[pablonete]

Publish Security extension version 0.2.0 for GitHub Copilot App. Contains the built canvas extension, its plugin manifest and README, the regenerated marketplace and plugin docs, and a codespell skip for the bundled third-party code.

[github-actions]

🔒 PR Risk Scan Results

Scanned 5 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

Skipped non-text or missing files

• extensions/github-security/assets/preview.png
• extensions/github-security/assets/screenshot.png
• plugins/github-security/assets/preview.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Adds 3 file(s), e.g. extensions/github-security/README.md
• Changes 173 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Canvas extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 3a36a0c · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🧩 Canvas smoke test

✅ Passed · 0 error(s), 0 warning(s)

Check	Result
Syntax, imports, file safety	✅
Preview image (≥ 400×160 PNG)	✅
Plugin manifests	✅
Materialize	✅
Install (Copilot CLI)	✅

Plugin github-security v0.2.0

Field	Value
Description	GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.
Author	—
License	—
Keywords	security, code-scanning, canvas, ghas, alert, finding
Extensions	github-security
Materialize	✅
Install	✅

Changed plugin files

• plugins/github-security/README.md
• plugins/github-security/assets/preview.png
• plugins/github-security/plugin.json

Extension github-security

Field	Value
Registered by	github-security
Package	—
Preview	1984×892, 278.1 KB
Modules	61 (60 reachable from extension.mjs)
Files	70

Permissions and capabilities (static analysis of modules reachable from extension.mjs)

• Spawns processes (node:child_process)
• File system access (node:fs)
• Network sockets / local server (node:http, node:net, ...)
• Outbound HTTP requests (fetch)
• Reads environment variables (process.env)

Changed extension files

• extensions/github-security/README.md
• extensions/github-security/assets/preview.png
• extensions/github-security/assets/screenshot.png
• extensions/github-security/extension.mjs

---

Static checks compile modules without executing them. Minimum preview size is configurable with CANVAS_PREVIEW_MIN_WIDTH/CANVAS_PREVIEW_MIN_HEIGHT. Workflow run

[Copilot]

🟢 Approval recommended

The supplied changes are limited to documentation, metadata, and a display label, with only non-blocking editorial feedback remaining.

No open issues 🎉

What changed in this PR

Refines the GitHub Security 0.2.0 release presentation for Copilot App, documenting existing security workflows and updating the extension’s branding.

Changes:

• Expands documentation for features, installation, tools, and permissions.
• Renames the canvas display label to GitHub Security.
• Synchronizes the plugin description across the manifest and generated catalogs.

File	Description
plugins/​github-security/​README.md	Expands user-facing setup and usage documentation.
plugins/​github-security/​plugin.json	Updates the plugin description.
extensions/​github-security/​README.md	Adds matching documentation alongside the extension.
extensions/​github-security/​extension.mjs	Updates the canvas display label.
docs/​README.plugins.md	Refreshes the generated plugin listing.
.github/​plugin/​marketplace.json	Synchronizes the marketplace description.

_{Review effort: Max}

[jchuerva]

This PR should be closed. Tag 0.2.0 has been merged so we cannot update it.

Replaced by #5382 , updating the tag to 0.2.1