Add codebase audit workflow for analyzing existing code by anakrish · Pull Request #39 · anakrish/regorus

anakrish · 2026-04-26T15:50:11Z

Codebase Audit System

Adds a workflow_dispatch-triggered audit system that analyzes existing code (not just PR diffs) using multi-perspective AI review via GitHub Models API.

How it works

Smart file discovery: Searches knowledge files for topic relevance → extracts file paths → expands with grep → LLM reranks for precision
Clustered analysis: Groups files into ~15KB clusters, analyzes each per perspective
Snippet-based citing: Quotes exact code instead of line numbers (more reliable than approximate references)
Rolling issues: Updates existing issue for same topic label instead of creating duplicates

Usage

Go to Actions → Codebase Audit → Run workflow, then either:

Enter a free-text topic (e.g., error handling patterns)
Select a preset from the dropdown

Preset audits

Preset	Topic	Perspectives
panic-safety	Unwrap, expect, bounds checks	reliability, security, semantics
ffi-boundary	Memory safety across language boundaries	security, architect, api-steward, reliability
security-hardening	Input validation, DoS protection	security, red-teamer, reliability
undefined-propagation	Three-valued logic correctness	semantics, test, reliability
resource-limits	Unbounded resource consumption	security, reliability, performance

New files

.github/workflows/codebase-audit.yml — Workflow definition
.github/scripts/codebase-audit.sh — Core audit logic
.github/prompts/audit-*.json — 5 preset audit configurations

Add a complete Copilot configuration for regorus with layered architecture: instructions, knowledge files, skills, role-based agents, and CI validation. ## Instructions (auto-loaded) - copilot-instructions.md: lean 5KB orientation with knowledge file references - copilot-code-review-instructions.md: "think freely" review guide with severity categories and domain-specific context (Undefined, FFI, telemetry) ## Knowledge Files (20 files, ~70KB) Deep institutional knowledge organized by subsystem: - Core: value-semantics, engine-api, error-handling-migration - Execution: interpreter-architecture, rvm-architecture, compilation-pipeline - Rego: rego-semantics, rego-compiler, builtin-system - Azure: azure-policy-language, azure-policy-aliases, azure-rbac-language - Safety: policy-evaluation-security, ffi-boundary, feature-composition - Diagnostics: telemetry-and-diagnostics, causality-and-partial-eval - Extensibility: language-extension-guide, tooling-architecture, time-builtins-compat ## Agents (16 role-based personas) Each agent brings a distinct thinking mode for review and planning: - Core engineering: red-teamer, semantics-expert, architect, performance-engineer - Quality: test-engineer, verification-engineer, security-auditor - Operations: reliability-engineer, support-engineer, ci-engineer - Evolution: refactorer, api-steward - Product: program-manager, demo-engineer, dx-engineer - Leadership: tech-lead (with 9 constitutional rules and cross-agent synthesis) ## Skills (6 task workflows) - thorough-review: multi-agent parallel review with cross-agent context protocol - design-alternatives: multi-approach evaluation against 9 dimensions - add-builtin, opa-conformance, security-review, verification ## CI & Infrastructure - copilot-setup-steps.yml: Rust 1.92.0 + clippy + rustfmt + cargo cache - copilot-config-validation.yml: YAML syntax, reference checking, staleness detection ## Architecture Documentation - docs/copilot-architecture.md: how all layers connect, extension guide Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Add 'Review Perspectives' section to copilot-code-review-instructions.md that inlines key thinking modes from all 10 relevant agents so the single-pass GitHub PR reviewer adopts multiple roles automatically - Fix copilot-config-validation.yml grep pattern to only match knowledge file references in the table (not docs/rvm/*.md references) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

feat: add comprehensive GitHub Copilot configuration

Each review comment now includes: - Perspective tag identifying which role raised the finding - Severity indicator (critical/important/suggestion) - Issue-ready summary in blockquote for easy GitHub issue creation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This reverts commit 2225c7e.

