mirror of
https://github.com/github/awesome-copilot.git
synced 2026-10-12 23:04:14 +00:00
James MontemagnoandCopilot App
d6131471b8
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184) Phase 2 (enforcement) of github/awesome-copilot#4184: - submission-gate aggregate required check (reader) with infra vs contribution failure classification - merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy - Submission Gate Writer maintaining state labels and a persistent status comment - /rerun-checks and /request-review PR commands - validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell findings and add spelling to submission gate checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden submission gate per review feedback - Publish the submission-gate check from the trusted writer via the Checks API and flag any other submission-gate check run as tampering - Fail closed on truncated file lists, unscannable diffs, permission lookup errors, and skipped required checks - Discard evaluations when the PR head or reviews change mid-run - Low tier requires a resource owner approval - Commands must start the comment, matching the workflow filter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address #4190 review: command reader/writer, pools, paths, staleness - Split /rerun-checks and /request-review into a read-only issue_comment reader and a workflow_run writer that re-reads the comment, PR, and permission before writing. - Drop the workflow-security pool; agentic workflows and hooks are content (medium unless they add scripts or hook commands); the core pool is core-maintainers. - Include each check's workflow file and eng scripts in its paths. - Discard evaluations when the base branch or risk labels change; run the gate on PR edits (retargeting). - Correct copies of the writer's check that claim success while the evaluation fails. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on lost contributor signal; publish gate check before labels - A contributor check whose pr-check job succeeded but whose result artifact is missing or unreadable is now an infrastructure failure, so a lost HIGH signal can't lower the approval tier. - Publish the submission-gate check right after stale-state revalidation; label and comment sync are independent and reported afterwards. - Revert the self-path added to validate-agentic-workflows-pr.yml's trigger: that workflow rejects any .github change. Exempt it in the drift test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on bad routing config; advisory checks never hold the gate - loadGateConfig: a missing review-routing.yml still falls back, but a file that can't be parsed (or whose pools isn't a mapping) now throws instead of silently relaxing approvals. - Pending required: false checks no longer keep the PR in awaiting-automation or the gate check in progress, and the polling loop doesn't wait on them. They render as pending (advisory). - PR commands: 👀 marks a command as claimed; 🚀 is written only after the reply is posted and is the only replay guard, so a run that failed partway can be retried. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell: unparseable -> unparsable Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor Reporting (Maintainers) 🚧
This directory contains build scripts and utilities for maintaining the repository.
Build Scripts
update-readme.mjs
Generates the main README.md and documentation files from the repository content (agents, prompts, instructions, skills, hooks, collections).
generate-marketplace.mjs
Automatically generates .github/plugin/marketplace.json from all plugin directories in the plugins/ folder. This file is used by the GitHub Copilot CLI to discover and install plugins from this repository.
How it works:
- Scans all directories in
plugins/ - Reads each plugin's root
plugin.jsonfor metadata - Generates a consolidated
marketplace.jsonwith all available plugins - Runs automatically as part of
npm run build
To run manually:
npm run plugin:generate-marketplace
generate-website-data.mjs
Generates JSON data files for the website from repository content.
review-routing.mjs
Reviewer routing and review SLA escalation used by the Review Routing and Review Escalation workflows. Reviewer pools live in .github/review-routing.yml; see docs/maintainers/review-routing.md.
node eng/review-routing.mjs validate # validate .github/review-routing.yml
node --test eng/review-routing.test.mjs # unit tests
Contributor Tools
contributor-report.mjs— generates a markdown report of merged PRs for missing contributors (includes shared helpers).add-missing-contributors.mjs— on-demand maintainer script to automatically add missing contributors to.all-contributorsrc(infers contribution types from merged PR files, then runs the all-contributors CLI).
Key notes for maintainers
- Reports are generated on-demand and output to
reports/contributor-report.mdfor human review. - The report output is intentionally minimal: a single list of affected PRs and one command to add missing contributor(s).
- This repository requires full git history for accurate analysis. In CI, set
fetch-depth: 0. - Link: all-contributors CLI documentation
On-demand scripts (not CI)
These are maintainer utilities. They are intentionally on-demand only (but could be wired into CI later).
add-missing-contributors.mjs
- Purpose: detect missing contributors, infer contribution types from their merged PR files, and run
npx all-contributors add ...to update.all-contributorsrc. - Requirements:
- GitHub CLI (
gh) available (used to query merged PRs). .all-contributorsrcexists.- Auth token set to avoid the anonymous GitHub rate limits:
- Set
GITHUB_TOKEN(preferred), orGH_TOKENfor theghCLI. - If you use
PRIVATE_TOKENlocally,contributor-report.mjswill map it toGITHUB_TOKEN.
- Set
- GitHub CLI (
Graceful shutdown
contributor-report.mjscallssetupGracefulShutdown('script-name')fromeng/utils/graceful-shutdown.mjsearly in the file to attach signal/exception handlers.
Testing & maintenance
- Helper functions have small, deterministic behavior and include JSDoc comments.
- The
getMissingContributorsfunction incontributor-report.mjsis the single source of truth for detecting missing contributors fromall-contributors checkoutput.