Skip to content

Commit 80873da

Browse files
committed
Add Copilot Automations and Enterprise Agent Configuration challenges
- Introduced the Copilot Automations challenge (ch33) with a detailed meta.yml, provision scripts (PowerShell and Bash), and success criteria for implementing customer-owned automations. - Created the Enterprise Agent Configuration challenge (ch34) with comprehensive documentation, including a README.md, COACH.md, and provision scripts, focusing on establishing a governed configuration source for custom agents. - Both challenges include prerequisites, success criteria, and references to relevant GitHub documentation to ensure proper implementation and governance.
1 parent e153831 commit 80873da

22 files changed

Lines changed: 1838 additions & 1 deletion

File tree

modules/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ modules/
1212
│ ├── README.md ← customer delivery team guide template
1313
│ └── COACH.md ← coach guide template
1414
15-
├── ghec/ ← GitHub Enterprise Cloud (28 challenges)
15+
├── ghec/ ← GitHub Enterprise Cloud (35 activities)
1616
│ └── challenges/
1717
│ └── <slug>/ ← one directory per challenge
1818
│ ├── meta.yml
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Ch31 — Copilot Environment & Instructions — Delivery Assurance
2+
3+
Apply the [Delivery Assurance Standard](../../../DELIVERY_ASSURANCE.md). `README.md` is the canonical task, evidence, and Definition of Done guide.
4+
5+
## Assurance record
6+
7+
- **Authorized scope:** customer target/default branch, data boundary, approvers, and named repository, Copilot, security, and runner owners.
8+
- **Evidence:** default-branch commit SHA; Actions workflow URL/log; instruction inventory and precedence review; cloud-agent session and/or code-review URL; runner/secrets decision.
9+
- **Open risk:** unavailable policy/feature, conflicting instruction, non-ephemeral runner, service, secret, or unobserved behavior, with accountable owner.
10+
- **Next decision:** approve an eligible pilot, remediate the environment, retain inspect-and-propose, or mark unavailable/not applicable.
11+
12+
## Reviewer focus
13+
14+
- Confirm the customer target came first. `ghec-ch31-*` is a safe fallback only and must not be represented as customer-production evidence.
15+
- Open the default branch and confirm `.github/workflows/copilot-setup-steps.yml` has exactly one `copilot-setup-steps` job. Verify a normal Actions run succeeded; a feature-branch file alone is not activated for Copilot.
16+
- Check the job uses only supported customization surfaces, minimal permissions, an explicit timeout no greater than 59 minutes, and no unjustified service, write scope, or secret.
17+
- Verify the team understands the shared baseline: cloud agent and code review use setup steps by default. Require a documented, review-specific reason before accepting `copilot-code-review.yml`.
18+
- Inspect repository-wide, matching path-specific, agent, and organization instructions. Confirm GitHub.com precedence is recorded as personal, path-specific repository, repository-wide, agent, then organization, and that conflicts are resolved rather than left to model behavior.
19+
- Check the runner evidence: standard hosted baseline or approved cost/network posture; ephemeral single-use cloud-agent runner; ARC-only Ubuntu x64 self-hosted code-review runner; no broad internal network.
20+
- Confirm Agents secrets/variables—not Actions, Codespaces, or Dependabot types—are the only cloud-agent environment inputs. No demonstration secret is acceptable.
21+
- Require actual visible evidence: Actions log plus a cloud-agent session log and/or code-review result. Where unavailable or limited, accept only a dated decision package that names the limitation and owner.
22+
- **Governance controls:** for approved cloud-agent use, confirm `COP-CLOUD-AGENT` in the existing register with policy, repository eligibility, review gates, environment evidence, and owner. Otherwise use `inspect-and-propose`, `not applicable`, or the customer equivalent.

