Christopher Harrison
cb87dae678
* Seed Copilot Workshops Learning Hub mirror Perform the initial import of github-samples/copilot-workshops (@b543d2f) into the Learning Hub, since a first-run import from the scheduled sync workflow exceeds the 100-file safe-output PR cap. Also update the sync workflow prompt so future runs are always incremental and stay under the file cap. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Stop codespell flagging mirrored workshop content codespell only knows English, so the localized Learning Hub mirrors (es-es, ja-jp, ko-kr, pt-br, zh-cn) produce ~150 false positives such as "comando ==> commando". Skip those locale directories, and allow the two valid English words the mirrored pages use verbatim. Mirrored pages must stay source-faithful, so the fix belongs in .codespellrc rather than in the content. Note that in the sync workflow so future runs handle new false positives the same way. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Awesome GitHub Copilot website
Astro + Starlight site published to https://awesome-copilot.github.com/.
Local development
Run these from the repository root (they generate the data the site needs first):
npm run website:data # generate public/data/*.json from repo content
npm run website:dev # generate data + start the dev server
npm run website:build # full production build
Accessibility
The website has an automated axe-core + Playwright audit. Run it locally with npm run website:a11y from the repository root, or run npm run a11y from website/ after building dist first.
CI blocks on critical and serious violations. Minor and moderate best-practice issues are reported as non-blocking.
Authoring conventions: resource cards use div[role="listitem"] wrappers, not <article>; only add role="list" to containers whose direct children are list items; do not nest interactive controls inside another focusable element; .btn-primary and ToC links must meet WCAG AA (4.5:1) contrast in both light and dark themes.
Security hardening notes
- The site ships with a baseline meta CSP and
referrerpolicy insrc/components/Head.astro. - Because the site is hosted on GitHub Pages, response headers are not controllable in-repo. For stricter enforcement (for example, header-based CSP with nonce/hashes), place the site behind infrastructure that can set HTTP security headers.
- Markdown rendered for detail/file-browser experiences is sanitized with the shared
sanitizeHtml()helper before insertion.
Social preview cards (LinkedIn, etc.)
Shared links render as large preview cards driven by Open Graph / Twitter meta tags.
LinkedIn (and most platforms) read Open Graph — primarily og:image — while Twitter/X
also uses twitter:card=summary_large_image. Most tags are produced automatically:
- Starlight defaults emit
og:title,og:description,og:url,og:type,og:site_name, andtwitter:card=summary_large_image. astro.config.mjs(globalhead) emits the shared image tags:og:image,og:image:width,og:image:height,og:image:alt, andtwitter:image.src/components/Head.astroaddstwitter:title/description,og:image:secure_url,og:image:type, andtwitter:image:alt.
Each page's title and description (StarlightPage frontmatter) flow into the card text,
so keep them clear and benefit-focused.
The image-dimension invariant
og:image:width / og:image:height in astro.config.mjs describe public/images/social-image.png
(currently 2400×1260, ~1.91:1). Crawlers use these dimensions to understand the image and
may use them when selecting/rendering the preview. If you swap the image or add a per-page image
override, update the full image set so every tag stays consistent: og:image,
og:image:width, og:image:height, og:image:alt, and twitter:image (the last one matters
because Head.astro derives og:image:secure_url from twitter:image first).
After deploying
LinkedIn caches scrapes aggressively. To force a refresh and confirm the card renders, run the
changed URL through the LinkedIn Post Inspector.
HTML output alone doesn't prove the live card — verify the deployed image returns HTTP 200 over
HTTPS with Content-Type: image/png and no auth.