feat(workflow): add copilot-setup-steps.yml for Coding Agent environment by katriendg · Pull Request #398 · microsoft/hve-core

katriendg · 2026-02-03T12:25:14Z

Description

Adds copilot-setup-steps.yml workflow to bridge the devcontainer environment to GitHub Actions runners for Copilot Coding Agent. The workflow pre-installs Node.js 20, Python 3.11, and PowerShell modules to match local development capabilities, enabling agents to use the same npm scripts for validation in the cloud environment.

Created .github/workflows/copilot-setup-steps.yml with SHA-pinned actions for checkout, setup-node, and setup-python
Added tool verification step confirming availability of node, npm, python3, pwsh, and shellcheck
Updated .github/copilot-instructions.md with new "Coding Agent Environment" section documenting pre-installed tools and npm script usage
Applied minimal contents: read permissions following principle of least privilege

Related Issue(s)

Closes #388

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - only updated copilot-instructions.md for the cloud agent.

Testing

Workflow triggers on push/PR to its own path for validation
Tool verification step confirms all dependencies are available
npm scripts listed via npm run --list for agent reference

Checklist

Required Checks

Documentation is updated (if applicable) - This will be a follow-up PR to update documentation after workflow is merged and verified
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

Copilot instructions (.github/instructions/*.instructions.md)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

The workflow uses SHA-pinned actions for security:

actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v4.2.2)
actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 (v4.1.0)
actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f (v5.1.1)

The job is named copilot-setup-steps as required by GitHub Copilot documentation for automatic recognition.

Intentionally excluded or leveraged from runners:

gitleaks - Secret scanning runs in CI workflows via security-scan.yml, following the principle that security validation belongs in the pipeline, not the agent's editing environment. GitHub's push protection provides an additional layer of defense.
shellcheck - Pre-installed on ubuntu-latest runners (v0.9.0-1), no explicit installation needed.
Pester 5.7.1 - Pre-installed on GitHub-hosted runners, no explicit installation needed.

Create copilot-setup-steps.yml workflow to pre-install tools for GitHub Copilot Coding Agent, bridging the devcontainer environment to GitHub Actions runners. Workflow includes: - SHA-pinned actions (checkout, setup-node, setup-python) - Node.js 20 with npm ci for JavaScript dependencies - Python 3.11 - PowerShell modules (PowerShell-Yaml) Update copilot-instructions.md with Coding Agent Environment section documenting pre-installed tools and npm script usage.

github-actions · 2026-02-03T12:25:29Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/checkout

de0fac2e4500dabe0009e67214ff5f5447ce83dd

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 5	7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
SAST	🟢 8	SAST tool detected but not run on all commits

actions/actions/setup-node

6044e13b5dc448c55e2357c09f80417699197238

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 8	10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 9	binaries present in source code
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9
Vulnerabilities	🟢 4	6 existing vulnerabilities detected

actions/actions/setup-python

39cd14951b08e74b54015e9e001cdefcf80e669f

🟢 5

Details

Check	Score	Reason
Maintained	🟢 5	7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	⚠️ 0	10 existing vulnerabilities detected
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

Scanned Files

.github/workflows/copilot-setup-steps.yml

codecov-commenter · 2026-02-03T12:27:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.45%. Comparing base (de43e73) to head (3e47e11).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #398      +/-   ##
==========================================
- Coverage   61.49%   61.45%   -0.04%     
==========================================
  Files          17       17              
  Lines        3111     3111              
==========================================
- Hits         1913     1912       -1     
- Misses       1198     1199       +1

Flag	Coverage Δ
pester	`61.45% <ø> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR adds a GitHub Actions workflow to configure the environment for GitHub Copilot Coding Agent, ensuring tool parity with the local devcontainer. The workflow pre-installs Node.js 20, Python 3.11, PowerShell modules, and verifies tool availability to enable cloud-based agents to run the same validation scripts as local developers.

