mirror of
https://github.com/github/awesome-copilot.git
synced 2026-07-14 01:51:02 +00:00
Aaron Powell
79cda6bb19
* Add canvas schema and extension submission checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: use namespace import for js-yaml Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> * Fix contributors page build markup Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> * Address PR feedback on canvas schema validation - Add ajv-cli@5 as a pinned devDependency; install via npm ci in CI instead of npx --yes - Fix screenshot path regex to prevent .. traversal segments - Validate canvas.schema.json is parseable JSON even on schema-only PRs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden canvas extension workflow against injection attacks Switch from newline to null-terminated git diff output (git diff -z) so filenames containing newlines are read atomically, matching the existing skill-check.yml pattern. Add an allowlist regex guard on the extracted extension directory name immediately after it is parsed from git diff output. Any name not matching ^[a-z0-9][a-z0-9-]*$ (e.g. names containing dollar signs, parentheses, spaces, or other shell metacharacters) is silently skipped before being used anywhere in the script. Add a matching allowlist guard on each screenshot path extracted from canvas.json before the file-existence check, so a crafted manifest cannot supply a path with shell metacharacters or traversal segments even after the schema check passes. Follows the same defence-in-depth pattern introduced after the injection PoCs in #1236 and #1240. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Replace ajv-cli with in-repo schema validator - Remove ajv-cli to avoid vulnerable/deprecated transitive dependencies - Add eng/validate-json-schema.mjs using ajv + ajv-formats - Update validate-canvas-extensions workflow to use local script - Use npm ci --ignore-scripts in PR validation job Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor Reporting (Maintainers) 🚧
This directory contains build scripts and utilities for maintaining the repository.
Build Scripts
update-readme.mjs
Generates the main README.md and documentation files from the repository content (agents, prompts, instructions, skills, hooks, collections).
generate-marketplace.mjs
Automatically generates .github/plugin/marketplace.json from all plugin directories in the plugins/ folder. This file is used by the GitHub Copilot CLI to discover and install plugins from this repository.
How it works:
- Scans all directories in
plugins/ - Reads each plugin's
.github/plugin/plugin.jsonfor metadata - Generates a consolidated
marketplace.jsonwith all available plugins - Runs automatically as part of
npm run build
To run manually:
npm run plugin:generate-marketplace
generate-website-data.mjs
Generates JSON data files for the website from repository content.
Contributor Tools
contributor-report.mjs— generates a markdown report of merged PRs for missing contributors (includes shared helpers).add-missing-contributors.mjs— on-demand maintainer script to automatically add missing contributors to.all-contributorsrc(infers contribution types from merged PR files, then runs the all-contributors CLI).
Key notes for maintainers
- Reports are generated on-demand and output to
reports/contributor-report.mdfor human review. - The report output is intentionally minimal: a single list of affected PRs and one command to add missing contributor(s).
- This repository requires full git history for accurate analysis. In CI, set
fetch-depth: 0. - Link: all-contributors CLI documentation
On-demand scripts (not CI)
These are maintainer utilities. They are intentionally on-demand only (but could be wired into CI later).
add-missing-contributors.mjs
- Purpose: detect missing contributors, infer contribution types from their merged PR files, and run
npx all-contributors add ...to update.all-contributorsrc. - Requirements:
- GitHub CLI (
gh) available (used to query merged PRs). .all-contributorsrcexists.- Auth token set to avoid the anonymous GitHub rate limits:
- Set
GITHUB_TOKEN(preferred), orGH_TOKENfor theghCLI. - If you use
PRIVATE_TOKENlocally,contributor-report.mjswill map it toGITHUB_TOKEN.
- Set
- GitHub CLI (
Graceful shutdown
contributor-report.mjscallssetupGracefulShutdown('script-name')fromeng/utils/graceful-shutdown.mjsearly in the file to attach signal/exception handlers.
Testing & maintenance
- Helper functions have small, deterministic behavior and include JSDoc comments.
- The
getMissingContributorsfunction incontributor-report.mjsis the single source of truth for detecting missing contributors fromall-contributors checkoutput.