Move comment format from a subsection hint to a top-level REQUIRED section with concrete examples and explicit 'no exceptions' language. This should improve compliance from the PR review bot. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adds a GitHub Actions workflow that: - Triggers on PRs via pull_request_target (fork-safe, API-only diff) - Selects relevant perspectives based on changed file paths - Calls GitHub Models API with agent instructions + file context - Requests structured JSON output, renders perspective-tagged markdown - Upserts a single consolidated review comment (idempotent) Security: never checks out PR head code; pins actions by SHA; uses concurrency groups to cancel stale runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The 'models: read' permission may not be recognized by GitHub Actions yet, potentially causing silent workflow failures. Remove it and rely on GITHUB_TOKEN's default access. Add workflow_dispatch for manual testing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Testing both triggers to determine which fires for same-repo PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move all review logic from inline YAML to .github/scripts/perspective-review.sh. Workflow YAML is now minimal — just triggers, permissions, and script invocation. This fixes YAML parsing issues with complex heredocs and inline bash. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The perspective-review workflow needs the models:read permission on GITHUB_TOKEN to call the GitHub Models API endpoint. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Redesigned the perspective-review script to use the PR Review API for inline code comments instead of issue comments. Each perspective posts a separate review with findings anchored to specific diff lines. Key improvements: - Uses PR Review API for inline comments with code snippets - One review per perspective for clear attribution - Parses diff to extract valid line anchors with code content - LLM picks from exact anchor list (100% inline rate) - Two-bucket fallback: inline for anchored, body for unanchored - Locks reviews to analyzed commit SHA Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adds a workflow_dispatch-triggered codebase audit system that can analyze existing code (not just PR diffs) using multi-perspective AI review. Key features: - Smart file discovery: knowledge files → grep → LLM reranking - Multi-pass analysis: per-file clusters, then cross-file synthesis - Snippet-based citing: exact code quotes instead of line numbers - Rolling issues: updates existing issue for same topic - 5 preset audit topics: panic-safety, ffi-boundary, security-hardening, undefined-propagation, resource-limits - Auto-selects perspectives based on topic keywords New files: - .github/workflows/codebase-audit.yml - .github/scripts/codebase-audit.sh - .github/prompts/audit-*.json (5 preset configs) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

⚙️ Reliability Engineer — 5 finding(s)

github-actions · 2026-04-26T15:50:30Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",


🟠 Important: FFI Boundary Safety Considerations

The FFI boundary safety prompt outlines the need for memory safety, panic containment, handle validation, and error propagation across language boundaries. It is crucial to ensure that all FFI bindings are audited for safety invariants to prevent potential vulnerabilities when interfacing with other languages.

github-actions · 2026-04-26T15:50:30Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",


🟠 Important: Panic Safety in Code Paths

The panic safety prompt emphasizes the importance of identifying potential panic points in non-test code. This is critical for maintaining reliability in a no_std-compatible library used in Azure production, where unexpected panics can lead to service disruptions.

github-actions · 2026-04-26T15:50:30Z

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",


🟠 Important: Resource Limits and DoS Protection

The resource limits prompt highlights the need to enforce limits on resource usage to prevent denial-of-service attacks. It is essential to ensure that all code paths that could consume unbounded resources are properly guarded to maintain system stability.

github-actions · 2026-04-26T15:50:31Z

@@ -0,0 +1,5 @@
+{
+  "topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",


🟠 Important: Security Hardening Against Untrusted Inputs

The security hardening prompt focuses on input validation, resource limits, and DoS protection. A comprehensive security review of the policy engine is necessary to address attack surfaces exposed to untrusted inputs, ensuring the integrity of the system.

github-actions · 2026-04-26T15:50:31Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",


🟠 Important: Undefined Value Propagation Handling

The undefined value propagation prompt addresses the need for correct handling of three-valued logic throughout the evaluation pipeline. Ensuring that Undefined values are managed properly is crucial to avoid subtle bugs in the system.

github-actions

🧪 Test Engineer — 5 finding(s)

github-actions · 2026-04-26T15:50:39Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",


🟠 Important: Missing FFI boundary safety checks

The FFI boundary safety checks are crucial for ensuring memory safety, panic containment, and handle validation. The absence of these checks can lead to vulnerabilities when interfacing with untrusted code. It is essential to audit all FFI bindings to ensure they adhere to safety invariants.

github-actions · 2026-04-26T15:50:39Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",