modules/ghec/challenges/ch31-copilot-environment-instructions/README.md

Lines changed: 170 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: ghec-ch31
2+
title: Copilot Environment & Instructions
3+
module: ghec
4+
track: automation-ai
5+
difficulty: advanced
6+
duration_minutes: 180
7+
prerequisites: []
8+
prerequisite_capabilities:
9+
- Authorized customer repository and accountable repository owner
10+
- Repository administrator access, or a customer owner who can merge workflow and instruction changes to the default branch
11+
- Copilot Business or Copilot Enterprise availability and the applicable cloud-agent or code-review policy view
12+
- GitHub CLI (gh >= 2.x), git, and jq for the optional seeded fallback
13+
description: "Deliver a customer-approved Copilot environment and instruction decision package: default-branch setup steps, scoped instructions, runner and secret boundaries, and visible validation evidence for Copilot cloud agent and/or code review."
14+
success_criteria:
15+
- The authorized customer repository, accountable owners, approved scope, feature availability, and fallback decision were recorded.
16+
- A valid `.github/workflows/copilot-setup-steps.yml` with one `copilot-setup-steps` job was merged to the target default branch and its visible Actions run succeeded.
17+
- Repository-wide and path-specific instruction files were reviewed or implemented, with applicable organization instructions and their precedence recorded.
18+
- The team documented that cloud agent and code review share setup steps by default, and created `copilot-code-review.yml` only when review requires a different environment.
19+
- Least-privilege permissions, runner/network posture, services, 59-minute timeout limit, and Agents secret/variable boundary were recorded.
20+
- A cloud-agent session log and/or code-review result provided visible evidence that the intended setup and instructions were used, with limitations recorded.
21+
- When policy or feature access was unavailable, the customer received a decision package instead of an unauthorized enablement attempt.
22+
tags:
23+
- copilot
24+
- cloud-agent
25+
- code-review
26+
- custom-instructions
27+
- github-actions
28+
- automation
29+
app_dependency: none
30+
emu_compatible: true
31+
min_environment: org
32+
provision_creates:
33+
- repo ghec-ch31-copilot-environment-instructions (safe fallback only; no secrets, runners, or Copilot policy changes)
34+
- default-branch Copilot setup workflow, repository and path-specific instructions, and a small Node.js validation fixture
35+
- a bounded issue for optional cloud-agent or code-review validation
36+
tier: core
37+
source_repo: microsoft/frontier-agentic-devops-rvas
38+
source_path: modules/ghec/challenges/ch31-copilot-environment-instructions/meta.yml
39+
license: MIT
40+
references:
41+
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment
42+
- https://docs.github.com/en/copilot/concepts/prompting/response-customization?tool=webui
43+
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
44+
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-organization-instructions
45+
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/configure-secrets-and-variables
46+
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-runners
Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
[CmdletBinding()]
2+
param(
3+
[Parameter(Mandatory = $true)][string]$Org,
4+
[switch]$Teardown
5+
)
6+
7+
$ErrorActionPreference = 'Stop'
8+
$repo = 'ghec-ch31-copilot-environment-instructions'
9+
$repoFull = "$Org/$repo"
10+
11+
if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
12+
throw 'gh is required'
13+
}
14+
15+
if ($Teardown) {
16+
if (-not $repo.StartsWith('ghec-ch31-')) {
17+
throw 'Refusing to delete a non-ch31 repository'
18+
}
19+
gh repo delete $repoFull --yes
20+
Write-Host "Deleted $repoFull"
21+
exit 0
22+
}
23+
24+
gh repo view $repoFull 2>$null
25+
if ($LASTEXITCODE -ne 0) {
26+
gh repo create $repoFull --public --description 'Safe fallback for GHEC Ch31 Copilot environment instructions'
27+
}
28+
29+
function Set-SeedFile {
30+
param([string]$Path, [string]$Message, [string]$Content)
31+
32+
$sha = gh api "repos/$repoFull/contents/$Path" --jq .sha 2>$null
33+
$encoded = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($Content))
34+
