Add GitHub Copilot code review instructions - #1
Merged
Conversation
This adds standardized Copilot code review instructions to help ensure consistent and effective automated code reviews across the organization. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds a repository-level instruction document intended to standardize GitHub Copilot’s automated PR review behavior for RiseUp projects.
Changes:
- Introduces
.github/copilot-instructions.mdwith org/stack/security context and review expectations - Defines security severity rubric and dependency guidance
- Documents suggested PR discussion commands for Copilot usage
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - 3rd party and api authentication is handled in other repository (e.g. carmella with verifySignature vs a pre-shared api key or aggregator using pki) | ||
| - **Tech Stack**: AWS, Vue, Node.js, TypeScript, Express, MongoDB, Jest | ||
| - **Architecture**: Microservice with CQRS pattern, event-driven flows | ||
| - **Trust internal @riseupil dependencies (e.g. @riseupil/reactive-cashflow) somewhat, and focus on external dependencies when raising feedback |
There was a problem hiding this comment.
The Markdown bold formatting is not closed (**), which will cause the rest of the document to render incorrectly. Close the bold marker (or remove bolding) so formatting doesn’t bleed into subsequent sections.
Suggested change
| - **Trust internal @riseupil dependencies (e.g. @riseupil/reactive-cashflow) somewhat, and focus on external dependencies when raising feedback | |
| - **Trust internal @riseupil dependencies (e.g. @riseupil/reactive-cashflow) somewhat, and focus on external dependencies when raising feedback** |
| - This document provides clear instructions for conducting Copilot-powered code reviews. | ||
| - Know that code you review for in this organization is developed by RiseUp - to build cashflows by analyzing transactions, predicting patterns, and managing financial data | ||
| - Know that RiseUp processes and stores personal financial data of customers that's pulled from open banking data sources via APIs, such as banks and credit card companies. | ||
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository |
There was a problem hiding this comment.
This is a run-on sentence with multiple clauses and mixed concerns (platforms, repos, technologies). Please split into shorter bullet points/sentences and standardize capitalization (e.g., HTML/JavaScript/Android/iOS) to improve readability and reduce ambiguity.
Suggested change
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository | |
| - RiseUp offers mobile and web apps directly to consumers and has tens of thousands of paying users. | |
| - The web front-end (HTML, JavaScript) is implemented in the elsa, greta, and anna repositories. | |
| - Flutter mobile apps are deployed to Android and iOS devices from the mobile_web repository. |
| - This document provides clear instructions for conducting Copilot-powered code reviews. | ||
| - Know that code you review for in this organization is developed by RiseUp - to build cashflows by analyzing transactions, predicting patterns, and managing financial data | ||
| - Know that RiseUp processes and stores personal financial data of customers that's pulled from open banking data sources via APIs, such as banks and credit card companies. | ||
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository |
There was a problem hiding this comment.
Correct capitalization of 'IOS' to 'iOS'.
Suggested change
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository | |
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and iOS devices from the mobile_web repository |
| - A security issue at RiseUp can only be described as **CRITICAL** if it is likely to: | ||
| - Lead to a personal or financial data breach of numerous identifiable persons to external attackers, | ||
| - Compromise a customer's credentials to their bank, credit card, or financial accounts, | ||
| - Or directly compromise RiseUp infrastructure, software, or credentials (such as CICD API keys or developer accounts). |
There was a problem hiding this comment.
Use the standard abbreviation 'CI/CD' instead of 'CICD' for clarity.
Suggested change
| - Or directly compromise RiseUp infrastructure, software, or credentials (such as CICD API keys or developer accounts). | |
| - Or directly compromise RiseUp infrastructure, software, or credentials (such as CI/CD API keys or developer accounts). |
Comment on lines
+7
to
+20
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository | ||
| - Know that RiseUp cares a lot about customer privacy and data protection. | ||
| - apart from elsa, greta, anna and mobile_web repositories, also olaf, carmella and captain-hooks are internet facing and will process and accept dangerous input from users when calling other internal services. | ||
| - our database is a mongodb nosql database | ||
| - the service and repository 'hans' is responsible for customer authentication, token creation and validation | ||
| - 'olaf' is the primary product proxy and API - it will intercept internet web requests, processes them, validate the session (if exists) and route them to the appropriate internal service | ||
| - our customers are authenticated using 2fa, with either auth0 or descope plus an in-house OTP mechanism | ||
| - we also communicate with customers using email, intercom, sms messages, push notifications | ||
| - user authentication is handled by 'hans' and authorization is handled by olaf, per called endpoint using an authorizationMiddleware | ||
| - very few endpoints should remain unauthenticated and when such are added or extended this should be reviewed by humans with your feedback | ||
| - 3rd party and api authentication is handled in other repository (e.g. carmella with verifySignature vs a pre-shared api key or aggregator using pki) | ||
| - **Tech Stack**: AWS, Vue, Node.js, TypeScript, Express, MongoDB, Jest | ||
| - **Architecture**: Microservice with CQRS pattern, event-driven flows | ||
| - **Trust internal @riseupil dependencies (e.g. @riseupil/reactive-cashflow) somewhat, and focus on external dependencies when raising feedback |
There was a problem hiding this comment.