🟠 Important: Potential panic points in production code

The audit for panic safety is critical, especially for a no_std-compatible library used in production environments. Identifying potential panic points such as unwraps and expects can prevent runtime failures and ensure reliability.

github-actions · 2026-04-26T15:50:39Z

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",


🟠 Important: Resource limits and DoS protection

Ensuring that all code paths are properly guarded against unbounded resource consumption is vital for maintaining system stability. This includes enforcing limits on recursion depth, output sizes, and memory usage to prevent denial-of-service attacks.

github-actions · 2026-04-26T15:50:39Z

@@ -0,0 +1,5 @@
+{
+  "topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",


🟠 Important: Input validation and security hardening

A comprehensive security review focusing on input validation and resource limits is necessary to protect against untrusted inputs. This audit should cover all attack surfaces exposed to untrusted data to mitigate potential vulnerabilities.

github-actions · 2026-04-26T15:50:39Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",


🟠 Important: Undefined value propagation handling

Verifying correct handling of Undefined values and three-valued logic throughout the evaluation pipeline is crucial. This ensures that the system behaves as expected in edge cases and prevents subtle bugs related to Undefined propagation.

New presets: performance, design-alternatives, code-cleanup, test-gaps, api-ergonomics (10 total now). Weekly cron schedule rotates through all 10 presets (one per Monday). Week number mod 10 selects which preset runs, ensuring full coverage over a 10-week cycle. Also: improved concurrency grouping, better error messages, made topic optional when using presets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

⚙️ Reliability Engineer — 4 finding(s)

github-actions · 2026-04-26T16:10:27Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",
+  "perspectives": "security-auditor,architect,api-steward,reliability-engineer",


🟠 Important: Missing Error Handling in FFI Functions

The FFI boundary safety topic highlights the importance of memory safety and error propagation across language boundaries. It is crucial to ensure that all FFI functions validate pointer parameters to prevent null dereferences, which could lead to crashes or undefined behavior in production.

github-actions · 2026-04-26T16:10:27Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",
+  "perspectives": "reliability-engineer,security-auditor,semantics-expert",


🟠 Important: Potential Panic Points in Code

The audit for panic safety emphasizes identifying potential panic points in non-test code. This is critical for maintaining reliability in production environments, especially for libraries intended for use in Azure, where stability is paramount.

github-actions · 2026-04-26T16:10:27Z

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",
+  "perspectives": "security-auditor,reliability-engineer,performance-engineer",


🟠 Important: Resource Limits and DoS Protection

The resource limits audit ensures that all code paths are properly guarded against unbounded resource consumption. This is essential for preventing denial-of-service attacks and ensuring that the system remains responsive under load.

github-actions · 2026-04-26T16:10:27Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",
+  "perspectives": "semantics-expert,test-engineer,reliability-engineer",


🟠 Important: Undefined Value Propagation Handling

The audit for undefined value propagation focuses on the correctness of three-valued logic handling throughout the evaluation pipeline. Proper handling of undefined values is crucial to avoid subtle bugs and ensure deterministic behavior in policy evaluations.

github-actions

🧪 Test Engineer — 5 finding(s)

github-actions · 2026-04-26T16:10:36Z

@@ -0,0 +1,5 @@
+{
+  "topic": "API ergonomics — confusing public interfaces, missing builder patterns, inconsistent naming, poor error messages, and documentation gaps in the public API",


🟠 Important: Missing Test Coverage for New Audit Prompts

The newly added audit prompt for API ergonomics lacks corresponding test cases. This could lead to untested paths in the code that may introduce bugs related to public API interfaces. It is crucial to ensure that all new features have adequate test coverage to prevent regressions.

github-actions · 2026-04-26T16:10:36Z

+# Usage: codebase-audit.sh <repo> <topic> [perspectives]
+# Requires: GITHUB_TOKEN env var, jq, gh CLI
+
+set -euo pipefail


🟠 Important: Potential for Undefined Propagation in New Audit Scripts

The new codebase audit script may not handle undefined values properly, especially when processing inputs from the GitHub API. This could lead to unexpected behavior or crashes if the API returns unexpected results. It is essential to validate inputs and handle undefined cases to maintain robustness.

