GitHub Copilot Skills · Agents · Instructions · MCP · Hooks · Plugins

# Project: E-Commerce Platform

## Stack
- Backend: ASP.NET Core 8, C# 12, EF Core 8
- Frontend: React 18, TypeScript 5, Tailwind CSS 3
- Database: PostgreSQL 16, Redis 7
- Cloud: Azure (App Service, Blob Storage, Service Bus)

## Code Style
- Use async/await throughout; never block threads
- Prefer records over classes for DTOs
- Use primary constructors (C# 12) for simple classes
- All public APIs must have XML doc comments
- No magic strings — use constants or enums

## Testing
- Use xUnit for unit tests, Playwright for E2E
- Test file mirrors source: `src/Foo.cs` → `tests/FooTests.cs`
- Mock external dependencies; never hit real APIs in unit tests

## Git
- Branch names: `feat/`, `fix/`, `chore/`, `docs/`
- Commit format: Conventional Commits (feat: add X)
- PRs require passing CI and one human approval

---
applyTo: "src/ui/**/*.{tsx,jsx}"
---

## React Component Standards
- Use functional components only; no class components
- Props interface must be named `{ComponentName}Props`
- Use `React.memo` for expensive pure components
- Prefer `useCallback` for event handlers passed to children
- All components must be exported as named exports
- Use Tailwind utility classes; no inline styles

# AGENTS.md — Guidance for AI Coding Agents

## Build & Test
- Build: `dotnet build ./src`
- Run tests: `dotnet test ./tests`
- Lint: `dotnet format --verify-no-changes`
- E2E: `npx playwright test` (requires running server on :5000)

## Important Rules
- Never commit secrets or connection strings
- Do not modify `*.lock` files manually
- Run `dotnet format` before creating any PR
- PRs must not decrease test coverage below 80%

## Architecture
- Domain logic lives in `src/Domain/`
- Never import Domain → Infrastructure (dependency rule)
- Use the MediatR pattern for all commands/queries

---
mode: 'agent'
description: 'Generate comprehensive xUnit tests for the selected code'
---

Analyze the selected code and generate comprehensive xUnit tests:

1. Cover all public methods and their edge cases
2. Use `[Theory]` + `[InlineData]` for parameterized tests
3. Mock all external dependencies using Moq
4. Follow Arrange-Act-Assert pattern
5. Test file should be placed in `tests/` mirroring `src/`
6. Include at least one test for the unhappy path (exceptions)

Reference our testing conventions from `.github/instructions/tests.instructions.md`.

---
description: 'Senior DBA: database design, query optimization, index strategy'
tools:
  - pgsql_connect
  - pgsql_query
  - github
---

You are a Senior Database Administrator specializing in PostgreSQL 16.
When reviewing queries: always check for missing indexes, N+1 problems,
and missing pagination. Use EXPLAIN ANALYZE when you have database access.
Prefer CTEs over subqueries for readability. Always consider connection
pooling and transaction scope.

# Via GitHub CLI (gh v2.90.0+)
gh skill install github/awesome-copilot <skill-name>

# Via Copilot CLI
copilot plugin install <plugin-name>@awesome-copilot

# Register marketplace first (older Copilot CLI versions)
copilot plugin marketplace add github/awesome-copilot
copilot plugin install <plugin-name>@awesome-copilot

# Or copy manually into your skills directory
# cp -r path/to/skill ~/.copilot/skills/skill-name/

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"  // OAuth — no token needed
    },
    "playwright": {
      "type": "stdio",
      "command": "npx",
      "args": ["@playwright/mcp-server"]
    },
    "postgres": {
      "type": "stdio",
      "command": "npx",
      "args": ["@modelcontextprotocol/server-postgres"],
      "env": {
        "POSTGRES_CONNECTION_STRING": "${env:DATABASE_URL}"
      }
    }
  }
}

{
  "hooks": [
    {
      "event": "preToolUse",
      "tool": "write_file",
      "command": "scripts/validate-no-secrets.sh",
      "description": "Scan for secrets before writing files"
    },
    {
      "event": "postToolUse",
      "tool": "run_terminal_command",
      "command": "scripts/log-command.sh",
      "description": "Audit log all terminal commands executed by agent"
    },
    {
      "event": "preToolUse",
      "tool": "create_pull_request",
      "command": "scripts/enforce-pr-template.sh",
      "description": "Verify PR has required sections before creation"
    }
  ]
}

---
name: dependency-update-agent
description: |
  Automatically review dependency update PRs, run tests,
  and approve safe updates. Triggered on Dependabot PRs.
on:
  pull_request:
    types: [opened]
    branches: [main]
permissions:
  contents: read
  pull-requests: write
safe-outputs: true
---

When a Dependabot PR is opened:
1. Read the dependency diff to understand what changed
2. Check if the package has known CVEs (use GitHub Security Advisory)
3. Review the CHANGELOG for breaking changes
4. If patch/minor version with no CVEs: approve the PR
5. If major version or CVE found: add a review comment explaining

{
  "name": "azure-devops-plugin",
  "version": "1.2.0",
  "description": "Complete Azure DevOps toolset for Copilot",
  "agents": ["agents/azure-iac-agent.agent.md"],
  "skills": ["skills/azure-iac-export/", "skills/bicep-review/"],
  "mcp_servers": [
    {
      "name": "azure-mcp",
      "source": { "npm": "@azure/mcp-server" }
    }
  ]
}

# Install from awesome-copilot marketplace (registered by default)
copilot plugin install azure-devops@awesome-copilot

# Install from any GitHub repo
copilot plugin install owner/repo

# List installed plugins
copilot plugin list

# Validate a plugin during development
npm run plugin:validate

# Install via npm
npm install -g @github/copilot-cli

# Or via homebrew
brew install gh-copilot

# Authenticate
copilot auth login

# Initialize project (generates instructions + AGENTS.md)
copilot /init

# Start a session
copilot

# Start and describe a task
copilot
> Add input validation to all API endpoints in src/api/

# Copilot plans, writes code, runs tests automatically
# Review what changed
> /diff

# Delegate a related task to cloud agent while you continue
> /delegate Write E2E Playwright tests for the new validation endpoints

# Check for related open issues via GitHub MCP
> Are there any open issues related to input validation?

# Switch to plan mode before a big change (Shift+Tab)
# Copilot asks clarifying questions, shows plan, waits for approval

# Use in CI pipeline (non-interactive)
copilot -p "Review the diff and check for security issues" \
  --allow-tools workspace,github \
  --deny-tools terminal

# Fork the repo and clone
git clone https://github.com/YOUR_USERNAME/awesome-copilot
cd awesome-copilot

# Create your content (skill, agent, instruction, etc.)
# File names: lower-case-with-hyphens.md

# Run validation
npm run skill:validate      # validate SKILL.md frontmatter
npm run plugin:validate     # validate plugin.json

# Build (required — updates README automatically)
npm run build

# Fix line endings (required — CI will fail otherwise)
bash scripts/fix-line-endings.sh

# PR MUST target the 'staged' branch, NOT main
git checkout -b feat/my-awesome-skill
git push origin feat/my-awesome-skill
# Open PR → base: staged