lukaszlenart opened a new pull request, #1876: URL: https://github.com/apache/struts/pull/1876
GitHub Copilot code review picks up [agent skills](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review#mcp-servers-and-agent-skills) from `.github/skills`, and is more likely to use one whose directory name signals it is meant for pull request review. This repository had no such directory, so Copilot has been reviewing Struts pull requests without any of our conventions. This adds `.github/skills/code-review/SKILL.md`, covering: 1. **Tests** — the repository is JUnit 4 only; a Jupiter `@Test` added to an `XWorkTestCase` subclass silently never runs. Also the three traps that produce green tests asserting nothing: an unpushed action, `ParametersInterceptor.requireAnnotations` defaulting to `false` in a bare harness, and interned string literals defeating `==` marker checks. 2. **Security-sensitive changes** — OGNL, the allowlist, `@StrutsParameter` gating, uploads, action name cleanup, deserialization, escaping. 3. **PR hygiene** — the `WW-XXXX` title format and Jira link, and the documentation/build exception that uses conventional-commit form instead. 4. **Struts patterns** — UUID temporary files, allowlisted member access, `ParameterNameAware`, `Struts*` naming, no TODOs referencing unfiled tickets. The security section deliberately limits what the reviewer is allowed to write. A pull request is public, so a review comment that names a weakness, sketches how it is reached, or estimates its impact would itself be the disclosure that `SECURITY.md` exists to prevent. The skill asks for a neutral pointer to `SECURITY.md` and the private `[email protected]` process, and explicitly forbids describing the weakness, exploitability, severity, affected versions, or a matching CVE in the comment. No Jira ticket: this is a repository configuration change under `.github/`, which `CLAUDE.md` exempts from the `WW-XXXX` rule. Copilot code review reads skills from the head branch, so its review of this pull request is also the test of the skill — the attribution line under its comments should name `code-review`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