github-actions · 2026-04-26T16:10:36Z

+    ],
+    temperature: 0.1
+  }' | curl -s -X POST "$API_URL" \
+    -H "Authorization: Bearer ${GITHUB_TOKEN}" \


🟠 Important: Lack of Error Handling in API Calls

The script makes API calls to the GitHub Models API without sufficient error handling. If the API fails or returns an error, the script may not respond appropriately, leading to silent failures or incorrect results. Implementing robust error handling will improve the reliability of the audit process.

github-actions · 2026-04-26T16:10:36Z

+CLUSTER_NUM=0
+
+analyze_cluster() {
+  local cluster_content="$1"


🔵 Suggestion: Consider Adding Unit Tests for New Audit Functions

The new functions introduced in the audit script should have unit tests to ensure their correctness. This will help catch any potential bugs early in the development process and ensure that the functions behave as expected under various conditions.

github-actions · 2026-04-26T16:10:36Z

+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",
+  "perspectives": "security-auditor,architect,api-steward,reliability-engineer",
+  "description": "Audits all FFI bindings (C, Python, Ruby, Java, Go, C#, WASM) for safety invariants."


🔵 Suggestion: Documentation Gaps in New Audit Features

The new audit prompt for FFI boundary safety lacks detailed documentation on how it should be used and what specific checks it performs. Providing clear documentation will help users understand the purpose of the audit and how to interpret the results.

Schedule Mon/Wed/Fri rotation using day-of-year mod 10 to select preset. Full codebase audit coverage every ~3.5 weeks. Knowledge freshness is already tracked by copilot-config-validation.yml which checks 8 knowledge↔source pairs weekly and warns on staleness. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

⚙️ Reliability Engineer — 5 finding(s)

github-actions · 2026-04-26T16:20:29Z

+echo "Valid files to audit: ${#VALID_FILES[@]}"
+
+if [ ${#VALID_FILES[@]} -eq 0 ]; then
+  echo "No files found for topic '${TOPIC}'. Exiting."


🟠 Important: Missing Error Handling in Audit Scripts

The script does not handle the case where no files are found for the specified topic, leading to a silent exit. This could result in missed audits and lack of visibility into potential issues. Proper error handling should be implemented to notify users when no relevant files are found.

github-actions · 2026-04-26T16:20:29Z

+
+# 1a. Find relevant knowledge files by searching for topic keywords
+echo "Searching knowledge files for topic relevance..."
+TOPIC_WORDS=$(echo "$TOPIC" | tr '[:upper:]' '[:lower:]' | tr -cs '[:alnum:]' '\n' | sort -u)


🟠 Important: Potential for Resource Exhaustion in File Discovery

The file discovery process uses a potentially unbounded number of files from the knowledge base and source directories. If the directories contain a large number of files, this could lead to excessive memory usage or slow performance. Implementing limits on the number of files processed or adding pagination could mitigate this risk.

github-actions · 2026-04-26T16:20:29Z

+  --arg model "$MODEL" \
+  --arg prompt "$DISCOVERY_PROMPT" \
+  '{
+    model: $model,


🟠 Important: Lack of Timeout Handling in Audit Process

The audit process does not implement any timeout handling for the API calls made to the GitHub Models API. This could lead to indefinite waiting periods if the API is unresponsive, impacting the reliability of the audit process. Adding timeout logic would ensure that the script can fail gracefully in such scenarios.

github-actions · 2026-04-26T16:20:29Z

+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#
+# Codebase audit using GitHub Models API.


🔵 Suggestion: Improve Documentation for Audit Scripts

The documentation for the codebase audit script could be enhanced to provide clearer instructions on its usage and expected inputs. This would help users understand how to effectively utilize the script and what to expect from its execution.

github-actions · 2026-04-26T16:20:29Z

+MODEL="openai/gpt-4o-mini"
+API_URL="https://models.github.ai/inference/chat/completions"
+
+echo "=== Codebase Audit: ${TOPIC} ==="


🔵 Suggestion: Consider Adding Logging for Audit Processes

The audit script currently lacks logging capabilities, which would be beneficial for tracking the execution flow and diagnosing issues. Implementing logging would provide better visibility into the audit process and help in troubleshooting any problems that arise.

