Home › Agent workflows › Code review Copilot instructions

Code review Copilot instructions

Copilot instructions focused on pull request review: what to flag, severity labels, and how to word comments.

GitHub CopilotAgent workflows

How to use

Save this as .github/copilot-instructions.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

# Instructions for Copilot code review

When reviewing a pull request in this repository:

## Priorities (in order)
1. **Correctness:** logic errors, unhandled errors or null cases, race conditions, off-by-one, wrong async handling.
2. **Security:** missing auth/authorization checks, injection, secrets in code or logs, unsafe deserialization, unvalidated input.
3. **Data safety:** destructive migrations, missing transactions, breaking API or schema changes without versioning.
4. **Tests:** new behavior without tests, tests that don't assert anything meaningful, skipped tests.
5. **Performance:** N+1 queries, unbounded loops or queries, large synchronous work on hot paths.
6. **Maintainability:** unclear names, duplicated logic, functions doing too much.

## How to comment
- Prefix each comment with a severity: `[blocker]`, `[should]`, or `[nit]`.
- Be specific: quote the line, explain the failure scenario, and suggest a fix (use a suggestion block when it's small).
- One issue per comment. Don't repeat the same nit across files; mention it once.
- Skip style issues the linter or formatter already enforces.
- If something looks intentional but risky, ask a question rather than asserting it's wrong.

## Don't
- Don't request large rewrites unrelated to the PR's goal.
- Don't praise or summarize line by line; give one short overall summary at the top with the blocker count.