* Add soft-gate PR risk scanning automation
Introduce a PR risk scanner script plus two workflows: one to scan changed files and upload findings, and one to upsert a sticky PR comment with a summary table and findings. This adds non-blocking supply-chain risk visibility for agentic contributions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Harden path checks and reduce scanner false positives
Reject absolute paths, enforce repo-root containment after resolution, and tighten unpinned-version detection to dependency/version contexts to avoid markdown noise.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Harden soft-gate behavior and scanner coverage
Make PR risk scan workflows non-blocking on scanner/artifact edge cases, always upload artifacts, reduce required permissions, and extend scanner script detection to plugin skill paths.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add GitHub Copilot app learning hub page
- Create new learning hub page covering Copilot app basics, features, and use cases
- Include information about target audiences (developers, non-dev roles, teams with parallel work)
- Highlight key features: My Work view, isolated worktrees, canvases, Agent Merge
- Add installation and getting started instructions
- Update learning hub index to include app in Getting Started section
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Refine GitHub Copilot app learning hub page
- Add the app to the learning hub navigation
- Tighten the page copy around audiences, features, and getting started
- Keep canvases and automations high level as requested
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: reset bot review when PR base is changed off main
The check-pr-target workflow only ran on 'opened' events targeting main,
so it never re-ran after a submitter edited the base branch to 'staged'.
The REQUEST_CHANGES review was left in place, blocking merge and requiring
a manual maintainer override.
Changes:
- Broaden trigger to also fire on edited, reopened, and synchronize events,
and add 'staged' to the branches filter so the workflow runs after a
base-branch edit.
- Before posting REQUEST_CHANGES, check whether the bot already has an
active CHANGES_REQUESTED review to avoid duplicate reviews.
- After a base-branch edit: if the PR no longer targets main and the bot's
latest review state is CHANGES_REQUESTED, post an APPROVE review to
clear the block automatically.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: rerun PR target check for any base branch
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
The install smoke gate was hardcoding .github/plugin/plugin.json as the
expected manifest path after copilot plugin install, which caused a false
ail for plugins whose manifests live at plugin.json (root) or
.plugins/plugin.json instead of the Copilot CLI convention.
Replace the hardcoded path with a call to the existing indPluginJson()
helper that already probes all three candidate locations in priority order.
Separate the 'install directory missing' check from 'no manifest found' so
error messages surface the actual root cause.
Also fix a .plugin/ → .plugins/ typo in EXTERNAL_PLUGIN_ROOT_MANIFEST_PATHS
(external-plugin-validation.mjs) which caused the error message shown to
submitters to reference a path that indPluginJson never actually checks.
Add cross-reference comments on both constants so they stay in sync.
Closes: reported in issue #1837
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat: Add external plugins Kanban board canvas extension
- Create interactive Kanban board showing external plugin submission issues
- Display issues in columns based on labels: 'requires-submitter-fixes', 'ready-for-review', 'approved', 'rejected'
- Support drag-and-drop state transitions between columns
- Show PR links for approved issues via [Generated PR](url) pattern in issue body
- Display issue summaries with numbers and titles
- Use app theme variables for visual integration
- Implement demo mode with example issues for consistent testing
The canvas includes:
- HTTP server with /api/issues endpoint for issue fetching
- Drag-and-drop UI with vanilla JavaScript
- Responsive HTML/CSS Kanban layout
- Auto-refresh on drag operations
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat: Add issue detail modal to Kanban board canvas
- Click any issue card to view full details in a modal
- Modal shows issue description, creation/update dates, labels, and PR link
- Displays formatted dates and color-coded label badges
- Modal can be closed via X button or clicking outside
- Drag-and-drop still works on issue cards
- Added hover effects to issue cards for better interactivity
Demo data now includes issue body descriptions, created_at, and updated_at timestamps for realistic display.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat: Integrate real external plugin issues from repository
- Replaced hard-coded demo data with live gh CLI integration
- Attempts to fetch actual issues using 'gh issue list --label external-plugin'
- Tries multiple gh installation paths for Windows compatibility
- Falls back to demo data if gh CLI isn't accessible from extension subprocess
- Demo data now contains real external plugin issue titles from repository
- Maintains full functionality (Kanban board, drag-drop, modal details, PR links)
Note: gh CLI integration may require environment configuration on Windows.