github-actions

🧪 Test Engineer — 10 finding(s)

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "API ergonomics — confusing public interfaces, missing builder patterns, inconsistent naming, poor error messages, and documentation gaps in the public API",


🟠 Important: Missing test coverage for new audit prompts

The newly added audit prompt for API ergonomics lacks corresponding test cases. This could lead to untested paths in the code that may introduce bugs related to confusing public interfaces and documentation gaps.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "code cleanup — dead code, duplicated logic, overly complex functions, unclear naming, stale comments, and opportunities to simplify",


🟠 Important: Potential for untested code in code cleanup prompts

The code cleanup prompt introduces new areas for potential dead code and duplicated logic that are not currently covered by tests. This oversight can lead to increased complexity and maintenance challenges.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "design alternatives — areas where a different data structure, algorithm, abstraction, or API design would simplify code, improve correctness, or reduce maintenance burden",


🟠 Important: Lack of tests for design alternatives prompt

The design alternatives prompt has been added without any associated tests. This could result in missed opportunities to simplify code or improve correctness, as the new design considerations may not be validated.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",


🟠 Important: FFI boundary safety prompt lacks test coverage

The FFI boundary safety prompt has been introduced without corresponding tests. This gap could lead to untested safety invariants across language boundaries, potentially exposing the system to vulnerabilities.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",


🟠 Important: Panic safety prompt needs test cases

The panic safety prompt has been added without any tests to validate its effectiveness. This could result in unhandled panic scenarios in production code paths, which is critical for a no_std-compatible library.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "performance bottlenecks — hot paths, unnecessary allocations, redundant cloning, inefficient data structures, and missed optimization opportunities",


🟠 Important: Performance audit prompt lacks testing

The performance audit prompt has been introduced without corresponding tests. This could lead to undetected performance bottlenecks and missed optimization opportunities in the evaluation and compilation paths.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",


🟠 Important: Resource limits prompt needs test coverage

The resource limits prompt has been added without any associated tests. This gap could result in untested code paths that may consume unbounded resources, leading to potential Denial of Service vulnerabilities.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",


🟠 Important: Security hardening prompt lacks tests

The security hardening prompt has been introduced without corresponding tests. This oversight could expose the policy engine to vulnerabilities from untrusted inputs, as the new security measures may not be validated.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "test coverage gaps — untested code paths, missing edge cases, weak assertions, and areas where property-based or fuzz testing would add value",


🟠 Important: Test gaps prompt needs validation

The test gaps prompt has been added without any associated tests. This could lead to untested code paths and weak assertions, increasing the risk of bugs in complex areas of the codebase.

github-actions · 2026-04-26T16:20:44Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",


🟠 Important: Undefined propagation prompt lacks testing

The undefined propagation prompt has been introduced without corresponding tests. This gap could lead to untested scenarios involving three-valued logic, which is critical for ensuring correct behavior in the evaluation pipeline.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

⚙️ Reliability Engineer — 7 finding(s)

github-actions · 2026-04-26T17:51:05Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",


🟠 Important: Missing Error Handling in FFI Functions

The FFI boundary safety topic emphasizes the importance of memory safety and error propagation across language boundaries. It is crucial to ensure that all FFI functions validate pointer parameters to prevent null dereferences, which could lead to crashes or undefined behavior.

github-actions · 2026-04-26T17:51:05Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",


🟠 Important: Potential Panic Points in Code

The panic safety topic highlights the need to identify potential panic points in the code, such as unwraps and expects. These can lead to crashes in production environments, especially in a no_std context where reliability is paramount.

github-actions · 2026-04-26T17:51:05Z

@@ -0,0 +1,5 @@
+{
+  "topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",


🟠 Important: Resource Limits and DoS Protection

The resource limits topic addresses the need for enforcing limits on memory and computation to prevent denial-of-service attacks. It is essential to ensure that all code paths that could consume unbounded resources are properly guarded.

github-actions · 2026-04-26T17:51:05Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",


🟠 Important: Undefined Value Propagation Handling

The undefined value propagation topic focuses on the correct handling of three-valued logic throughout the evaluation pipeline. Ensuring that Undefined values are correctly propagated is critical to maintaining the integrity of evaluations.