$args = @('--method', 'PUT', "repos/$repoFull/contents/$Path", '-f', "message=$Message", '-f', "content=$encoded")
35+
if ($sha) { $args += @('-f', "sha=$sha") }
36+
gh api @args | Out-Null
37+
}
38+
39+
Set-SeedFile -Path 'README.md' -Message 'Add Ch31 fallback overview' -Content @'
40+
# GHEC Ch31 — Copilot Environment & Instructions
41+
42+
Safe fallback repository for validating a Copilot setup workflow and instruction
43+
layout. It contains no customer data, secret, service, internal endpoint, runner,
44+
or Copilot policy change.
45+
46+
Run `npm ci && npm test`. The default-branch setup workflow is the common
47+
environment baseline for Copilot cloud agent and Copilot code review.
48+
'@
49+
50+
Set-SeedFile -Path 'package.json' -Message 'Add minimal Node.js fixture' -Content @'
51+
{
52+
"name": "ghec-ch31-copilot-environment-instructions",
53+
"version": "1.0.0",
54+
"private": true,
55+
"scripts": {
56+
"test": "node test/greeting.test.js"
57+
}
58+
}
59+
'@
60+
61+
Set-SeedFile -Path 'package-lock.json' -Message 'Add npm lockfile' -Content @'
62+
{
63+
"name": "ghec-ch31-copilot-environment-instructions",
64+
"version": "1.0.0",
65+
"lockfileVersion": 3,
66+
"requires": true,
67+
"packages": {
68+
"": {
69+
"name": "ghec-ch31-copilot-environment-instructions",
70+
"version": "1.0.0"
71+
}
72+
}
73+
}
74+
'@
75+
76+
Set-SeedFile -Path 'src/greeting.js' -Message 'Add greeting fixture' -Content @'
77+
function formatGreeting (name) {
78+
return `Hello, ${name}!`
79+
}
80+
81+
module.exports = { formatGreeting }
82+
'@
83+
84+
Set-SeedFile -Path 'test/greeting.test.js' -Message 'Add fixture test' -Content @'
85+
const assert = require('assert')
86+
const { formatGreeting } = require('../src/greeting')
87+
88+
assert.strictEqual(formatGreeting('Ada'), 'Hello, Ada!')
89+
console.log('greeting test passed')
90+
'@
91+
92+
Set-SeedFile -Path '.github/copilot-instructions.md' -Message 'Add repository Copilot instructions' -Content @'
93+
# Repository instructions
94+
95+
Use Node.js 20. Run `npm ci` and `npm test` before proposing a change. Keep
96+
changes small, avoid adding secrets or network access, and explain validation in
97+
the pull request. Human review and CI remain required.
98+
'@
99+
100+
Set-SeedFile -Path '.github/instructions/source.instructions.md' -Message 'Add path-specific Copilot instructions' -Content @'
101+
---
102+
applyTo: "src/**/*.js"
103+
---
104+
Use CommonJS exports. Update the matching test under `test/` for behavior
105+
changes and run `npm test`.
106+
'@
107+
108+
Set-SeedFile -Path '.github/workflows/copilot-setup-steps.yml' -Message 'Add Copilot setup steps' -Content @'
109+
name: Copilot setup steps
110+
111+
on:
112+
workflow_dispatch:
113+
push:
114+
paths: [.github/workflows/copilot-setup-steps.yml]
115+
pull_request:
116+
paths: [.github/workflows/copilot-setup-steps.yml]
117+
118+
jobs:
119+
copilot-setup-steps:
120+
runs-on: ubuntu-latest
121+
permissions:
122+
contents: read
123+
timeout-minutes: 15
124+
steps:
125+
- uses: actions/checkout@v4
126+
- uses: actions/setup-node@v4
127+
with:
128+
node-version: "20"
129+
cache: npm
130+
- run: npm ci
131+
- run: npm test
132+
'@
133+
134+
$issueTitle = 'Validate the Copilot environment and instructions'
135+
$existing = gh issue list --repo $repoFull --state all --limit 100 --json title --jq '.[].title' 2>$null
136+
if ($existing -notcontains $issueTitle) {
137+
$body = @'
138+
Validate the default-branch Copilot setup workflow and instruction layout.
139+
140+
Acceptance criteria:
141+
- Run the setup workflow from Actions and retain its successful URL.
142+
- Make a small, reviewed pull request that changes `src/greeting.js`.
143+
- Confirm the repository and matching path-specific instructions are on the PR head branch.
144+
- Request approved Copilot code review and/or assign an approved cloud-agent task.
145+
- Record observed evidence and any unavailable-feature limitation.
146+
147+
Do not add a secret, service, self-hosted runner, or policy change to this seed.
148+
'@
149+
gh issue create --repo $repoFull --title $issueTitle --body $body | Out-Null
150+
}
151+
152+
Write-Host "Safe fallback ready: $repoFull"
153+
Write-Host 'Next: confirm the setup workflow is on the repository default branch, run it from Actions, then use the bounded issue only if the applicable Copilot feature is approved.'

0 commit comments

Comments
 (0)