Skip to content

Commit d7e4ad9

Browse files
aaronpowellCopilot
andauthored
Add Copilot code review quality guidance (#3665)
* Add Copilot code review quality guidance Add a repository-specific Copilot Code Review skill for repo-fit, provenance, differentiation, validation, and marketing-signal review. Wire it into the repo review instructions and CODEOWNERS, add an advisory PR quality-signal workflow, and tighten the Learning Hub updater instructions to reuse existing bot PRs instead of creating duplicate stale update PRs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix PR review workflow feedback Add constrained safe outputs for reusing and closing Learning Hub bot pull requests, and declare the quality-signal workflow name in source frontmatter. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Upgrade agentic workflows Rebase the PR onto main and upgrade gh-aw to v0.88.8. Refresh setup actions, generated workflow locks, container pins, and updater permissions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
1 parent a89cd67 commit d7e4ad9

19 files changed

Lines changed: 6247 additions & 2369 deletions

‎.gitattributes‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,4 @@
2727
*.zip binary
2828
*.pdf binary
2929

30-
.github/workflows/*.lock.yml linguist-generated=true merge=ours
30+
.github/workflows/*.lock.yml linguist-generated=true

‎.github/aw/actions-lock.json‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,15 @@
2020
"version": "v7.0.1",
2121
"sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
2222
},
23-
"github/gh-aw-actions/setup@v0.86.2": {
23+
"github/gh-aw-actions/setup-cli@v0.88.8": {
24+
"repo": "github/gh-aw-actions/setup-cli",
25+
"version": "v0.88.8",
26+
"sha": "5e508589e03a7757a7e05b26e834292f5445bfb6"
27+
},
28+
"github/gh-aw-actions/setup@v0.88.8": {
2429
"repo": "github/gh-aw-actions/setup",
25-
"version": "v0.86.2",
26-
"sha": "6aab9e5b5c91c615506061f09bedd81a23babe3c"
30+
"version": "v0.88.8",
31+
"sha": "5e508589e03a7757a7e05b26e834292f5445bfb6"
2732
}
2833
},
2934
"containers": {
@@ -32,30 +37,45 @@
3237
"digest": "sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6",
3338
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"
3439
},
40+
"ghcr.io/github/gh-aw-firewall/agent:0.28.14": {
41+
"image": "ghcr.io/github/gh-aw-firewall/agent:0.28.14",
42+
"digest": "sha256:f7df036c86575527b61f3f7df91c4412349a12b2a74988d929eafa2999230c98",
43+
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.28.14@sha256:f7df036c86575527b61f3f7df91c4412349a12b2a74988d929eafa2999230c98"
44+
},
3545
"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43": {
3646
"image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43",
3747
"digest": "sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1",
3848
"pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"
3949
},
50+
"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14": {
51+
"image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14",
52+
"digest": "sha256:6f95e2234dd9bd6333a8ff28ccea7ecf0204acd4a09108723844dbd2bf6268c5",
53+
"pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14@sha256:6f95e2234dd9bd6333a8ff28ccea7ecf0204acd4a09108723844dbd2bf6268c5"
54+
},
4055
"ghcr.io/github/gh-aw-firewall/squid:0.27.43": {
4156
"image": "ghcr.io/github/gh-aw-firewall/squid:0.27.43",
4257
"digest": "sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d",
4358
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"
4459
},
45-
"ghcr.io/github/gh-aw-mcpg:v0.4.7": {
46-
"image": "ghcr.io/github/gh-aw-mcpg:v0.4.7",
47-
"digest": "sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00",
48-
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"
60+
"ghcr.io/github/gh-aw-firewall/squid:0.28.14": {
61+
"image": "ghcr.io/github/gh-aw-firewall/squid:0.28.14",
62+
"digest": "sha256:2ce8df3abf3e9b76e9c0cf5863da41f1ab3f89b20ad14b988806ab89e7bf2cd5",
63+
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.28.14@sha256:2ce8df3abf3e9b76e9c0cf5863da41f1ab3f89b20ad14b988806ab89e7bf2cd5"
64+
},
65+
"ghcr.io/github/gh-aw-mcpg:v0.4.18": {
66+
"image": "ghcr.io/github/gh-aw-mcpg:v0.4.18",
67+
"digest": "sha256:85b940556a8faa4e1fdbef124bfd75f2c4ebd855a10b88a1c3b6f3e97f6f1a53",
68+
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.18@sha256:85b940556a8faa4e1fdbef124bfd75f2c4ebd855a10b88a1c3b6f3e97f6f1a53"
4969
},
5070
"ghcr.io/github/gh-aw-node": {
5171
"image": "ghcr.io/github/gh-aw-node",
5272
"digest": "sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196",
5373
"pinned_image": "ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"
5474
},
55-
"ghcr.io/github/github-mcp-server:v1.8.0": {
56-
"image": "ghcr.io/github/github-mcp-server:v1.8.0",
57-
"digest": "sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520",
58-
"pinned_image": "ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"
75+
"ghcr.io/github/github-mcp-server:v1.11.0": {
76+
"image": "ghcr.io/github/github-mcp-server:v1.11.0",
77+
"digest": "sha256:fbec75de11c255213fa08d80fb166abe73d851fff631c51c0079872967720699",
78+
"pinned_image": "ghcr.io/github/github-mcp-server:v1.11.0@sha256:fbec75de11c255213fa08d80fb166abe73d851fff631c51c0079872967720699"
5979
}
6080
}
6181
}

