Setup `.github/**` for Copilot (for CodeQL) by data-douser · Pull Request #335 · advanced-security/codeql-sap-js

data-douser · 2026-03-24T17:15:54Z

What This PR Contributes

Resolves #259

Agent Definitions and Documentation:

Added .github/agents/javascript-cap-modeling-agent.md to define the responsibilities, workflow, and boundaries for the CAP framework CodeQL modeling agent, including TDD workflow, ql-mcp tools, and project structure.
Added .github/agents/javascript-ui5-modeling-agent.md to provide detailed instructions and best practices for the UI5 CodeQL modeling agent, covering TDD, supporting prompts, and project structure.
Added .github/agents/dependency-upgrade-agent.md to specify the workflow, commands, and boundaries for managing dependency upgrades (Node.js, CodeQL CLI, GitHub Actions) across the repository.
Added .github/agents/github-maintenance-agent.md to document the scope, structure, and best practices for maintaining the .github infrastructure, including prompts, instructions, templates, and workflows.
Added .github/agents/codeql-cds-extractor-agent.md to guide development, testing, and maintenance of the CodeQL CDS extractor (TypeScript), with explicit build/test commands and boundaries.

Configuration and Tooling:

Added .github/.yamllint configuration to enforce YAML style and linting rules for GitHub workflows and templates.
Removed static .codeql-version file; qlt.conf.json is now the single source of truth for the CodeQL CLI version. The copilot-setup-steps workflow dynamically generates .codeql-version at runtime from qlt.conf.json (using jq -r '.CodeQLCLI') as required by the setup-codeql-environment action.
Updated scripts/update-release-version.sh to remove .codeql-version maintenance code (version check and update functions), since the file is no longer tracked in the repository.

Future Works

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.

Adds a full complement of .github/** files for leveraging AI agents with the ql-mcp server for more efficient development of features and troubleshooting of problems related to SAP frameworks such as CAP / CDS, UI5, and XSJS. Sets up the 'advanced-security/codeql-sap-js' repo for ongoing "agentic maintenance", aka Resolves #259

Copilot

Pull request overview

This PR sets up repository-level .github/** infrastructure to support agentic Copilot maintenance workflows for CodeQL modeling and maintenance tasks (resolving #259), and adds tooling/version files to support consistent CodeQL environment setup.

Changes:

Adds multiple Copilot agent definitions, instruction files, and task prompts for CAP/UI5/XSJS modeling, CDS extractor work, dependency upgrades, and .github maintenance.
Introduces a copilot-setup-steps workflow plus .node-version / .codeql-version files to standardize agent environment setup.
Extends scripts/update-release-version.sh to validate/update .codeql-version alongside existing version-bearing files.

Reviewed changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
scripts/update-release-version.sh	Adds `.codeql-version` consistency check and update logic tied to release version updates.
.node-version	Defines Node major version for consistent setup across workflows/agents.
.gitignore	Ignores `.vscode/` workspace settings.
.github/workflows/copilot-setup-steps.yml	New workflow to provision Node + CodeQL env and install packs for Copilot setup.
.github/workflows/cds-extractor-dist-bundle.yml	Minor comment placement tweak for `workflow_dispatch`.
.github/prompts/xsjs_framework_development.prompt.md	Adds XSJS modeling guidance prompt (sources/sinks/tests).
.github/prompts/ui5_framework_codeql_test.prompt.md	Adds UI5 unit testing prompt content and examples.
.github/prompts/ui5_framework_codeql_lib.prompt.md	Adds UI5 library modeling prompt content and examples.
.github/prompts/ui5_framework_codeql_dev.prompt.md	Adds UI5 query development prompt content and examples.
.github/prompts/test_driven_development.prompt.md	Adds shared TDD workflow prompt for CodeQL development.
.github/prompts/github_maintenance.prompt.md	Adds `.github` maintenance workflow prompt (agents/instructions/prompts/templates).
.github/prompts/dependency_upgrade.prompt.md	Adds dependency upgrade workflow prompt (Node/CodeQL/Actions).
.github/prompts/codeql_test_commands.prompt.md	Adds centralized CodeQL/ql-mcp test command reference prompt.
.github/prompts/cds_extractor_development.prompt.md	Adds CDS extractor development prompt (build/test/architecture).
.github/prompts/cap_framework_development.prompt.md	Adds CAP modeling development prompt (patterns/tests/examples).
.github/instructions/javascript_xsjs_ql.instructions.md	Adds XSJS QL/QLL instruction constraints and workflow requirements.
.github/instructions/javascript_ui5_ql.instructions.md	Adds UI5 QL/QLL/testing instruction constraints and workflow requirements.
.github/instructions/javascript_cap_ql.instructions.md	Adds CAP QL/QLL instruction constraints and workflow requirements.
.github/instructions/github_maintenance.instructions.md	Adds `.github` maintenance instruction constraints and hierarchy guidance.
.github/instructions/dependency_upgrades.instructions.md	Adds dependency-upgrade instruction constraints and workflow requirements.
.github/instructions/README.md	Documents instruction-file purpose, structure, and prompt hierarchy.
.github/agents/javascript-xsjs-modeling-agent.md	Adds XSJS modeling agent definition (tools, workflow, boundaries).
.github/agents/javascript-ui5-modeling-agent.md	Adds UI5 modeling agent definition (tools, workflow, structure).
.github/agents/javascript-cap-modeling-agent.md	Adds CAP modeling agent definition (tools, workflow, structure).
.github/agents/github-maintenance-agent.md	Adds `.github` maintenance agent definition (commands, hierarchy).
.github/agents/dependency-upgrade-agent.md	Adds dependency upgrade agent definition (commands, boundaries).
.github/agents/codeql-cds-extractor-agent.md	Adds CDS extractor agent definition (commands, boundaries, tests).
.github/.yamllint	Adds yamllint configuration intended for workflow/template YAML linting.
.codeql-version	Adds pinned CodeQL version file used by setup and versioning automation.

