chore(copilot): add code-review agent skill - #1876
Merged
Merged
Conversation
GitHub Copilot code review reads agent skills from .github/skills, but this repository had none, so its pull request reviews ran without any of the project's conventions: the JUnit 4 only rule, the WW-XXXX title format, and the framework's security-sensitive patterns. Add .github/skills/code-review/SKILL.md covering test conventions and the three vacuous-test traps, security-sensitive code paths, PR and commit hygiene, and Struts implementation patterns. The security section deliberately constrains what the reviewer may write: a pull request is public, so a comment naming a weakness or its impact would itself be a disclosure. It asks only for a neutral pointer to SECURITY.md and the private process.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Copilot code review picks up agent skills from
.github/skills, and is more likely to use one whose directory name signals it is meant for pull request review. This repository had no such directory, so Copilot has been reviewing Struts pull requests without any of our conventions.This adds
.github/skills/code-review/SKILL.md, covering:@Testadded to anXWorkTestCasesubclass silently never runs. Also the three traps that produce green tests asserting nothing: an unpushed action,ParametersInterceptor.requireAnnotationsdefaulting tofalsein a bare harness, and interned string literals defeating==marker checks.@StrutsParametergating, uploads, action name cleanup, deserialization, escaping.WW-XXXXtitle format and Jira link, and the documentation/build exception that uses conventional-commit form instead.ParameterNameAware,Struts*naming, no TODOs referencing unfiled tickets.The security section deliberately limits what the reviewer is allowed to write. A pull request is public, so a review comment that names a weakness, sketches how it is reached, or estimates its impact would itself be the disclosure that
SECURITY.mdexists to prevent. The skill asks for a neutral pointer toSECURITY.mdand the privatesecurity@struts.apache.orgprocess, and explicitly forbids describing the weakness, exploitability, severity, affected versions, or a matching CVE in the comment.No Jira ticket: this is a repository configuration change under
.github/, whichCLAUDE.mdexempts from theWW-XXXXrule.Copilot code review reads skills from the head branch, so its review of this pull request is also the test of the skill — the attribution line under its comments should name
code-review.