‎.github/copilot-instructions.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
The following instructions are only to be applied when performing a code review.
22

3+
Use `.github/skills/code-review/SKILL.md` for repository-fit, differentiation,
4+
provenance, validation, and editorial-quality review criteria. Apply the
5+
deterministic file-format checks below as well.
6+
37
## README updates
48

59
- [ ] The new file should be added to the `docs/README.<type>.md`.

‎.github/skills/agentic-workflows/SKILL.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@ Repository overlay (optional):
1616
Read only the files you need:
1717
Load these files from `github/gh-aw` (they are not available locally).
1818
- `.github/aw/action-container-substitutions.md`
19+
- `.github/aw/agent-runtime-instructions.md`
1920
- `.github/aw/agentic-chat.md`
2021
- `.github/aw/agentic-workflows-mcp.md`
2122
- `.github/aw/asciicharts.md`
2223
- `.github/aw/campaign.md`
2324
- `.github/aw/charts-trending.md`
2425
- `.github/aw/charts.md`
2526
- `.github/aw/cli-commands.md`
27+
- `.github/aw/compat.md`
2628
- `.github/aw/configure-agentic-engine.md`
2729
- `.github/aw/context.md`
2830
- `.github/aw/create-agentic-workflow-trigger-details.md`
@@ -31,13 +33,19 @@ Load these files from `github/gh-aw` (they are not available locally).
3133
- `.github/aw/debug-agentic-workflow.md`
3234
- `.github/aw/dependabot.md`
3335
- `.github/aw/deployment-status.md`
36+
- `.github/aw/designer-mappings.md`
3437
- `.github/aw/designer.md`
38+
- `.github/aw/drive-memory.md`
39+
- `.github/aw/enclaves.md`
3540
- `.github/aw/evals.md`
3641
- `.github/aw/experiments.md`
3742
- `.github/aw/github-agentic-workflows.md`
3843
- `.github/aw/github-mcp-server-pagination.md`
44+
- `.github/aw/github-mcp-server-tools.md`
3945
- `.github/aw/github-mcp-server.md`
4046
- `.github/aw/instructions.md`
47+
- `.github/aw/intent.md`
48+
- `.github/aw/jobs.md`
4149
- `.github/aw/linter-workflows.md`
4250
- `.github/aw/llms.md`
4351
- `.github/aw/loop.md`
@@ -51,6 +59,7 @@ Load these files from `github/gh-aw` (they are not available locally).
5159
- `.github/aw/network.md`
5260
- `.github/aw/optimize-agentic-workflow.md`
5361
- `.github/aw/patterns.md`
62+
- `.github/aw/playwright.md`
5463
- `.github/aw/pr-reviewer.md`
5564
- `.github/aw/release-workflow.md`
5665
- `.github/aw/report.md`
@@ -98,5 +107,6 @@ After loading the matching workflow prompt or skill, follow it directly:
98107
- Choose workflow architecture and patterns: `.github/aw/patterns.md`
99108
- Optimize token usage and cost: `.github/aw/token-optimization.md`
100109
- Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
110+
- Add skills or agent plugins requested by the user (`skills:` / `plugins:` frontmatter, never on-the-fly installs): `.github/aw/skills.md`
101111