The extension gracefully degrades to accurate demo data when live integration unavailable.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Implement external plugins Kanban board canvas with GitHub API integration
- Created external-plugins-board canvas extension with HTTP loopback server
- 4-column Kanban board layout (requires-submitter-fixes, ready-for-review, approved, rejected)
- Fetches real issues from github/awesome-copilot repository via GitHub REST API
- Click issues to view full details in modal (title, description, dates, labels, PR links)
- Drag-and-drop support for state transitions (future: update labels via API)
- Responsive design with theme variable integration for light/dark mode
- No hard-coded demo data - displays actual repository data
Resolved subprocess execution limitation:
- Extension subprocess is sandboxed and cannot execute system binaries (gh, cmd.exe, powershell.exe)
- Solution: Use GitHub REST API directly instead of gh CLI subprocess execution
- API calls work perfectly from within restricted subprocess environment
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Render issue body as markdown in board modal
- add marked dependency for markdown parsing\n- render issue body HTML in the modal\n- style markdown elements for readable theme-aware output\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: skill-validator invocation for .github/plugin/plugin.json convention
The skill-validator --plugin mode looks for plugin.json at <dir>/plugin.json,
but external plugins (and the Copilot CLI) place it at .github/plugin/plugin.json.
This caused every external plugin with skills or agents to fail the skill-validator
gate with a misleading 'No plugin.json found' error, even when the install smoke
test passed correctly.
Extract buildSkillValidatorArgs() which reads plugin.json from
.github/plugin/plugin.json, resolves skills/agents paths relative to the plugin
root, and invokes skill-validator with --skills/--agents instead of --plugin.
Falls back to --plugin if the conventional path is not present.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: also check .plugins/plugin.json and root plugin.json locations
Extend buildSkillValidatorArgs to probe three candidate plugin.json locations
in priority order before falling back to --plugin:
1. .github/plugin/plugin.json (Copilot CLI convention)
2. .plugins/plugin.json
3. plugin.json (root — also the skill-validator's native --plugin expectation)
Extract findPluginJson() and PLUGIN_JSON_CANDIDATES constant so the list is easy
to extend. Paths in plugin.json are always resolved relative to the plugin root
regardless of where the manifest lives.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add workflow run link to external plugin intake comments
- Include a link to the GitHub Actions workflow run in intake comment
- Helps users trace which action run generated the intake report
- Works for both initial intake and re-run intake flows
- Link appears at bottom of comment for all intake states (passed/failed/quality gates)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback on intake comment formatting
- Remove leading spaces from runLink construction to preserve markdown formatting
- Remove unnecessary newline prefix before runLink in quality gates section
- Move workflow run link to the very end of all comment types (after warnings)
- For merged intake comments, append link as final element
- Remove unused runId parameter from applyExternalPluginIntakeEvaluation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Generate extensions data, add the extensions listing route/navigation, and include install URL copy actions pinned to the build commit SHA.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fixing path on chrome devtools external pluginPath is to the folder in the repo where the plugin structure starts, not where the plugin.json file lives.
* Updating validation scripts and guidance to avoid this mistake again
* Run contributor checks from AGT scripts
Fetch the pinned AGT contributor check scripts directly and execute them with Python so the workflow no longer depends on missing console entrypoints from the published package.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Log contributor check JSON outputs
Dump the raw AGT JSON outputs and stderr logs in the contributor check workflow to make future debugging easier.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Normalize AGT risk extraction in the contributor check workflow so missing per-check values do not render as blank or inflate the overall risk.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Updating the workflow to publish to the new marketplace branch
Using env vars for the branch names so that we can easily update without inlining everything as we progress through
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Removing search from the home pageThis was a little confusing because there are two searches, but the overall site search is a lot more powerful
* Prefilter website search by resource page
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* small error handling and formatting
* Simplify website listing controls
Remove per-page text search, trim page-specific controls, and move remaining sort/filter controls into compact flyouts.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* removing old scripts
* consolidated folder
* Updating usage of scripts
* Adding script to generate an open PR report, rather than making AI gen it each time
* Adding step to close old quality report discussions
* Initial pass at bringing a website experience to copilot cli for beginners
* dropped the number from the heading
* Adding codeowner
* agentic workflow to keep the docs in sync
* Making it more aligned with the source material
* Removing the badges and TOC since we get some of that from astro
* updating the agentic workflow
* Adding learning hub to llms.txt
* Removing nav that comes from the source markdown files
* Fixing model names
* handling arrays of models for agent frontmatter
* Cleaning up some warnings on website build
* adding a workflow to run and perform CI of the website
Supplement Starlight's default head output with Twitter title, description, URL, and domain tags plus extra image metadata so social crawlers have a more complete card payload.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add default Starlight description metadata and wire the existing social image into Open Graph and Twitter tags so shared links render a proper preview.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Make the skill modal download button reuse the existing skill ZIP behavior so it downloads the full skill bundle instead of only the current file. Extract the ZIP creation into a shared utility and reuse it from the skills and hooks pages.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Removing a codex-specific agent (model deprecated) and removing model from blueprint mode
* Combining skills into a single skill with an internal decision tree
* Converting agents to skill with decision tree
Closes#998
* Converting agents to skill with decision tree"
Fixes#999
* Cleaned up some tool names
* Removing some instructionsThese instructions are no longer useful as the knowledge the add is already well handled by frontier models, so the instructions potentially provide conflicting or incorrect information to the agent while it undertakes a task
* Improved the skill to be more explicit on how to use playwright
* Removing a skill that is of low value
The information captured in this skill is mostly just what is found in the links that are at the top of the references, and thus the model will already have that knowledge available to it, meaning that the skill will potentially provide conflicting guidance to the agent as it works
* Updating readmes
* Some layout tweaks
* SSR resource listing pages
Render resource listing pages in Astro for first paint and hydrate client filtering/search behavior on top.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fixing font path
* removing feature plugin reference as we don't track that anymore
* button alignment
* rendering markdown
* Improve skills modal file browsing
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improving the layout of the search/filter section
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat: show external plugins on the website
Read plugins/external.json during website data generation and include
external plugins alongside local ones in plugins.json. External plugins
are flagged with external:true and carry metadata (author, repository,
homepage, license, source).