This document includes detailed internal service/repository names and authentication/architecture specifics. Since files under .github/ are accessible to anyone with read access to the repo, consider reducing sensitive implementation details (or moving them to a private/internal doc) and keeping this file focused on review principles and high-level context.
Suggested change
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by front-end in the web (html, javascript) elsa, greta and anna repositories and flutter mobile apps that deploy to android and IOS devices from the mobile_web repository | |
| - Know that RiseUp cares a lot about customer privacy and data protection. | |
| - apart from elsa, greta, anna and mobile_web repositories, also olaf, carmella and captain-hooks are internet facing and will process and accept dangerous input from users when calling other internal services. | |
| - our database is a mongodb nosql database | |
| - the service and repository 'hans' is responsible for customer authentication, token creation and validation | |
| - 'olaf' is the primary product proxy and API - it will intercept internet web requests, processes them, validate the session (if exists) and route them to the appropriate internal service | |
| - our customers are authenticated using 2fa, with either auth0 or descope plus an in-house OTP mechanism | |
| - we also communicate with customers using email, intercom, sms messages, push notifications | |
| - user authentication is handled by 'hans' and authorization is handled by olaf, per called endpoint using an authorizationMiddleware | |
| - very few endpoints should remain unauthenticated and when such are added or extended this should be reviewed by humans with your feedback | |
| - 3rd party and api authentication is handled in other repository (e.g. carmella with verifySignature vs a pre-shared api key or aggregator using pki) | |
| - **Tech Stack**: AWS, Vue, Node.js, TypeScript, Express, MongoDB, Jest | |
| - **Architecture**: Microservice with CQRS pattern, event-driven flows | |
| - **Trust internal @riseupil dependencies (e.g. @riseupil/reactive-cashflow) somewhat, and focus on external dependencies when raising feedback | |
| - RiseUp offers mobile and web apps directly to consumers, we have tens of thousands of paying users serviced by web front-end applications and Flutter-based mobile apps that deploy to Android and iOS devices. | |
| - Know that RiseUp cares a lot about customer privacy and data protection. | |
| - Some services are internet facing and will process and accept potentially dangerous input from users when calling other internal services. | |
| - A dedicated authentication service is responsible for customer authentication, token creation, and validation. | |
| - An API gateway acts as the primary product proxy and API entry point: it intercepts internet web requests, validates sessions (if they exist), and routes them to the appropriate internal service. | |
| - Our customers are authenticated using multi-factor authentication (MFA), combining external identity providers with an in-house one-time-password (OTP) mechanism. | |
| - We also communicate with customers using email, in-app messaging, SMS messages, and push notifications. | |
| - User authentication is handled by a dedicated authentication service and authorization is enforced at the API gateway level per endpoint using authorization middleware. | |
| - Very few endpoints should remain unauthenticated, and when such endpoints are added or extended this should be reviewed by humans with your feedback. | |
| - Third-party and API authentication is handled by separate integration services (for example, using signature verification, pre-shared API keys, or public-key infrastructure (PKI), as appropriate). | |
| - **Tech Stack**: AWS, Vue, Node.js, TypeScript, Express, MongoDB, Jest | |
| - **Architecture**: Microservice with CQRS pattern, event-driven flows | |
| - **Trust internal organization-owned dependencies (for example, internal packages published to the private registry) somewhat, and focus primarily on external dependencies when raising feedback |
Updates the file with the latest version including: - Clarification on authentication requirements for internet-facing vs internal services - Added whatsapp to communication channels - Better guidance on what constitutes CRITICAL issues - Improved examples and assumptions guidance Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds standardized GitHub Copilot code review instructions to the repository.
What's included
.github/copilot-instructions.md- Comprehensive guidelines for Copilot-powered code reviews tailored for RiseUp's tech stack and security requirementsWhy this matters
Test plan
.github/copilot-instructions.md🤖 Generated with Claude Code