* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)
Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell findings and add spelling to submission gate checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden submission gate per review feedback
- Publish the submission-gate check from the trusted writer via the Checks API
and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address #4190 review: command reader/writer, pools, paths, staleness
- Split /rerun-checks and /request-review into a read-only issue_comment
reader and a workflow_run writer that re-reads the comment, PR, and
permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
content (medium unless they add scripts or hook commands); the core
pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
evaluation fails.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on lost contributor signal; publish gate check before labels
- A contributor check whose pr-check job succeeded but whose result artifact
is missing or unreadable is now an infrastructure failure, so a lost HIGH
signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
that workflow rejects any .github change. Exempt it in the drift test.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on bad routing config; advisory checks never hold the gate
- loadGateConfig: a missing review-routing.yml still falls back, but a
file that can't be parsed (or whose pools isn't a mapping) now throws
instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
awaiting-automation or the gate check in progress, and the polling loop
doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
the reply is posted and is the only replay guard, so a run that failed
partway can be retried.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix codespell: unparseable -> unparsable
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Precompute lowercased search fields once per index identity so each query avoids repeating normalization across every indexed item.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Waseem <wmohammed@pros.com>
* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184)
- Replace the individual default CODEOWNERS owner with the core-maintainer
team and add domain team ownership for extensions, plugins, content,
hooks, workflows, .github, and eng.
- Add .github/review-routing.yml as the single source of truth for reviewer
pools, routes, labels, and SLA settings (ships in dry-run mode).
- Add eng/review-routing.mjs (+ unit tests) with business-day math,
least-loaded reviewer selection, routing and escalation planning, and
workflow_run artifact validation.
- Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request
(read-only needs-reviewer reader), and Review Escalation (weekday schedule)
workflows.
- Add needs-reviewer, review-overdue, review-escalated to setup-labels.
- Document the model in docs/maintainers/review-routing.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on reviewer routing and escalation
- Escalate at routedOn + escalation business days (Mon -> Fri)
- Leave labels untouched when requestReviewers fails and fail the job
- Serialize read/plan/apply per PR across routing and escalation
- Treat Label PR Intent artifact labels as authoritative
- Re-route to an uncovered pool on head changes without restarting SLA
- Use the due-label timestamp as the review boundary
- Fall back to pool/escalation teams and report what was requested
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second-round review feedback on review routing (#4184)
- CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the
separate /.github/workflows/ rule, and leave per-resource owner lines as on
main (their removal is deferred to a separate cleanup).
- Routing: ignore pending requests for unavailable reviewers when checking
coverage; needs-reviewer excludes prior reviewers and changes nothing when no
new reviewer can be requested.
- Escalation comments show the actual routing date.
- Cap sweep matrices at 256 targets and defer the remainder.
- Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Route workflow and hooks labels to the content pool (#4184)
Drop the workflow-security reviewer pool per maintainer feedback: agentic
workflows and hooks are reviewed like other content, and the repository's
own GitHub Actions workflows stay with core maintainers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware
- Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config.
- CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Simplify dry_run validation condition
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds a skill for taking a Windows desktop app through its first Microsoft
Store submission: product identity, an unsigned Store MSIX, package
inspection, WACK with report verification, every Partner Center section,
and certification monitoring. It includes PowerShell scripts for MSIX
inspection and WACK, a guarded Playwright controller for Partner Center,
references, and templates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 33e33f93-bd16-4262-8026-fc42063cef78
The README build fetched the live GitHub MCP registry to decide whether to
link server names, which made output nondeterministic (e.g. Apify) and
caused the validate-readme check to fail intermittently.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add v-development skill
Teach Copilot V language development: toolchain, v.mod layout, build/test/fmt, and Option/Result error handling.
* Fix v-development skill accuracy
Correct v.mod schema (dependencies), manifest optionality, entry-point guidance, VPM registry URL, and globals rule per official V docs.
* Correct mutability and Option/Result propagation guidance
Variables use mut, only struct sections use mut:; postfix ? propagates Options, ! propagates errors; no forced unwrap.
* Scope compilation, nil, and mutability guidance to verified behavior
v run excludes test files; nil only in unsafe/C interop; mutable parameters documented.
* Keep example Config fields immutable
The port field was never mutated; placing it under mut: contradicted the immutable-by-default guidance.
* Recommend json2 over superseded json module
Official V docs teach json2 for encoding/decoding.
* Refactor Learning Hub content to reduce changelog-audit-trail noise
Follows up on the Learning Hub content audit report: automated
changelog-driven PRs had turned several evergreen guide pages into a
version-history audit trail rather than current-state documentation
(e.g. copilot-configuration-basics.md had 86 inline vX.Y.Z+ tags).