On the website:
- Plugin cards show a '🔗 External' badge and author attribution
- The 'Repository' button links to the source path within the repo
- The modal shows metadata (author, repo, homepage, license) and a
'View Repository' CTA instead of an items list
- External plugins are searchable and filterable by tags
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: address PR #937 security and UX review comments
- Add sanitizeUrl() function to validate URLs and prevent XSS via javascript:/data: schemes
- Add rel="noopener noreferrer" to all target="_blank" links to prevent reverse-tabnabbing
- Change external plugin path from external/<name> to plugins/<name> for proper deep-linking
- Track actual count of external plugins added (after filtering/deduplication) in build logs
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fixing the action link
* Fix sidebar navigation text contrast in light mode
- Use --sl-color-text-invert instead of --sl-color-white for active
sidebar item, fixing near-black text on dark purple background
(contrast ~2.5:1 → ~7.1:1)
- Bump inactive sidebar links to font-weight 500 for better readability
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add search functionality to Learning Hub index page
Add a client-side search bar that filters articles by title, description,
and tags. Sections with no matching results are hidden automatically.
Uses the existing .search-bar CSS pattern from the cookbook page.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore: remove deprecated layouts, theme script, and learning-hub config
Phase 5 cleanup of Starlight migration:
- Delete BaseLayout.astro (replaced by StarlightPage)
- Delete ArticleLayout.astro (replaced by Starlight docs rendering)
- Delete theme.ts (Starlight has built-in theme toggle)
- Delete src/config/learning-hub.ts (sidebar order now in astro.config.mjs)
- Replace learning-hub glob collection with Starlight docs collection in content.config.ts
- Keep search.ts (still used by homepage and all resource page scripts)
Build verified: 23 pages, no errors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Migrate website to Starlight with full-text resource search
- Replace bespoke Astro layouts with Starlight integration
- Homepage and resource pages use StarlightPage wrapper
- Learning Hub articles rendered via Starlight docs collection
- Starlight provides search, theme toggle, sidebar, ToC, a11y
- Add custom Pagefind integration for resource search
- All 614 agents/skills/instructions/hooks/workflows/plugins
indexed as custom records with deep-link URLs
- Type filter pills (horizontal pill toggles) above results
- Search results link directly to resource modals via #file= hash
- Move global.css to src/styles/ for Vite processing
- Scope CSS reset to #main-content to avoid Starlight conflicts
- Full-width page gradient via body:has(#main-content)
- Light/dark theme support with Starlight gray scale inversion
- Delete old layouts (BaseLayout, ArticleLayout), theme.ts, config
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback
- Fix pagefind-resources.ts header comment (pagefind:true not false)
- Remove unused base variable in cookbook/index.astro
- Replace hardcoded /awesome-copilot/ paths with relative links in index.md
- Delete stale public/styles/global.css (source of truth is src/styles/)
- Replace fragile getBasePath() with Astro config base in pagefind integration
- Document pagefind:true reasoning in astro.config.mjs
- Use proper visually-hidden pattern + :focus-visible ring for filter pills
- Remove dead header/nav/theme CSS from global.css (~160 lines)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Scoped custom token only to create-pull-request safe output.
All other operations use default token fallback chains.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Without explicit github-token, the compiler generates a proper
fallback chain (GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) ensuring
a valid token is always available for git push operations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The default GITHUB_TOKEN cannot push branches in this org.
Add explicit github-token using GH_AW_GITHUB_TOKEN secret
to the create-pull-request safe output.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds an agentic workflow triggered by #codeowner comments on PRs.
It creates a PR against staged updating CODEOWNERS with the PR's
files (in agents/, skills/, instructions/, workflows/, hooks/,
plugins/) owned by the PR creator.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