Changes:

Created .github/workflows/copilot-setup-steps.yml to pre-install development tools and dependencies for Copilot Coding Agent
Updated .github/copilot-instructions.md with new "Coding Agent Environment" section documenting pre-installed tools, npm script usage, and environment synchronization practices

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`.github/workflows/copilot-setup-steps.yml`	New workflow that sets up Node.js 20, Python 3.11, PowerShell modules, and verifies tool availability for Copilot Coding Agent with SHA-pinned actions
`.github/copilot-instructions.md`	Added documentation section describing the cloud agent environment, available tools, npm scripts for validation, and synchronization guidance

…md for clarity

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

.github/copilot-instructions.md

PR review comment Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

.github/workflows/copilot-setup-steps.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

WilliamBerryiii

LGTM

🤖 I have created a release *beep* *boop* --- ## [2.1.0](hve-core-v2.0.1...hve-core-v2.1.0) (2026-02-04) ### ✨ Features * add PowerShell script to validate copyright headers ([#370](#370)) ([92fce72](92fce72)) * **docs:** Replace deprecated chat.modeFilesLocations with chat.agentFilesLocations ([#413](#413)) ([67fb2ab](67fb2ab)) * **scripts:** add CIHelpers module for CI platform abstraction ([#348](#348)) ([23e7a7e](23e7a7e)) * **scripts:** add SecurityHelpers and CIHelpers modules ([#354](#354)) ([b93d990](b93d990)) * **workflow:** add copilot-setup-steps.yml for Coding Agent environment ([#398](#398)) ([085a38b](085a38b)) ### 🐛 Bug Fixes * **build:** increase release-please search depths to prevent 250-commit window issue ([#342](#342)) ([4bb857d](4bb857d)) * **build:** patch @isaacs/brace-expansion critical vulnerability ([#404](#404)) ([292ef51](292ef51)) * **ci:** disable errexit during spell check exit code capture ([#356](#356)) ([ed6ed46](ed6ed46)) * **ci:** exclude extension/README.md from frontmatter validation ([#362](#362)) ([e0d7378](e0d7378)) * exclude test fixtures from markdown link checker ([#345](#345)) ([58147f9](58147f9)) * **extension:** resolve path resolution issues in Windows/WSL environments ([#407](#407)) ([8529725](8529725)) * **linting:** use Write-Error instead of Write-Host for error output ([#377](#377)) ([2ca766b](2ca766b)) * **scripts:** apply CI output escaping to infrastructure scripts ([#369](#369)) ([251021e](251021e)) * **scripts:** apply CI output escaping to linting scripts ([#367](#367)) ([fdd75ed](fdd75ed)) * **scripts:** apply CI output escaping to security scripts ([#368](#368)) ([1237c9a](1237c9a)) * **scripts:** ensure reliable array count operations in linting and security scripts ([#395](#395)) ([de43e73](de43e73)) * **scripts:** standardize PowerShell requirements header block ([#385](#385)) ([6e26282](6e26282)) ### 📚 Documentation * add doc-ops agent to CUSTOM-AGENTS reference ([#358](#358)) ([15f7185](15f7185)) * add memory agent to CUSTOM-AGENTS.md ([#359](#359)) ([d92c4e1](d92c4e1)) * add missing agents to extension README ([#357](#357)) ([d58541c](d58541c)) * add task-reviewer agent to CUSTOM-AGENTS.md ([#363](#363)) ([0efb722](0efb722)) * **contributing:** add copyright header guidelines ([#382](#382)) ([881a567](881a567)) * **scripts:** update README.md with missing directory sections ([#355](#355)) ([ac2966f](ac2966f)) ### ♻️ Refactoring * **scripts:** align linting and tests with CIHelpers ([#401](#401)) ([3587e6a](3587e6a)) * **scripts:** extract Invoke-PackageExtension for testability ([#343](#343)) ([858a1be](858a1be)) * **scripts:** extract orchestration function for Prepare-Extension testability ([#344](#344)) ([9fd4bd1](9fd4bd1)) * **scripts:** replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension ([#391](#391)) ([74a30bb](74a30bb)) * **security:** move DependencyViolation and ComplianceReport to shared module ([#378](#378)) ([1dd31ad](1dd31ad)) ### 🔧 Maintenance * add copyright headers to PowerShell scripts ([#381](#381)) ([d19c9b3](d19c9b3)) * add copyright headers to shell scripts ([#380](#380)) ([284b456](284b456)) * **deps-dev:** bump cspell from 9.6.1 to 9.6.2 in the npm-dependencies group ([#387](#387)) ([23c2b9f](23c2b9f)) * **workflows:** simplify Copilot setup steps workflow triggers ([#414](#414)) ([492a7b1](492a7b1)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com> Co-authored-by: Bill Berry <wberry@microsoft.com>