Content changes:
- copilot-configuration-basics.md, installing-and-using-plugins.md,
building-custom-agents.md, automating-with-hooks.md, and
understanding-mcp-servers.md: removed decorative inline version
tags from the main teaching flow so pages read as 'how to use this
today' rather than 'when this changed'. Genuinely actionable
history (renames, removed flags/settings, breaking defaults) is
consolidated into a new Compatibility and Migration Notes section
per page instead of being scattered inline.
Automation change:
- .github/workflows/learning-hub-updater.md (+ recompiled .lock.yml):
added a 'stale version notes' detection step, a content model that
distinguishes evergreen guides from Compatibility and Migration
Notes sections, consolidation rules, and a required content-cleanup
checklist item in the PR body, so future automated updates keep
this pattern instead of re-accumulating inline version chronology.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Learning Hub review feedback
Clarify the evergreen and compatibility section model and restore version thresholds needed for troubleshooting older CLI installations.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update .NET Copilot SDK cookbook: fix On<T> breaking change, add in-process runtime, tool search, and message provenance recipes
- Fix breaking change: Session.On is now generic (On<T> where T : SessionEvent).
Updated all recipes that used the old non-generic session.On(evt => ...) pattern:
error-handling, pr-visualization, managing-local-files, accessibility-report,
ralph-loop (both .md and .cs where applicable).
- Add new 'In-Process Runtime' recipe (in-process-runtime.md + recipe/in-process-runtime.cs)
demonstrating RuntimeConnection.ForInProcess(), live-tested.
- Document tool search / deferred loading (SessionConfig.ToolSearch / ToolSearchConfig)
in pr-visualization.md, live-tested.
- Document typed message provenance (MessageOptions.Source / MessageSource) in
error-handling.md, live-tested.
- Fix dotnet/README.md recipe index: it was missing Ralph Loop and Accessibility
Report entries; also added the new In-Process Runtime entry.
- Add In-Process Runtime entry to the top-level cookbook/copilot-sdk/README.md
.NET section.
- Update dotnet/recipe/README.md runnable-examples table with the new recipe.
All existing .NET cookbook recipes were rebuilt and rechecked against the current
GitHub Copilot SDK (Copilot CLI 1.0.85); no other breaking changes were found.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update cookbook model names to current supported models
- Replace stale/nonexistent model IDs (gpt-5, claude-sonnet-4.5,
claude-opus-4.6, gpt-5.1-codex-mini) with current values from the
supported AI models list
- Prefer Model = "auto" wherever a specific model isn't load-bearing
to the recipe's teaching point
- ralph-loop: pin gpt-5.3-codex (current codex-family GA model), since
a dedicated coding model is a deliberate, documented choice for the
autonomous loop
- multiple-sessions: reshape the model narrative so it demonstrates a
real explicit-override use case (A/B testing via claude-sonnet-5)
instead of two sessions sharing the same hardcoded model
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use SendAndWaitAsync in in-process runtime recipe
Replace the event-based TaskCompletionSource pattern with SendAndWaitAsync so the example waits for the final assistant response, propagates session errors, and uses the SDK timeout behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update the external plugin version and tag, pin the merged upstream release commit, and regenerate the marketplace.
Co-authored-by: haozhang <haozhan@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4a60a8cc-9b50-40c7-b29a-bdbf60144f6f
* Update Anarlog to local-first version 1.3.0
Pin the existing listing to the tested source revision and regenerate its marketplace entry.
* Pin the final reviewed Anarlog package
Include corrected Flatpak setup and paid-Team eligibility in the 1.3.0 source.
* keep-the-why: bump to 0.16.0
* keep-the-why: bump to 0.16.1
* keep-the-why: bump to 0.16.2
* keep-the-why: bump to 0.16.3
* keep-the-why: bump to 0.17.0 (version and source.ref)
* Simplify agent definitions and bump plugin version to 1.129.0
* Fix spelling of reusable in gem-planner agent
* Simplify agent definitions and bump gem-team to 1.130.0
* Simplify agent definitions and bump gem-team to 1.131.0
* fix: revise proof rule to aovid redundant echoing
* fix: Simplify orchstrator rules
James Montemagno
github-actions[bot]
Gautam Jethwani
Waseem MohammedandWaseem
Burke HollandandCopilot App
Tim MulhollandandCopilot App
Paul YuknewiczandCopilot App
Ulises Jeremias
Jonathan Russ
Burak Kaygusuz
Antonio VillanuevaandCopilot App
Andrew ArnottandCopilot
Shruthi KumarandCopilot App
allcontributors[bot]andPretaSOFT
qinezh
Jon GallowayandCopilot
sudhirp25
dependabot[bot]andPretaSOFT
Viacheslav Tsuvariev
John Jeong
Ricky
Mnimiy
CrabbbandБаньковский Станислав Евгеньевич
Oliver Zehentleitner AIgent
Muhammad Ubaid Raza
Vijit SinghalandClaude Opus 4.6
