github-copilot-repo-instructions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-copilot-repo-instructions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Repository-scoped Copilot guidance. Markdown files in .github/ that GitHub Copilot reads on every request against the repo.
Generic, doc-faithful. For an opinionated generator that bakes in specific engineering principles, see thesetupmode of/copilot—/copilot setup(if installed).
>
For the multi-mode Copilot driver (review / delegate / setup), see /copilot (if installed) — this skill only writes and audits the instruction files.| File | Scope | Frontmatter | Notes |
|---|---|---|---|
.github/copilot-instructions.md | Repo-wide, every request | None | Single file. Keep ≤ 2 pages. |
.github/instructions/<name>.instructions.md | Path-glob | Required (applyTo) | Multiple files allowed. Filename must end .instructions.md. |
AGENTS.md | Nearest-wins | None | Place anywhere in the tree; the file closest to the edited path wins. |
CLAUDE.md | Repo root only | None | Single file at root. |
GEMINI.md | Repo root only | None | Single file at root. |
The repo-wide file and path-specific files combine when a path matches — both sets of instructions are sent to Copilot together.
---
applyTo: "**/*.ts, **/*.tsx"
excludeAgent: "code-review"
---
- Prefer `interface` over `type` for object shapes.
- Use named exports.| Field | Required | Values |
|---|---|---|
applyTo | Yes | Glob pattern, or comma-separated globs (*.py, src/**/*.rb, **/subdir/**/*.py). |
excludeAgent | No | "code-review" or "cloud-agent" — hides this file from that surface. |
Copilot reads repo instructions across these surfaces:
github.com/copilot (with repo attached) and IDE chat.base branch, not the feature branch.
Path-specific files (.github/instructions/*.instructions.md) are fully supported on github.com for code-review and the cloud agent. IDE support for path-specific files lags — repo-wide file is the safer bet for IDE coverage.
When multiple instruction sets exist, all are merged and sent to Copilot. Stated priority order (highest → lowest):
Conflicts are not auto-resolved — Copilot sees them all. If quality drops, temporarily disable a set rather than fighting overlap.
mkdir -p .github.github/copilot-instructions.md. Markdown only, no frontmatter.non-obvious conventions. Skip generic advice Copilot already knows.
main) — code review reads from base.mkdir -p .github/instructions<name>.instructions.md with applyTo frontmatter.python.instructions.md, frontend.instructions.md).excludeAgent to keep review-only or coding-agent-only guidance fromleaking into the other surface.
Repo Settings → Code & automation → Copilot → Code review → toggle "Use custom instructions when reviewing pull requests".
Default is enabled, but confirm — orgs sometimes flip it off.
Two paths — pick one. Both create a branch ruleset; the API path is scriptable.
UI — Settings → Rules → Rulesets → New branch ruleset. Under "Branch rules", select Automatically request Copilot code review. Two sub-toggles: Review new pushes (re-review on each push, burns premium requests) and Review draft pull requests.
API (gh) — the rule type is copilot_code_review. It is not listed on the rulesets schema page as of writing, but the endpoint accepts it. Targets work like any other ruleset.
gh api repos/<owner>/<repo>/rulesets -X POST --input - <<'JSON'
{
"name": "copilot-auto-review",
"target": "branch",
"enforcement": "active",
"conditions": { "ref_name": { "include": ["~DEFAULT_BRANCH"], "exclude": [] } },
"rules": [
{
"type": "copilot_code_review",
"parameters": {
"review_on_push": false,
"review_draft_pull_requests": false
}
}
]
}
JSONDefaults shown are conservative: review once on PR open, skip drafts. Flip review_on_push to true to re-review on every push — useful for agentic workflows, expensive on premium-request quota.
Requires Copilot Business/Enterprise on the org, or Copilot Pro for personal repos. The ruleset still installs without a license; reviews just don't fire.
For the full knob inventory across repo / org / per-PR — including what Copilot review cannot do (no "request changes" mode, no severity threshold, no API re-request) — read references/code-review-knobs.md.
github.com/copilot and attach the repo..github/copilot-instructions.md should appear; click to confirm it's theversion you expect. Path-specific files appear when relevant paths are mentioned or attached.
For PR review verification, look at the review comment metadata or trigger a review on a PR that touches a glob covered by a path-specific file.
When the user says "audit our Copilot config":
ls -la .github/copilot-instructions.md .github/instructions/ AGENTS.md CLAUDE.md GEMINI.md 2>/dev/null (silence missing files).applyTo frontmatter..instructions.md (path-specific only).excludeAgent values are exactly "code-review" or "cloud-agent".(e.g. "always add type hints" — that's Python-only, hoist it).
git log — recent edits to instructions on afeature branch won't be seen by code review until merged.
.github/copilot-instructions.md. Don't add applyTo there.
applyTo the fileis ignored.
refactor Y") — they're long-lived configuration, not ticket scope.
Conventional Commits", don't repeat it at repo level.
affect that PR's own review.
of the repo — anyone with read access sees them.
Validate frontmatter before committing.
**/ to cover nestedpaths (**/*.py covers nested files; *.py may only cover the root, depending on the glob engine).
AGENTS.md is recursive — a deeply nested AGENTS.md overrides a higherone for files near it. Useful, but confusing if the user expects merging.
CLAUDE.md and GEMINI.md are also read by Copilot now, even though theyoriginated as other-vendor files. If you maintain both, expect Copilot to see all three.
user on github.com Chat — symptoms look like "Copilot ignores our rules for Alice but works for everyone else". Check /github-copilot-personal-instructions.
that as the ceiling — long instructions crowd out the actual question.
/copilot setup (if installed) — that mode of the /copilotdriver bakes in a specific style.
/github-copilot-personal-instructions.org settings, outside any repo.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.