From 12d73664b4d0a59b5a6e29e466128823b1cfb23f Mon Sep 17 00:00:00 2001 From: Alexander Dusenbery Date: Tue, 21 Jul 2026 10:57:25 -0400 Subject: [PATCH] chore: sync AI instruction files from enterprise template Updated boilerplate sections to match current conventions in edx/ai-devtools-internal docs/templates/. --- .github/copilot-instructions.md | 40 +++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 7fafe25..47c6095 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -10,3 +10,43 @@ At the start of every session, before doing any other work, read: Treat their contents as binding project instructions for the remainder of the session, equivalent to instructions in this file. + +## PR Review Instructions + +When reviewing a PR, focus on the areas below. + +### Code correctness and performance + +1. Flag incorrect business logic. +2. Flag areas that are potentially inefficient or unperformant. + +### Excess and redundancy + +Bias toward flagging **excess and redundancy**. + +1. **Reuse before reinvent.** Flag code that duplicates existing functionality - identify the existing equivalent symbol. +2. **Earn every guard.** Defensive code (try/except, null-checks, fallbacks) must address a + failure that can actually happen at this call site given the system's invariants. +3. **Don't swallow exceptions.** If you catch an exception, re-raise it or convert it to a more actionable error; avoid catch-and-log-only (or catch-and-ignore) handling. +4. **YAGNI / trust the defaults.** Don't build for hypothetical futures. Don't re-implement what + the framework already does (DRF pagination, auth, serializer defaults). Flag speculative + generality and needless overrides of correct defaults. +5. **Respect the source of truth.** Data should be read from its canonical owner. Flag calls to + external services for data the system already stores locally (e.g. a live Stripe price lookup + when a local price table keyed by slug exists). Name the local source you're pointing to. + +### Security + +Check auth/permission classes, input validation at trust boundaries, injection vectors, secrets +in code, missing PII annotations, CSRF. For Django/DRF backends: verify `edx-drf-extensions` +and `edx-rbac` patterns. For React frontends: check XSS vectors and exposed keys. Cite +`file:line` for every finding. + +### Test coverage + +Flag new logic shipped without tests, tests that assert implementation detail rather than +behavior, missing edge cases that can actually happen, and brittle snapshot tests. + +### Output format + +Briefly highlight any critical or high severity issues.