.github/agents/github-maintenance-agent.md

.github/prompts/github_maintenance.prompt.md

.github/.yamllint

.github/prompts/ui5_framework_codeql_test.prompt.md

.github/prompts/ui5_framework_codeql_dev.prompt.md

.github/prompts/ui5_framework_codeql_lib.prompt.md

.github/agents/javascript-ui5-modeling-agent.md

.github/agents/github-maintenance-agent.md

data-douser · 2026-03-24T17:23:29Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-03-24T17:23:39Z

@data-douser I've opened a new pull request, #336, to work on those changes. Once the pull request is ready, I'll request review from you.

…nd UI5 prompt outer fences (#336) * Initial plan * Address review feedback: fix yamllint commands, agent structure diagram, and UI5 prompt fences Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> Agent-Logs-Url: https://github.com/advanced-security/codeql-sap-js/sessions/404b2862-c982-4730-894b-d434ad2bb1ed --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

mbaluda · 2026-03-26T14:14:01Z

@copilot the CodeQL version is already specified in qlt.conf.json.
Is .codeql-version a standardized file location?
Modify the PR to get the value directly from qlt.conf.json

…e in copilot-setup-steps workflow Agent-Logs-Url: https://github.com/advanced-security/codeql-sap-js/sessions/baa532ae-dce3-46f4-8f65-9200ae19135c Co-authored-by: mbaluda <5237080+mbaluda@users.noreply.github.com>

Copilot · 2026-03-26T14:19:48Z

@copilot the CodeQL version is already specified in qlt.conf.json.
Is .codeql-version a standardized file location?
Modify the PR to get the value directly from qlt.conf.json

.codeql-version is not a standardized file — it's a convention expected by the advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment action used in the copilot setup workflow. Since qlt.conf.json is already the single source of truth for the CodeQL version in this repo, keeping a separate static .codeql-version file was redundant.

Fixed in commit 15530ef:

Removed the static .codeql-version file from the repository
Updated copilot-setup-steps.yml to generate .codeql-version at runtime from qlt.conf.json (via jq -r '.CodeQLCLI' qlt.conf.json) before the setup-codeql-environment action runs
Removed all .codeql-version maintenance code from scripts/update-release-version.sh

data-douser added 2 commits March 24, 2026 10:49

Setup copilot-setup-steps actions workflow

8e9f2c3

data-douser self-assigned this Mar 24, 2026

data-douser requested a review from Copilot March 24, 2026 17:16

Copilot started reviewing on behalf of data-douser March 24, 2026 17:16 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 24, 2026

Fix review feedback: yamllint config path, agent structure diagram, and UI5 prompt outer fences #336

Merged

data-douser marked this pull request as ready for review March 24, 2026 22:52

data-douser requested review from a team March 24, 2026 22:53

data-douser added documentation Improvements or additions to documentation enhancement New feature or request labels Mar 24, 2026

data-douser requested a review from Copilot March 24, 2026 22:54

Copilot started reviewing on behalf of data-douser March 24, 2026 22:54 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Merge branch 'main' into dd/copilot-setup/2

e3300df

Copilot AI requested a review from mbaluda March 26, 2026 14:07

Copilot stopped work on behalf of mbaluda due to an error March 26, 2026 14:07
Before you can use Copilot coding agent, you need to pick a "Usage billed to" option in your Copilot settings. Update your settings at https://github.com/settings/copilot/features, then try again.

Copilot started work on behalf of mbaluda March 26, 2026 14:14 View session

Copilot finished work on behalf of mbaluda March 26, 2026 14:20

data-douser enabled auto-merge (squash) March 27, 2026 02:50

Merge branch 'main' into dd/copilot-setup/2

60e0046

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Setup `.github/**` for Copilot (for CodeQL)#335

Setup `.github/**` for Copilot (for CodeQL)#335
data-douser wants to merge 6 commits intomainfrom
dd/copilot-setup/2

data-douser commented Mar 24, 2026 •

edited by Copilot AI

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

data-douser commented Mar 24, 2026

Uh oh!

Copilot AI commented Mar 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mbaluda commented Mar 26, 2026

Uh oh!

Copilot AI commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

data-douser commented Mar 24, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What This PR Contributes

Future Works

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

data-douser commented Mar 24, 2026

Uh oh!

Copilot AI commented Mar 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

mbaluda commented Mar 26, 2026

Uh oh!

Copilot AI commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

data-douser commented Mar 24, 2026 •

edited by Copilot AI

Loading