102112
When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.
Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
name: code-review
3+
description: 'Review pull requests for repository fit, meaningful value, trustworthy provenance, differentiation, and maintainability in awesome-copilot.'
4+
---
5+
6+
# Awesome Copilot Code Review
7+
8+
Use this skill when reviewing pull requests in this repository. Apply the
9+
deterministic checklists in `.github/copilot-instructions.md` first, then use
10+
this skill for the editorial and repository-fit judgments that cannot be
11+
reduced to schema validation.
12+
13+
## Review priorities
14+
15+
Review in this order:
16+
17+
1. Correctness, security, and harmful behavior.
18+
2. Compliance with the repository's contribution requirements.
19+
3. Repository fit and meaningful value for GitHub Copilot users.
20+
4. Differentiation from existing resources and native model capabilities.
21+
5. Evidence that the contribution was tested or validated.
22+
6. Clarity, maintainability, and appropriate scope.
23+
24+
Do not use raw file count as a quality metric. Large generated website changes,
25+
mechanical README updates, and other build outputs can be legitimate and should
26+
be evaluated according to their source change.
27+
28+
## Repository fit
29+
30+
Confirm that a submission addresses a specific GitHub Copilot workflow,
31+
technology, domain constraint, or user problem. Flag contributions that:
32+
33+
- provide generic advice that current models already handle well without
34+
meaningful uplift
35+
- restate an existing resource without a clear differentiator
36+
- use broad claims such as doing everything for every project
37+
- lack concrete instructions, constraints, examples, or expected outcomes
38+
- are primarily a wrapper or advertisement for the author's product
39+
40+
Paid or commercial services are not automatically unsuitable. Evaluate whether
41+
the contribution provides standalone user value and follows the repository's
42+
guidance for paid-service submissions.
43+
44+
## AI-authored submissions
45+
46+
A PR title ending in `🤖🤖🤖` is an intentional AI-authorship disclosure from
47+
`CONTRIBUTING.md`. Do not report the marker itself as a defect.
48+
49+
For disclosed AI-authored submissions, verify that the PR still demonstrates:
50+
51+
- a concrete need and repository fit
52+
- human validation or testing of the result
53+
- useful constraints rather than generic generated prose
54+
- an explanation of how it differs from existing resources
55+
56+
Review the submitted result, not assumptions about the tool that produced it.
57+
58+
## Marketing and self-promotion
59+
60+
Flag marketing-heavy framing only when there is concrete evidence, such as:
61+
62+
- repeated brand or product promotion unrelated to usage instructions
63+
- unsupported superlatives or sales claims
64+
- links or calls to action that dominate the resource
65+
- a resource whose primary purpose is acquiring users rather than helping them
66+
use GitHub Copilot
67+
68+
Describe the specific evidence and suggest how to refocus the contribution on
69+
the user problem. Do not infer promotional intent solely because an author is
70+
associated with a referenced project.
71+
72+
## Duplication and differentiation
73+
74+
Search existing agents, instructions, skills, hooks, workflows, prompts, and
75+
plugins when the new resource appears similar to existing content. Compare
76+
purpose and behavior, not only names.
77+
78+
Only report duplication when the overlap is substantial. Related resources can
79+
coexist when they target different frameworks, audiences, constraints, or
80+
stages of a workflow.
81+
82+
When configured MCP context is relevant, use the GitHub MCP server to inspect
83+
linked issues, prior submissions, or repository history. Cite the specific
84+
resource or pull request that supports the finding.
85+
86+
## Evidence and validation
87+
88+
Check that the PR explains how the contribution was tested or validated. The
89+
appropriate evidence depends on the resource:
90+
91+
- agents, prompts, instructions, and skills should include a realistic usage
92+
scenario or describe how their output was evaluated
93+
- scripts and bundled assets should have focused tests or reproducible
94+
validation steps
95+
- workflows and hooks should demonstrate safe triggers, least-privilege
96+
permissions, constrained outputs, and expected event behavior
97+
- documentation updates should cite the authoritative feature or behavior they
98+
describe
99+
100+
Do not require executable tests for prose-only resources when a realistic
101+
manual evaluation is more appropriate.
102+
103+
## Trusted and automated paths
104+
105+
GitHub and Microsoft external-plugin updates are generally trusted-source
106+
submissions. Still report concrete correctness, security, or manifest problems,
107+
but do not manufacture editorial concerns merely because the change is
108+
automated or externally sourced.
109+
110+
For automated documentation PRs, distinguish bad content from stale automation
111+
churn. Overlapping daily updates may indicate that the workflow should update an
112+
existing PR rather than that the documentation itself is low quality.
113+
114+
## Review output
115+
116+
Leave comments only for specific, actionable findings introduced by the PR.
117+
Each finding should:
118+
119+
- identify the affected file and line when possible
120+
- explain the concrete impact on users or maintainers
121+
- cite the repository rule, existing resource, or evidence behind the finding
122+
- recommend the smallest useful correction
123+
124+
Avoid vague comments such as "this feels AI-generated," "low quality," or
125+
"marketing." Explain the observable problem.
126+
127+
Do not recommend approval solely because automated checks pass. Human
128+
maintainers retain final judgment over editorial value and repository fit.
129+
130+
## Review-policy changes
131+
132+
Copilot Code Review reads skills and instructions from the PR head branch.
133+
Therefore, treat changes to `.github/skills/code-review/`,
134+
`.github/copilot-instructions.md`, `AGENTS.md`, or other review-policy files as
135+
security-sensitive governance changes. Explicitly call out attempts to weaken,
136+
bypass, or remove review criteria, and require maintainer review of those
137+
changes.

0 commit comments

Comments
 (0)