caddis-plugin: Instructions file for GitHub Copilot

Code Review Guidelines

Structured approach to code review ensuring quality, security, and maintainability.

Review Principles

1. Be specific - Reference exact lines, files, and provide concrete examples
2. Provide context - Explain WHY something is an issue and the potential impact
3. Suggest solutions - Show corrected code, not just what's wrong
4. Be constructive - Focus on improving the code, not criticizing the author
5. Recognize good practices - Acknowledge well-written code and smart solutions
6. Be pragmatic - Not every suggestion needs immediate implementation

---

Review Priority (High to Low)

1. Security - Vulnerabilities, data exposure, injection risks
2. Correctness - Logic errors, edge cases, error handling, breaking changes
3. Performance - Inefficiencies, N+1 queries, memory leaks, resource cleanup
4. Maintainability - Readability, structure, documentation
5. Style - Formatting, naming, conventions

---

Security Checklist

Critical (Must Fix Before Merge)

• No hardcoded secrets, passwords, or API keys
• All SQL queries use parameterized queries
• User input is validated and sanitized
• Authentication required on protected endpoints
• Authorization checks for resource access
• No sensitive data logged (passwords, tokens, PII)
• Error messages don't expose system internals

Example Findings

# ❌ CRITICAL: SQL Injection
query = f"SELECT * FROM users WHERE id = '{user_id}'"

# ✅ FIXED: Parameterized query
query = "SELECT * FROM users WHERE id = ?"
result = adapter.fetch_dataframe(query, (user_id,))

---

Correctness Checklist

Error Handling

• All external calls wrapped in try/except
• Appropriate exception types caught (not bare except:)
• Error states handled gracefully
• Cleanup code in finally blocks where needed

# ❌ BAD: Bare except
try:
    result = fetch_data()
except:
    pass  # Silent failure

# ✅ GOOD: Specific handling
try:
    result = fetch_data()
except ConnectionError as e:
    logger.error(f"Database connection failed: {e}")
    raise DataFetchError("Unable to fetch data") from e