* Migrate extension plugin materialization layout
Materialize extension plugins into a dedicated extensions/ container, validate the new manifest convention, and bump extension plugin versions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Keep extension manifests source-compatible
Restore source extension manifests to "extensions": "." while preserving materialization-time rewrite to "extensions" in distribution output.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Validate canvas extension layout for external submissions
Add intake and quality-gate checks for canvas-tagged external plugins so they must include extensions/extension.mjs and optional manifest extensions is validated when present.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Fix plugin clean extension pass and typo guard text
Declare EXTENSIONS_DIR in clean-materialized-plugins and run extension cleanup once after plugin cleanup. Also normalize misspelled-key detection strings to satisfy spelling checks without changing validation behavior.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Proper codespell fix
* Separate canvas structure quality gate status
Track canvas structure as its own gate status and output, include it in aggregate summaries, and enforce Git object types so extensions/ is a tree and extensions/extension.mjs is a blob.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: standardize agent documentation markdown, fix formatting, add MANDATORY clauses, and update output formats across agents
* chore: Update gem-team plugin version to 1.84.0 and refine concurrency language in agent execution steps
Adds an agentic (gh-aw) workflow that mirrors the multi-harness workshop
from github-samples/copilot-workshops into the Learning Hub, plus the
Starlight infrastructure it needs: GitHub-admonition rendering, i18n
locales with English at the site root, and a language picker that only
appears when a page has a non-English translation.
Copilot-Session: 9e1d1a4c-a422-4cae-8ea7-b3d5171f58e3
Co-authored-by: GeekTrainer <GeekTrainer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Removing some features from the home page of the website
hooks, agentic workflows, and tools are removed - these are minimally used parts of the website
* Removing the pages and their references
* removing from the readme
* Adding the awesome copilot MCP server to our plugin and showing that in the rendered page
* Fix broken docs links and MCP plugin docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4215785a-7e6e-49c5-abaa-c39b0793a11e
* Add external plugin version-match gate
Enforce external.json version matching against remote plugin.json for source ref and/or sha in shared quality gates, and surface the new gate status/output in intake and PR workflows.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8aa3e98d-1873-4cab-8866-1b2efd0f24ad
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add convert-excel-to-md, convert-pdf-to-md, and convert-word-to-md skills
Add three new agent skills that convert common document formats to Markdown
using bundled Python scripts powered by MarkItDown:
- convert-excel-to-md: Converts .xlsx workbooks to Markdown with per-sheet
tables and embedded image extraction via a bundled Python script.
- convert-pdf-to-md: Converts .pdf documents to Markdown with text/table
extraction and embedded image extraction via PyMuPDF.
- convert-word-to-md: Converts .docx documents to Markdown with proper
image extraction replacing MarkItDown's base64 placeholders.
Each skill includes:
- SKILL.md with detailed usage instructions, output structure docs, and
a troubleshooting table
- scripts/ with the conversion Python script and requirements.txt
- references/setup.md with environment setup instructions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: remove Markdown image syntax from convert-word-to-md SKILL.md
The CI valid-refs linter flagged the literal Markdown image syntax
containing a data URI as an invalid file reference. Replaced it with
a plain text description of the placeholder format.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: update pip install command to use scripts/requirements.txt for setup
* fix: clarify installation instructions for requirements-file in setup documentation
* fix: correct indentation in image extraction function
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add comprehensive documentation and setup instructions for convert-to-md skills
* fix: add trailing slashes to skill paths in plugin.json
* fix: reorder skills in plugin.json for consistency
* fix: update plugin.json and README.md for clarity and consistency
* feat: add convert-to-md plugin and update related documentation
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: enhance conversion skills to handle mixed file types and improve error handling
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Add a skill covering Helidon SE and MP patterns, Helidon 3 to 4 API migration guidance, and examples for HTTP, service, data, testing, security and observability in Java 21+ projects.
* Add tm7-threat-model skill for valid TM7 file generation
Adds a skill that generates valid Microsoft Threat Modeling Tool (.tm7)
files using the correct WCF DataContractSerializer format, with a minimal
reference file. Includes STRIDE threat generation workflow and a checklist
of common serialization mistakes that corrupt .tm7 files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: sanitize reference model, fix dangling refs, move to assets
- Move example-minimal.tm7 into assets/ per repo convention (aaronpowell).
