cli: Instructions file for GitHub Copilot

Copilot review instructions

Repo-wide guidance for automated code review. Prioritize correctness and security over style. Be specific and actionable; cite the file and line.

GitHub Actions — credential & secret safety (review with extra scrutiny)

Workflows under .github/workflows/ can hold high-value credentials (GITHUB_TOKEN, NPM_TOKEN, OIDC identities, deploy keys). Treat any change to them as security-sensitive and flag the following:

• pull_request_target + PR-controlled code or secrets. Flag any pull_request_target (or workflow_run) workflow that checks out the PR head and then builds/tests it, or exposes secrets to it. A fork PR can then run its own code with the base repo's token. Prefer pull_request (forks get a read-only token and no secrets).
• Untrusted ${{ }} interpolated into run:. Flag any expression carrying attacker-controllable text — github.event.pull_request.title/.body, .head_commit.message, .head_ref/branch names, issue/comment/review bodies — substituted directly into a shell run: step. That is command injection. Require it be passed via env: and referenced as a quoted "$VAR", or handled in actions/github-script via process.env.
• Credentials exposed alongside untrusted content. Flag a job that holds a publish/deploy secret AND processes PR- or contributor-authored content (changeset text, PR bodies, uploaded artifacts). Prefer splitting into a credential-free job that handles untrusted content and a separate credentialed job that only runs reviewed, merged source.
• Over-broad or implicit permissions:. Prefer an explicit least-privilege permissions: block over relying on the repo/org default token scope, which varies by settings and may grant more than the job needs. Flag any grant not justified by the job — call out contents: write, id-token: write, packages: write, actions: write — and prefer setting permissions per job.
• Unpinned actions. In any workflow that touches secrets or OIDC, flag third-party actions pinned to a tag or branch (@v4, @main) instead of a full commit SHA.
• Lifecycle scripts under a live credential. Flag dependency installs that run lifecycle scripts (no --ignore-scripts) in a job that holds a publish token or OIDC identity — a malicious/compromised dependency could exfiltrate it. Prefer --ignore-scripts + an explicit, reviewed build step.
• Long-lived stored tokens. Where a registry supports it (e.g. npm trusted publishing), prefer short-lived OIDC over a stored NPM_TOKEN/PAT, and flag new long-lived secrets that could be replaced by OIDC.