feat: ghas-pack — Add Dependabot, CodeQL, and Secret Scanning agent skills#1039
Closed
VeVarunSharma wants to merge 5 commits intogithub:stagedfrom
Closed
feat: ghas-pack — Add Dependabot, CodeQL, and Secret Scanning agent skills#1039VeVarunSharma wants to merge 5 commits intogithub:stagedfrom
VeVarunSharma wants to merge 5 commits intogithub:stagedfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds three new Agent Skills under skills/ to support GitHub Advanced Security workflows (Dependabot, CodeQL, and Secret Scanning), each with a core SKILL.md plus bundled reference docs to guide configuration and troubleshooting.
Changes:
- Introduces new
dependabot,codeql, andsecret-scanningskills with step-by-step operational guidance. - Adds reference documentation covering configuration, commands, and remediation/troubleshooting for each area.
- Expands the repo’s skill catalog with GHAS-focused content intended for reuse across repositories.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| skills/dependabot/SKILL.md | Main Dependabot skill guidance (config patterns, grouping, scheduling, PR commands). |
| skills/dependabot/references/dependabot-yml-reference.md | Option-by-option reference for .github/dependabot.yml. |
| skills/dependabot/references/example-configs.md | Sample dependabot.yml configurations for common setups. |
| skills/dependabot/references/pr-commands.md | Reference for @dependabot PR comment commands. |
| skills/codeql/SKILL.md | Main CodeQL skill guidance (Actions workflow + CLI usage). |
| skills/codeql/references/alert-management.md | Reference for triage/dismissal/management of CodeQL alerts. |
| skills/codeql/references/cli-commands.md | Reference for installing and using the CodeQL CLI + SARIF upload. |
| skills/codeql/references/compiled-languages.md | Reference for build modes and requirements for compiled languages. |
| skills/codeql/references/sarif-output.md | Reference for interpreting SARIF output and upload constraints. |
| skills/codeql/references/troubleshooting.md | Troubleshooting guide for common CodeQL workflow/CLI failures. |
| skills/codeql/references/workflow-configuration.md | Reference for configuring CodeQL GitHub Actions workflows. |
| skills/secret-scanning/SKILL.md | Main secret scanning skill guidance (enablement, push protection, remediation). |
| skills/secret-scanning/references/alerts-and-remediation.md | Reference for alert types, remediation workflow, APIs, exclusions. |
| skills/secret-scanning/references/custom-patterns.md | Reference for defining and managing custom secret scanning patterns. |
| skills/secret-scanning/references/push-protection.md | Reference for push protection behavior, bypass flows, delegated bypass. |
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
+229
to
+233
| directory: "/" | ||
| schedule: | ||
| interval: "cron" | ||
| cronjob: "0 9 * * 1" # Every Monday at 9:00 AM | ||
| timezone: "America/New_York" |
Comment on lines
+248
to
+254
| ### Cron Expressions | ||
|
|
||
| ```yaml | ||
| schedule: | ||
| interval: "cron" | ||
| cronjob: "0 9 * * 1" # Every Monday at 9 AM | ||
| ``` |
| @@ -0,0 +1,224 @@ | |||
| --- | |||
| name: secret-scanning | |||
| description: Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. This skill should be used when users need help enabling secret scanning, setting up push protection, defining custom secret patterns, triaging secret scanning alerts, or resolving blocked pushes. | |||
Comment on lines
+3
to
+8
| description: >- | ||
| Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when | ||
| users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, | ||
| configuring dependency update strategies, setting up grouped updates, monorepo patterns, | ||
| multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub | ||
| Advanced Security (GHAS) supply chain security topic related to Dependabot. |
Comment on lines
+413
to
+417
| ## Resources | ||
|
|
||
| - `references/dependabot-yml-reference.md` — Complete YAML options reference | ||
| - `references/pr-commands.md` — Full PR comment commands reference | ||
| - `references/example-configs.md` — Real-world configuration examples |
Comment on lines
+96
to
+100
| | `interval` | `daily`, `weekly`, `monthly`, `quarterly`, `semiannually`, `yearly`, `cron` | Required | | ||
| | `day` | `monday`–`sunday` | Weekly only | | ||
| | `time` | `HH:MM` | UTC by default | | ||
| | `timezone` | IANA timezone string | e.g., `America/New_York` | | ||
| | `cronjob` | Cron expression | Required when interval is `cron` | |
| schedule: | ||
| interval: "weekly" | ||
| labels: ["infrastructure"] | ||
| assignees: ["@platform-team"] |
| schedule: | ||
| interval: "weekly" | ||
| labels: ["infrastructure", "dependencies"] | ||
| assignees: ["@platform-team"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds three new agent skills for GitHub Advanced Security (GHAS) as part of the ghas-pack:
New Skills
Files Added (15 files)
Checklist