[pablonete]

Publish Security extension version 0.2.1 for GitHub Copilot App. Contains the built canvas extension, its plugin manifest and README, the regenerated marketplace and plugin docs, and a codespell skip for the bundled third-party code.

[github-actions]

🔒 PR Risk Scan Results

Scanned 6 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	extensions/github-security/manifest.json	4	"engines": { "github-app": "^0.2.0" },

Skipped non-text or missing files

• extensions/github-security/assets/preview.png
• extensions/github-security/assets/screenshot.png
• plugins/github-security/assets/preview.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Adds 3 file(s), e.g. extensions/github-security/README.md
• Changes 179 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Canvas extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 6d6c763 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🧩 Canvas smoke test

✅ Passed · 0 error(s), 0 warning(s)

Check	Result
Syntax, imports, file safety	✅
Preview image (≥ 400×160 PNG)	✅
Plugin manifests	✅
Materialize	✅
Install (Copilot CLI)	✅

Plugin github-security v0.2.1

Field	Value
Description	GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.
Author	—
License	—
Keywords	security, code-scanning, canvas, ghas, alert, finding
Extensions	github-security
Materialize	✅
Install	✅

Changed plugin files

• plugins/github-security/README.md
• plugins/github-security/assets/preview.png
• plugins/github-security/plugin.json

Extension github-security

Field	Value
Registered by	github-security
Package	—
Preview	1984×892, 278.1 KB
Modules	61 (60 reachable from extension.mjs)
Files	70

Permissions and capabilities (static analysis of modules reachable from extension.mjs)

• Spawns processes (node:child_process)
• File system access (node:fs)
• Network sockets / local server (node:http, node:net, ...)
• Outbound HTTP requests (fetch)
• Reads environment variables (process.env)

Changed extension files

• extensions/github-security/README.md
• extensions/github-security/assets/preview.png
• extensions/github-security/assets/screenshot.png
• extensions/github-security/extension.mjs
• extensions/github-security/manifest.json

---

Static checks compile modules without executing them. Minimum preview size is configurable with CANVAS_PREVIEW_MIN_WIDTH/CANVAS_PREVIEW_MIN_HEIGHT. Workflow run

[Copilot]

🟡 Changes recommended

The packaged extension manifest still declares version 0.2.0, which does not match the advertised 0.2.1 release.

1 open issue

• Update extension manifest version to 0.2.1 · New

What changed in this PR

Prepares github-security 0.2.1 for the GitHub Copilot App, with updated release metadata, canvas branding, and usage documentation.

Changes:

• Updates the plugin and marketplace version to 0.2.1 and refreshes their descriptions.
• Changes the registered canvas display name to GitHub Security.
• Documents features, installation, agent tools, and data permissions in both READMEs.

File	Description
plugins/​github-security/​README.md	Expands user-facing features, setup, and permission documentation.
plugins/​github-security/​plugin.json	Updates the release version and plugin description.
extensions/​github-security/​README.md	Adds documentation alongside the extension bundle.
extensions/​github-security/​extension.mjs	Updates the registered canvas display name.
docs/​README.plugins.md	Refreshes the generated plugin catalog description.
.github/​plugin/​marketplace.json	Synchronizes the marketplace version and description.

_{Review effort: Max}

[Copilot]

🔵 Needs a closer look

Maintainer verification of the upstream-built extension artifacts is still needed before publishing the release.

1 open issue

• Update opened panel titles to GitHub Security · New

1 resolved since last review

• Update extension manifest version to 0.2.1

_{Review effort: Max}

[Copilot]

🟢 Approval recommended

Release versions match, the runtime edit only changes a display label, and the remaining suggestions are optional.

1 open issue

• Remove duplicate screenshot asset from plugin · New

1 resolved since last review

• Update opened panel titles to GitHub Security

_{Review effort: Max}

[jchuerva]

We want to have different images and avoid reusing assets/preview.png, with unique images for different purposes.