- Remove personal/corporate metadata from the reference model (Owner,
Contributors, ChangedBy domain account, project names).
- Make the reference model self-contained: add a second stencil so the data
flow and threat SourceGuid/TargetGuid/FlowGuid all resolve to real elements.
- Fix SKILL.md threat contract (KeyValueOfstringThreatpc_P0_PhOB with
b:-prefixed KnowledgeBase fields) to match the bundled reference.
- Reconcile guidance: MetaInformation/Notes/KnowledgeBase are valid schema
elements and must be preserved; only SecurityGaps/Mitigations are invalid.
- Regenerate docs/README.skills.md and normalize line endings to LF.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address 2nd review: correct KnowledgeBase placement, valid TypeIds, z:Id uniqueness
- Document KnowledgeBase as a top-level sibling after ThreatMetaData (not embedded)
- Update skeleton to show <ThreatMetaData/>, sibling <KnowledgeBase>, and <Profile>
- Replace TypeIds absent from the bundled KB: AzureCosmosDB -> AzureSQLDB,
HumanUser -> Mobile, GenericDataFlow -> Request
- Require z:Id uniqueness across the file in the common-mistakes checklist
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci: exclude *.tm7 exports from codespell
MTM DataContract .tm7 exports embed base64 icon blobs whose substrings
(oT, bu, wth, mKe, ...) trigger codespell false positives. Skip *.tm7,
matching the existing convention for binary/asset files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: prasad <prasaddharaskar@gmail.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* sync: update cli-for-beginners ch04 and ch06 from upstream
- Chapter 04: Add @-style imports section under Custom Instruction Files
(released in v1.0.66, 2026-06-30). Users can now reference other files
inside AGENTS.md or instruction files with @filepath syntax.
- Chapter 06: Add /mcp list to the Additional MCP Commands reference table.
Released in v1.0.69-1 (2026-07-04), /mcp list shows currently attached MCP
servers and can be run while Copilot is working. Also add /mcp auth command
and update enable/disable descriptions to note session persistence.
- Bump lastUpdated to 2026-07-10 in both files.
Upstream commits: c559ab4953a0 (2026-07-09)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: revert ch04 content changes, keep only date update
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
* Apply suggestion from @aaronpowell
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
font.getbbox() returns (left, top, right, bottom), so text line height must
be bottom - top (bbox[3] - bbox[1]). The label placement code used
bbox[3] - bbox[0] (bottom - left), mixing an x-coordinate into a height and
producing a slightly wrong label-box height (empirically off by 0-4px
depending on font). The debug heatmap labeling in the same module already
uses the correct bbox[3] - bbox[1], so this brings placement in line.
Port the app workspace and runtime session inventory fixes from the personal James Hub canvas into the generic Work Hub extension. This lets the cleanup and recent-session surfaces read current app workspaces before falling back to the legacy session store.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add APNG Studio canvas extension
APNG Studio is an interactive GitHub Copilot canvas extension for building
Animated PNG (APNG) files from frames: draw or upload frames, tune per-frame
timing and compositing, preview live, send the result to a phone by QR, and
export an animated .png.
Adds extensions/apng-studio/ with the required .github/plugin/plugin.json and
assets/preview.png, and regenerates .github/plugin/marketplace.json.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback for APNG Studio
Security and robustness (extension.mjs):
- Reject "." and ".." project ids so canvas/action input cannot resolve
outside artifacts/.
- Bound request bodies (1 MiB JSON, 40 MiB frame upload); return 413 when
exceeded.
- Reject malformed JSON with 400 instead of coercing to {}, so a truncated
body cannot trigger destructive routes such as /frames/clear.
- Scope shares per project so one canvas cannot rotate or stop another's
share; the LAN server is shared and torn down once no shares remain.
- get_state treats hiddenFirst as active only with >=2 frames, matching the
encoder, so a single-frame project reports the correct duration.
Accessibility (web/):
- Expose Pen/Eraser state with aria-pressed and keep it in sync in setTool.
- Mark the toast as an aria-live status region.
Packaging:
- Add extensions/apng-studio/.gitignore with artifacts/ so the documented
runtime-data exclusion holds for this extension.
- Update the README install section to reference the committed awesome-copilot
extension path.
Regenerated .github/plugin/marketplace.json.