github-actions · 2026-04-26T17:51:06Z

@@ -0,0 +1,5 @@
+{
+  "topic": "API ergonomics — confusing public interfaces, missing builder patterns, inconsistent naming, poor error messages, and documentation gaps in the public API",


🔵 Suggestion: Documentation Gaps in Public API

The API ergonomics topic suggests reviewing the public API surface for documentation gaps. Clear and comprehensive documentation is essential for downstream consumers to effectively utilize the API.

github-actions · 2026-04-26T17:51:06Z

@@ -0,0 +1,5 @@
+{
+  "topic": "code cleanup — dead code, duplicated logic, overly complex functions, unclear naming, stale comments, and opportunities to simplify",


🔵 Suggestion: Code Cleanup Opportunities

The code cleanup topic identifies areas where dead code, duplicated logic, or overly complex functions can be simplified. Reducing complexity without changing behavior can improve maintainability and reliability.

github-actions · 2026-04-26T17:51:06Z

@@ -0,0 +1,5 @@
+{
+  "topic": "design alternatives — areas where a different data structure, algorithm, abstraction, or API design would simplify code, improve correctness, or reduce maintenance burden",


🔵 Suggestion: Design Alternatives for Improved Robustness

The design alternatives topic encourages exploring different data structures or algorithms that could simplify code and improve correctness. Evaluating alternative designs can reduce the maintenance burden and enhance system reliability.

github-actions

🧪 Test Engineer — 12 finding(s)

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "API ergonomics — confusing public interfaces, missing builder patterns, inconsistent naming, poor error messages, and documentation gaps in the public API",


🟠 Important: New audit prompts added for various perspectives

New prompts have been added to audit API ergonomics, focusing on confusing public interfaces and documentation gaps. This enhances the testing strategy by ensuring that API usability is evaluated from multiple perspectives.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "code cleanup — dead code, duplicated logic, overly complex functions, unclear naming, stale comments, and opportunities to simplify",


🟠 Important: Code cleanup prompts introduced

Prompts for identifying code cleanup opportunities have been added. This will help in maintaining code quality by addressing dead code, duplicated logic, and overly complex functions.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "design alternatives — areas where a different data structure, algorithm, abstraction, or API design would simplify code, improve correctness, or reduce maintenance burden",


🟠 Important: Design alternatives prompts added

New prompts for evaluating design alternatives have been introduced. This encourages exploration of different data structures and algorithms that could simplify the codebase.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",


🟠 Important: FFI boundary safety prompts added

Prompts for auditing FFI boundary safety have been added, focusing on memory safety and error propagation. This is crucial for ensuring that interactions between Rust and other languages are secure.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",


🟠 Important: Panic safety prompts introduced

New prompts for identifying potential panic points in the code have been added. This is essential for maintaining reliability in production environments, especially for no_std-compatible libraries.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",


🟠 Important: Security hardening prompts introduced

Prompts for conducting a comprehensive security review have been added. This focuses on input validation and untrusted policy handling, which are critical for maintaining security.

github-actions · 2026-04-26T17:51:19Z

@@ -0,0 +1,5 @@
+{
+  "topic": "test coverage gaps — untested code paths, missing edge cases, weak assertions, and areas where property-based or fuzz testing would add value",


🟠 Important: Test coverage gaps prompts added

New prompts for identifying test coverage gaps have been introduced. This will help in ensuring that untested code paths and edge cases are adequately covered by tests.

github-actions · 2026-04-26T17:51:20Z

@@ -0,0 +1,5 @@
+{
+  "topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",


🟠 Important: Undefined value propagation prompts added

Prompts for verifying correct handling of undefined values have been added. This is crucial for maintaining the integrity of three-valued logic throughout the evaluation pipeline.

github-actions · 2026-04-26T17:51:20Z

@@ -0,0 +1,462 @@
+#!/usr/bin/env bash


🟠 Important: Codebase audit script added

A new script for conducting codebase audits has been introduced. This script automates the process of discovering relevant files and analyzing them from multiple perspectives.

github-actions · 2026-04-26T17:51:20Z

@@ -0,0 +1,125 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.