katriendg requested a review from a team as a code owner February 3, 2026 12:25

Copilot AI review requested due to automatic review settings February 3, 2026 12:25

Copilot started reviewing on behalf of katriendg February 3, 2026 12:25 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

katriendg added 2 commits February 3, 2026 16:18

chore(instructions): add attribution note to copilot-instructions.md

a0542ca

style(instructions): update attribution note in copilot-instructions.…

e937165

…md for clarity

Copilot AI review requested due to automatic review settings February 3, 2026 15:59

Copilot started reviewing on behalf of katriendg February 3, 2026 15:59 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

.github/copilot-instructions.md Outdated Show resolved Hide resolved

.github/copilot-instructions.md Show resolved Hide resolved

Update .github/copilot-instructions.md

a8afb15

PR review comment Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 3, 2026 16:09

Copilot started reviewing on behalf of katriendg February 3, 2026 16:10 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

.github/workflows/copilot-setup-steps.yml Show resolved Hide resolved

.github/workflows/copilot-setup-steps.yml Show resolved Hide resolved

.github/workflows/copilot-setup-steps.yml Outdated Show resolved Hide resolved

chore: copilot PR suggestion

110033a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 3, 2026 16:20

Copilot started reviewing on behalf of katriendg February 3, 2026 16:20 View session

chore: add PSScriptAnalyzer module per PR review

47f31e1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Feb 3, 2026

View reviewed changes

nguyena2 approved these changes Feb 3, 2026

View reviewed changes

auyidi1 approved these changes Feb 3, 2026

View reviewed changes

WilliamBerryiii approved these changes Feb 3, 2026

View reviewed changes

Merge branch 'main' into feat/388-tool-parity-cloud-agent

3e47e11

WilliamBerryiii merged commit 085a38b into main Feb 3, 2026
17 checks passed

WilliamBerryiii deleted the feat/388-tool-parity-cloud-agent branch February 3, 2026 18:50

hve-core-release-please bot mentioned this pull request Feb 3, 2026

chore(main): release hve-core 2.1.0 #347

Merged

hve-core-release-please bot mentioned this pull request Feb 4, 2026

chore(main): release hve-core 3.0.0 #417

Closed

This was referenced Feb 6, 2026

chore(main): release hve-core 3.0.0 #441

Closed

chore(main): release hve-core 3.0.0 #530

Closed

chore(main): release hve-core 3.0.0 #532

Closed

chore(main): release hve-core 3.0.0 #534

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(workflow): add copilot-setup-steps.yml for Coding Agent environment#398

feat(workflow): add copilot-setup-steps.yml for Coding Agent environment#398
WilliamBerryiii merged 7 commits intomainfrom
feat/388-tool-parity-cloud-agent

katriendg commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Feb 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

WilliamBerryiii left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

katriendg commented Feb 3, 2026

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

codecov-commenter commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

WilliamBerryiii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions bot commented Feb 3, 2026 •

edited

Loading

codecov-commenter commented Feb 3, 2026 •

edited

Loading