* Use "GitHub Copilot app" wording
Update the plugin description (and regenerated marketplace entry) to refer to
the host as the GitHub Copilot app.
* Address deeper review for APNG Studio
Security:
- Require a per-server access token on every loopback data/mutation request
(minted per canvas server, carried in the iframe URL, attached to every
renderer request). Static assets stay public. Blocks a local process or
cross-origin page from reading state or driving mutations.
Concurrency and durability:
- Serialize the load-mutate-save cycle per project; dedupe concurrent first
loads; write project.json via temp file + rename.
Lifecycle:
- Track SSE clients per instance and end them before server.close().
- Stop a project's LAN share only when no other panel references it.
Correctness:
- Report exact numerator/denominator total duration; handle pointercancel.
QR and accessibility:
- Place QR version bits least-significant-bit first (versions 7-10).
- Associate delay/fps/dispose/blend labels with their inputs via for=.
* Address deeper concurrency and validation review for APNG Studio
- Run assemble() under the project lock; add_color_frame renders and appends
within one lock.
- Validate uploaded frames (PNG chunk scan, size + dimension checks) before
writing; first frame stores real dimensions; CanvasError maps to 400.
- Validate move delta; clear frames in memory before deleting files.
- Route the open-handler rename through applySettings.
- Deduplicate LAN share startup; clean up if the canvas closes mid-start.
- End SSE streams before server.close(); skip dead streams in broadcast.
- Exact fractional duration; drawing surface stays >= 1px; refresh state before
re-seeding "start from last frame".
* Address review: PNG format validation, share bind, limits, a11y
- Validate uploaded frames are 8-bit RGBA non-interlaced PNGs (standard
compression/filter); reject formats the codec can't encode.
- Cap projects at 600 frames (add + duplicate).
- Bind the LAN share server to the private address, not 0.0.0.0; require a
private address and rebind when it changes while idle; build the URL from the
bound address.
- Align width/height inputs and clampSize to the 2048 maximum.
- Size the drawing surface by width + aspect ratio for narrow panels.
- set_frame with an unknown frameId returns a validation error.
* Address review: encoded-byte budget, timing modes, id keys, load errors
- 256 MiB aggregate encoded-byte budget (add + duplicate); per-frame size
tracked and backfilled on load, so a frame count alone no longer bounds
assembly memory.
- Frame timing is one exclusive mode (delayMs | fps | delayNum/delayDen);
combinations are rejected instead of producing hybrid delays.
- Collision-resistant project storage keys: safe ids are used verbatim (existing
projects still load) and only unsafe ids get a hash suffix, so "foo/bar" and
"foo?bar" can't share a directory.
- Load only treats a missing file as a new project; other read/parse errors
surface instead of silently overwriting real data.
- Share server binds to a real LAN interface (skips virtual/VPN/container,
prefers physical NICs and common ranges).
- Generated export names get millisecond + random suffix to avoid same-second
overwrite.
- PNG validator accepts the encoder's Uint8Array so agent solid-color frames
aren't rejected.
* Address review: crash-safe frame writes, server startup, APNG first frame
- Write the PNG before mutating project metadata on add/duplicate, and delete
after persisting, so an interrupted disk op can't dangle a reference or
advance unsaved state.
- Evict a project from the in-memory cache if its save fails, so a transient
write error can't desync the live session from disk.
- Reject on the loopback server's listen error and drop a half-initialized
instance so startup failures clean up and can retry.
- Normalize APNG dispose_op PREVIOUS to BACKGROUND on the first animated frame
(spec requirement).
- Release decoded ImageBitmaps after use so a large upload batch doesn't retain
native image memory.
- Surface otherwise-silent async UI failures via a toast; check the state
response is ok before parsing it.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Augustin Popa
Augustin Popa
Aaron Powell
Xiaoyun Ding
Tim Mulholland
Fenqin Zhou
qinezh
Muhammad Ubaid Raza
tomshafir-sonarsource
Christopher Harrison
github-actions[bot]
Anton Standrik
Copilot
Ari LiVigni ContinuousG33k
Alex Yang [MSFT]
Willie Yao
Suren K
allcontributors[bot]
prasadgd9022
Akash Dwivedi
Paul Delannoy
Artur Spychaj
James Montemagno
Gijs Reijn
Andrea Liliana Griffiths