedOn + escalation business days (Mon -> Fri)
- Leave labels untouched when requestReviewers fails and fail the job
- Serialize read/plan/apply per PR across routing and escalation
- Treat Label PR Intent artifact labels as authoritative
- Re-route to an uncovered pool on head changes without restarting SLA
- Use the due-label timestamp as the review boundary
- Fall back to pool/escalation teams and report what was requested
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second-round review feedback on review routing (#4184)
- CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the
separate /.github/workflows/ rule, and leave per-resource owner lines as on
main (their removal is deferred to a separate cleanup).
- Routing: ignore pending requests for unavailable reviewers when checking
coverage; needs-reviewer excludes prior reviewers and changes nothing when no
new reviewer can be requested.
- Escalation comments show the actual routing date.
- Cap sweep matrices at 256 targets and defer the remainder.
- Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Route workflow and hooks labels to the content pool (#4184)
Drop the workflow-security reviewer pool per maintainer feedback: agentic
workflows and hooks are reviewed like other content, and the repository's
own GitHub Actions workflows stay with core maintainers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware
- Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config.
- CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Simplify dry_run validation condition
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds a skill for taking a Windows desktop app through its first Microsoft
Store submission: product identity, an unsigned Store MSIX, package
inspection, WACK with report verification, every Partner Center section,
and certification monitoring. It includes PowerShell scripts for MSIX
inspection and WACK, a guarded Playwright controller for Partner Center,
references, and templates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 33e33f93-bd16-4262-8026-fc42063cef78
The README build fetched the live GitHub MCP registry to decide whether to
link server names, which made output nondeterministic (e.g. Apify) and
caused the validate-readme check to fail intermittently.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add v-development skill
Teach Copilot V language development: toolchain, v.mod layout, build/test/fmt, and Option/Result error handling.
* Fix v-development skill accuracy
Correct v.mod schema (dependencies), manifest optionality, entry-point guidance, VPM registry URL, and globals rule per official V docs.
* Correct mutability and Option/Result propagation guidance
Variables use mut, only struct sections use mut:; postfix ? propagates Options, ! propagates errors; no forced unwrap.
* Scope compilation, nil, and mutability guidance to verified behavior
v run excludes test files; nil only in unsafe/C interop; mutable parameters documented.
* Keep example Config fields immutable
The port field was never mutated; placing it under mut: contradicted the immutable-by-default guidance.
* Recommend json2 over superseded json module
Official V docs teach json2 for encoding/decoding.
Artsiom Chmutau
Dan WahlinandAaron Powell
Andrew ArnottandCopilot
emilus512-cmykandCopilot App
dependabot[bot]andPretaSOFT
Muhammad Umer Waheed
Paul DelannoyandPretaSOFT
Burke HollandandCopilot App
John HaugabookandCopilot Autofix powered by AI
Anton StandrikandClaude Fable 5.1
AzureMike
Stefan BroennerandExcel Plugin Updates
Antonio Villanueva
Matt Raible
Oliver Zehentleitner AIgent
github-actions[bot]
Gautam Jethwani
Waseem MohammedandWaseem
Tim MulhollandandCopilot App
Paul YuknewiczandCopilot App
Ulises Jeremias
Jonathan Russ
Burak Kaygusuz