From 34ed3e2c5785d6ca78ee32dffda54df60ce8634a Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Fri, 19 Jun 2026 10:10:47 +0100 Subject: [PATCH 1/5] ci: add copilot review config and limit reviews to PR open only - Add .github/copilot-code-review.yml with project-specific instructions: skip linter-overlap issues, generated code, vendored code, and style nits. Focus reviews on logic errors, concurrency, security, and K8s API correctness. - Add workflow to request Copilot review only on PR open (not on every push). Manual re-request still available via GitHub UI. - Requires disabling automatic Copilot reviews in repo settings. Signed-off-by: Fiachra Corcoran --- .github/copilot-code-review.yml | 67 +++++++++++++++++++++++++++ .github/workflows/copilot-review.yaml | 52 +++++++++++++++++++++ 2 files changed, 119 insertions(+) create mode 100644 .github/copilot-code-review.yml create mode 100644 .github/workflows/copilot-review.yaml diff --git a/.github/copilot-code-review.yml b/.github/copilot-code-review.yml new file mode 100644 index 000000000..ec6c627e9 --- /dev/null +++ b/.github/copilot-code-review.yml @@ -0,0 +1,67 @@ +# Copyright 2026 The kpt Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Copilot code review configuration for Porch +# Porch is a Kubernetes package orchestration system using controller-runtime. + +review: + instructions: + # Linter overlap — these are already enforced by golangci-lint in CI + - "Do not comment on issues caught by: errcheck, govet, ineffassign, staticcheck, unused, nosprintfhostport, gofmt" + - "Do not comment on import ordering or formatting" + - "Do not flag SA1019 deprecation warnings on client.Apply — this is intentionally suppressed" + + # Style — established project conventions, not up for debate + - "Do not comment on error wrapping style (this project uses fmt.Errorf with %w consistently)" + - "Do not suggest renaming variables, functions, or packages" + - "Do not suggest extracting single-use helper functions" + - "Do not suggest adding comments to exported symbols unless the function is non-obvious" + + # Architecture context + - "This project uses Kubernetes controller-runtime with Server-Side Apply (SSA)" + - "Controllers use distinct field managers and ForceOwnership — do not flag this as a concern" + - "Reconcile functions returning (*ctrl.Result, error) where nil result means continue is an intentional pattern" + - "Errors intentionally not returned to controller-runtime (returned as nil) is a deliberate choice to avoid requeue backoff — do not flag this" + - "log.FromContext(ctx) with V-levels is the logging convention — do not suggest alternatives" + + # What to actually review + - "Focus on: logic errors, race conditions, resource leaks, deadlocks, nil pointer dereferences" + - "Flag: missing context cancellation checks, unbounded goroutines, missing error handling in deferred Close calls" + - "Flag: incorrect SSA field manager usage, writing fields owned by another controller" + - "Flag: security issues (credential leaks, injection, TOCTOU)" + - "Flag: incorrect Kubernetes API usage (wrong GVK, missing RBAC, broken owner references)" + + path_instructions: + - path: "api/generated/**" + instructions: "Do not review — generated by k8s code-generator" + - path: "**/zz_generated*" + instructions: "Do not review — generated by controller-tools" + - path: "test/mockery/mocks/**" + instructions: "Do not review — generated by mockery" + - path: "third_party/**" + instructions: "Do not review — vendored upstream code" + - path: "go.sum" + instructions: "Do not review" + - path: "go.mod" + instructions: "Only flag if a dependency looks suspicious or has a known CVE" + - path: "docs/**" + instructions: "Only flag factual errors or broken links. Do not comment on grammar or style" + - path: "**/*_test.go" + instructions: "Focus on correctness, flakiness risks, and missing edge case coverage. Do not suggest style changes. testify (assert/require/mock) and Ginkgo/Gomega are the test frameworks" + - path: "test/e2e/**" + instructions: "Focus on test reliability and resource cleanup. Do not suggest refactoring test helpers" + - path: ".github/**" + instructions: "Focus on security (pinned actions, minimal permissions, injection risks). Do not suggest cosmetic changes" + - path: "deployments/**" + instructions: "Focus on correctness of RBAC, resource limits, and security context. Do not comment on YAML style" diff --git a/.github/workflows/copilot-review.yaml b/.github/workflows/copilot-review.yaml new file mode 100644 index 000000000..0c8e8daf9 --- /dev/null +++ b/.github/workflows/copilot-review.yaml @@ -0,0 +1,52 @@ +# Copyright 2026 The kpt Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Request Copilot review once when a PR is opened. +# Further reviews can be requested manually via the GitHub UI. +# +# Prerequisite: Disable automatic Copilot code review in repo settings +# (Settings → Copilot → Code review → Disable automatic reviews) + +name: Copilot Code Review + +on: + pull_request: + types: [opened] + +permissions: {} + +jobs: + request-copilot-review: + runs-on: ubuntu-latest + permissions: + pull-requests: write + steps: + - name: Request Copilot review + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + with: + script: | + const prNumber = context.payload.pull_request.number; + core.info(`Requesting Copilot review for PR #${prNumber}`); + + try { + await github.rest.pulls.requestReviewers({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: prNumber, + reviewers: ['copilot-pull-request-reviewer[bot]'], + }); + core.info(`✅ Copilot review requested for PR #${prNumber}`); + } catch (error) { + core.warning(`Could not request Copilot review: ${error.message}`); + } From eabb9465999f71bcf8810bf6678a479b401707d4 Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Fri, 19 Jun 2026 11:29:20 +0100 Subject: [PATCH 2/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Fiachra Corcoran --- .github/copilot-code-review.yml | 2 ++ .github/workflows/copilot-review.yaml | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/copilot-code-review.yml b/.github/copilot-code-review.yml index ec6c627e9..4f7c85b12 100644 --- a/.github/copilot-code-review.yml +++ b/.github/copilot-code-review.yml @@ -65,3 +65,5 @@ review: instructions: "Focus on security (pinned actions, minimal permissions, injection risks). Do not suggest cosmetic changes" - path: "deployments/**" instructions: "Focus on correctness of RBAC, resource limits, and security context. Do not comment on YAML style" + - path: "examples/**" + instructions: "Do not review — tutorial/example configs excluded from CI linting" diff --git a/.github/workflows/copilot-review.yaml b/.github/workflows/copilot-review.yaml index 0c8e8daf9..9bd36a7ba 100644 --- a/.github/workflows/copilot-review.yaml +++ b/.github/workflows/copilot-review.yaml @@ -22,12 +22,13 @@ name: Copilot Code Review on: pull_request: - types: [opened] + types: [opened, ready_for_review, reopened] permissions: {} jobs: request-copilot-review: + if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name runs-on: ubuntu-latest permissions: pull-requests: write From ec34ebc3e2a344df340990d8c09d24b1be3372bf Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Mon, 22 Jun 2026 15:08:46 +0100 Subject: [PATCH 3/5] Address review comments Signed-off-by: Fiachra Corcoran --- .github/copilot-code-review.yml | 2 +- .github/workflows/copilot-review.yaml | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/copilot-code-review.yml b/.github/copilot-code-review.yml index 4f7c85b12..f36538ff0 100644 --- a/.github/copilot-code-review.yml +++ b/.github/copilot-code-review.yml @@ -58,7 +58,7 @@ review: - path: "docs/**" instructions: "Only flag factual errors or broken links. Do not comment on grammar or style" - path: "**/*_test.go" - instructions: "Focus on correctness, flakiness risks, and missing edge case coverage. Do not suggest style changes. testify (assert/require/mock) and Ginkgo/Gomega are the test frameworks" + instructions: "Focus on correctness, flakiness risks, and missing edge case coverage. Do not suggest style changes. testify (assert/require/mock) and Ginkgo/Gomega are the test frameworks. Suggest using testify assertions or Ginkgo/Gomega matchers instead of raw t.Errorf/t.Fatalf" - path: "test/e2e/**" instructions: "Focus on test reliability and resource cleanup. Do not suggest refactoring test helpers" - path: ".github/**" diff --git a/.github/workflows/copilot-review.yaml b/.github/workflows/copilot-review.yaml index 9bd36a7ba..56fcd0487 100644 --- a/.github/workflows/copilot-review.yaml +++ b/.github/workflows/copilot-review.yaml @@ -49,5 +49,9 @@ jobs: }); core.info(`✅ Copilot review requested for PR #${prNumber}`); } catch (error) { - core.warning(`Could not request Copilot review: ${error.message}`); + if (error.status === 422) { + core.info(`Copilot review already requested or cannot be requested: ${error.message}`); + } else { + core.warning(`Could not request Copilot review: ${error.message}`); + } } From 94c909f76307f5f4dfaeae4d904dbc569a026e96 Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Mon, 22 Jun 2026 15:38:55 +0100 Subject: [PATCH 4/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Fiachra Corcoran --- .github/copilot-code-review.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/copilot-code-review.yml b/.github/copilot-code-review.yml index f36538ff0..faab45ea5 100644 --- a/.github/copilot-code-review.yml +++ b/.github/copilot-code-review.yml @@ -61,6 +61,8 @@ review: instructions: "Focus on correctness, flakiness risks, and missing edge case coverage. Do not suggest style changes. testify (assert/require/mock) and Ginkgo/Gomega are the test frameworks. Suggest using testify assertions or Ginkgo/Gomega matchers instead of raw t.Errorf/t.Fatalf" - path: "test/e2e/**" instructions: "Focus on test reliability and resource cleanup. Do not suggest refactoring test helpers" + - path: "test/**" + instructions: "Only flag correctness/security issues; avoid style/linter-overlap feedback. Note: golangci-lint excludes test/ from CI linting." - path: ".github/**" instructions: "Focus on security (pinned actions, minimal permissions, injection risks). Do not suggest cosmetic changes" - path: "deployments/**" From c27cd7bbf50f2c0e886cda956a0459c81cd672e8 Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Mon, 22 Jun 2026 19:04:30 +0100 Subject: [PATCH 5/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Fiachra Corcoran --- .github/workflows/copilot-review.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/copilot-review.yaml b/.github/workflows/copilot-review.yaml index 56fcd0487..ee3cbaf47 100644 --- a/.github/workflows/copilot-review.yaml +++ b/.github/workflows/copilot-review.yaml @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Request Copilot review once when a PR is opened. +# Request Copilot review when a PR is opened, reopened, or marked ready for review (non-draft). # Further reviews can be requested manually via the GitHub UI. # # Prerequisite: Disable automatic Copilot code review in repo settings