Improve Agent Syncs between Github Copilot/Cursor/Claude Code#16962
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: windows-latest | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Validate generated wrappers | ||
| shell: pwsh | ||
| run: ./tools/agents/sync-agent-wrappers.ps1 -Check |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
In general, the fix is to explicitly restrict the GITHUB_TOKEN permissions for this workflow to the minimum it needs. This job only checks out the repository and runs a local script, so it only requires read access to repository contents. We should therefore add a permissions block specifying contents: read.
The best way to fix this without changing functionality is to add a workflow-level permissions block near the top (after name: and/or on:) or a job-level block under validate-agent-wrappers:. A workflow-level block is more future-proof if more jobs are added later that have similar needs; if a future job needs additional privileges, it can override permissions at the job level. For this specific file, we will add:
permissions:
contents: readat the root level, between the on: section and jobs:. No imports or extra methods are needed since this is a YAML workflow configuration only.
| @@ -8,6 +8,9 @@ | ||
| - 'tools/agents/**' | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| validate-agent-wrappers: | ||
| runs-on: windows-latest |
QilongTang
committed this autofix suggestion 4 months ago.
There was a problem hiding this comment.
Applied the suggested fix
There was a problem hiding this comment.
Pull request overview
This PR formalizes .agents/ as the canonical source of agent skills/guidance and adds automation to keep GitHub Copilot agent wrapper files in .github/agents/ synchronized (and drift-checked in CI).
Changes:
- Added a PowerShell script to generate and validate thin Copilot wrapper files from canonical
.agents/skills/*/SKILL.mdfrontmatter. - Added a GitHub Actions workflow to enforce wrapper sync/drift checks on PRs that touch relevant agent guidance paths.
- Updated agent guidance docs and refined the PR description + Jira ticket skill docs to reduce ambiguity and centralize template usage.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
tools/agents/sync-agent-wrappers.ps1 |
Generates wrappers and supports -Check mode drift/orphan detection for .github/agents/. |
.github/workflows/agent_wrapper_sync_check.yml |
Adds CI enforcement to ensure generated wrappers remain in sync on PRs. |
.agents/skills/dynamo-pr-description/SKILL.md |
Clarifies PR template usage guidance and tightens wording around template adherence. |
.agents/skills/dynamo-jira-ticket/template.md |
Refines the canonical Jira ticket template structure and sections. |
.agents/skills/dynamo-jira-ticket/SKILL.md |
Points the skill to the canonical template.md and removes embedded template duplication. |
.agents/README.md |
Documents the canonical policy, wrapper sync commands, and cross-tool parity matrix. |
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
kalunkuo
left a comment
kalunkuo
left a comment
There was a problem hiding this comment.
This is awesome!! a good way to in sync without duplicating content @QilongTang 🚀 👀 . We should set it up in other repos too.
In the future if we end up having many skills across repos, it might be interesting to set up auto-discovery.
|
Purpose
Improve cross-tool agent skill consistency by making
.agents/canonical, generating thin Copilot wrappers from canonical skills, and enforcing drift checks in CI.Key changes:
tools/agents/sync-agent-wrappers.ps1to generate and validate wrappers.Github Actionto run wrapper sync checks on pull requests.-VerboseReportdiagnostics in check mode.Dynamo Skill Writeragent to help align agent skill format and syncingDeclarations
Check these if you believe they are true
Release Notes
N/A
Reviewers
@DynamoDS/eidos
FYIs
(FILL ME IN, Optional) Names of anyone else you wish to be notified of