mirror of
https://github.com/github/awesome-copilot.git
synced 2026-10-12 23:04:14 +00:00
d82df27473
* Phase 3: canvas smoke-test evidence, safe auto-merge, and weekly review metrics (#4184) Adds the canvas-smoke-test check with review evidence, a config-gated safe auto-merge workflow (disabled by default), and a weekly review operating metrics workflow, plus maintainer docs. Refs github/awesome-copilot#4184 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Trigger safe auto-merge sweep after Submission Gate Writer completes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Rename thirdParty identifier to satisfy codespell Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address Copilot review on canvas smoke test, auto-merge, and metrics - Bind canvas report writer to the triggering workflow_run PR (base/head repo, ref, SHA) - Bound PNG inflation by IHDR-derived size and a decoded-bytes budget - Classify file: URLs as unsafe manifest paths - Follow CommonJS require() and literal dynamic imports; error on missing reachable targets and devDependency-only runtime imports - Validate removed extension paths and orphaned plugins instead of skipping - Warn on .py/.rb/.pl scripts - Auto-merge: support CODEOWNERS teams (fail closed), front matter authors, list PRs by head SHA, only fall back to direct merge on clean status, drop ineffective check_run trigger - Metrics: ignore reviews before the PR was ready for review Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Docs: note microsoft/azure-dev-tools as a portable marketplace for the review model Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Auto-merge: only trust submission-gate runs from the Submission Gate Writer Adds trusted_checks (default submission-gate -> external_id submission-gate-writer). Any other check run or status with that name on the head SHA blocks arming, so a PR-defined job cannot satisfy the gate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden canvas smoke-test checker - String-, template-, and regex-aware comment stripping so literals containing // cannot hide imports - Never follow symlinks or read non-regular files; bounded, contained reads - Validate plugins whose plugin.json was deleted - Reject unsafe extension IDs in plugin manifests before materialization Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Phase 3: remove auto-merge, isolate canvas smoke test, harden checker - Remove safe auto-merge (config, workflow, script, tests, labels) per maintainer review; documented as deferred pending a security review. - Restore validate-canvas-extensions.yml to main and move the smoke test to its own canvas-smoke-test.yml workflow scoped to extensions/**. - Reject duplicate IHDR chunks in preview PNGs. - Mask string/template/regex literal contents before extracting dynamic import() and require() specifiers. - Resolve package.json imports aliases through the same classifier and module graph; fail closed on alias shapes that cannot be analyzed. - Rename docs to canvas-evidence-and-metrics.md and update references. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix canvas smoke and review metrics findings - Trigger canvas smoke tests for plugin changes while skipping expensive setup when target detection finds no canvas coverage. - Fail reachable data: imports while preserving warnings for unreachable module data: imports. - Use base plugin manifests for deleted bundle plugin detection and fail closed when base manifests cannot be read. - Paginate GraphQL PR review pages before computing weekly review metrics. - Report workflow run API collection errors as incomplete automation health instead of not found. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address follow-up canvas review findings Fail closed on non-literal runtime imports, require canonical PNG termination, restrict comment updates to github-actions[bot], and paginate external-plugin label events. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Aaron Powell <me@aaron-powell.com>
62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
# Weekly review operating metrics (github/awesome-copilot#4184, phase 3).
|
|
#
|
|
# Read by eng/review-metrics.mjs, which .github/workflows/review-metrics.yml
|
|
# runs every Monday. See docs/maintainers/canvas-evidence-and-metrics.md.
|
|
|
|
# Days of activity summarized in each report.
|
|
window_days: 7
|
|
|
|
# Review targets, in business days (weekends are skipped).
|
|
targets_business_days: [2, 4]
|
|
|
|
# Base branch for contribution PRs.
|
|
base_branch: main
|
|
|
|
# State labels (maintained by the submission gate). Open PRs without any of
|
|
# these are reported as "unlabeled".
|
|
state_labels:
|
|
- awaiting-automation
|
|
- requires-submitter-fixes
|
|
- ready-for-review
|
|
- review-in-progress
|
|
- approved
|
|
|
|
# Risk tier labels. Open PRs without any of these are "unclassified".
|
|
risk_labels:
|
|
- merge-risk:low
|
|
- merge-risk:medium
|
|
- merge-risk:high
|
|
|
|
# External plugin submission issues are tracked alongside PRs.
|
|
external_plugin_label: external-plugin
|
|
external_plugin_state_labels:
|
|
- awaiting-review
|
|
- requires-submitter-fixes
|
|
- ready-for-review
|
|
- awaiting-approval
|
|
|
|
# Review-automation workflows whose failed/errored runs count toward the
|
|
# automation failure rate. Files that do not exist yet are reported as
|
|
# "not found" and skipped, so later phases can be listed ahead of time.
|
|
automation_workflows:
|
|
- submission-gate.yml
|
|
- submission-gate-writer.yml
|
|
- review-routing.yml
|
|
- canvas-smoke-test.yml
|
|
- canvas-smoke-test-comment.yml
|
|
- pr-risk-scan.yml
|
|
- pr-risk-scan-comment.yml
|
|
- label-pr-intent.yml
|
|
- label-pr-intent-writer.yml
|
|
- check-plugin-structure.yml
|
|
- external-plugin-intake.yml
|
|
- external-plugin-quality-gates.yml
|
|
- external-plugin-pr-quality-gates.yml
|
|
- external-plugin-pr-quality-gates-writer.yml
|
|
- external-plugin-command-router.yml
|
|
|
|
# Tracking issue that receives the weekly report.
|
|
tracking_issue:
|
|
title: Review operating metrics
|
|
label: review-metrics
|