presets.dev: Instructions file for GitHub Copilot

Django Copilot Instructions: ORM, Permissions and Migrations

Path-specific Copilot instructions for Django. They apply through applyTo and leave .github/copilot-instructions.md in place.

Updated for Django 6.1.3, Nov 2026

Do not upgrade dependencies or the framework version unless the task asks.

Project shape

An app owns its models, forms, and views. A view checks permission, validates input, and calls a function or a model method. Business rules do not pile up in the view. Settings come from environment-backed settings, not a new hardcoded secret.

Use the project's auth decorators or mixins. A class-based view and a function view follow the one the app already uses.

ORM

select_related and prefetch_related match the template or serializer that walks relations. A loop that queries per row is an N+1. Assert the query count in a test when the project already does that.

A queryset is filtered before it is evaluated. Do not list(Model.objects.all()) and filter in Python. QuerySet.update() is SQL. It does not call save() and it does not send signals. QuerySet.delete() does send pre_delete and post_delete, including for rows Django cascades in Python. It does not call your model's delete() method, so an override there does not run. A database ON DELETE CASCADE is separate: the database removes the row and Django does not send a signal for that child. If the override must run, iterate instances and call delete() on each.

Note.objects.filter(tenant=tenant).delete()  # signals fire, Note.delete() does not
for note in Note.objects.filter(tenant=tenant):
    note.delete()  # the override runs

Fetch modes in 6.1 are explicit. FETCH_RAISE is how you stop a lazy query you did not expect. Do not add it blindly to every relation. Read what the view actually touches.

Forms, auth, and migrations

A form or a serializer lists the fields it accepts. fields = "__all__" on a model form that faces the user is a review. Permission checks happen before the write, including for a custom action. Do not trust a user id in the POST body.