🟠 Important: Codebase audit workflow added

A new GitHub Actions workflow for running codebase audits has been added. This allows for manual and scheduled audits, enhancing the overall quality assurance process.

New specialized audit that compares docs/knowledge/*.md against actual source code using LLM analysis. Detects: - Factual inaccuracies (wrong types, signatures, behavior descriptions) - Stale content from refactoring or API changes - Deleted/renamed source files still referenced by knowledge docs - New significant source files (>100 lines) with no knowledge coverage Uses a dedicated script (.github/scripts/knowledge-accuracy.sh) that: 1. Extracts source file references from each knowledge doc 2. Checks file existence (catches deletions/renames) 3. Sends knowledge doc + actual source to LLM for comparison 4. Finds uncovered source files via coverage analysis 5. Posts findings as a rolling GitHub Issue Added to preset rotation (11 presets, ~4 week cycle). Workflow now supports script override via preset JSON 'script' field. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

anakrish and others added 14 commits April 25, 2026 13:20

Merge pull request #33 from anakrish/copilot-config

9437423

feat: add comprehensive GitHub Copilot configuration

feat: add strings.repeat builtin

2225c7e

Revert "feat: add strings.repeat builtin"

4bf4818

This reverts commit 2225c7e.

fix: add pull_request trigger alongside pull_request_target

7de4177

Testing both triggers to determine which fires for same-repo PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: add models:read permission for GitHub Models API access

54f3663

The perspective-review workflow needs the models:read permission on GITHUB_TOKEN to call the GitHub Models API endpoint. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions Bot reviewed Apr 26, 2026

View reviewed changes

Remove accidentally committed editor backup file

556bf4f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions Bot reviewed Apr 26, 2026

View reviewed changes

anakrish force-pushed the main branch 4 times, most recently from c4def37 to 88c7ef8 Compare May 4, 2026 21:34

anakrish force-pushed the main branch 2 times, most recently from b3cc8ab to 369c82a Compare May 5, 2026 00:07

anakrish force-pushed the main branch from 369c82a to acf7f7a Compare May 27, 2026 14:42

anakrish force-pushed the main branch from 6a3b744 to 11940dd Compare June 4, 2026 17:46

		@@ -0,0 +1,5 @@
		{
		"topic": "FFI boundary safety — memory safety, panic containment, handle validation, and error propagation across language boundaries",

		@@ -0,0 +1,5 @@
		{
		"topic": "panic safety — unwrap, expect, index without bounds check, and potential panics in production code paths",

		@@ -0,0 +1,5 @@
		{
		"topic": "resource limits and DoS protection — enforce_limit usage, recursion depth, output size caps, timeout handling, and memory bounds",

		@@ -0,0 +1,5 @@
		{
		"topic": "security hardening — input validation, resource limits, DoS protection, untrusted policy handling, and supply chain safety",

		@@ -0,0 +1,5 @@
		{
		"topic": "undefined value propagation — three-valued logic correctness, Undefined handling in builtins, partial sets, comprehensions, and rule evaluation",

		@@ -0,0 +1,5 @@
		{
		"topic": "API ergonomics — confusing public interfaces, missing builder patterns, inconsistent naming, poor error messages, and documentation gaps in the public API",

		@@ -0,0 +1,5 @@
		{
		"topic": "code cleanup — dead code, duplicated logic, overly complex functions, unclear naming, stale comments, and opportunities to simplify",

		@@ -0,0 +1,5 @@
		{
		"topic": "design alternatives — areas where a different data structure, algorithm, abstraction, or API design would simplify code, improve correctness, or reduce maintenance burden",

		@@ -0,0 +1,5 @@
		{
		"topic": "performance bottlenecks — hot paths, unnecessary allocations, redundant cloning, inefficient data structures, and missed optimization opportunities",

		@@ -0,0 +1,5 @@
		{
		"topic": "test coverage gaps — untested code paths, missing edge cases, weak assertions, and areas where property-based or fuzz testing would add value",

		@@ -0,0 +1,125 @@
		# Copyright (c) Microsoft Corporation. All rights reserved.

Conversation

anakrish commented Apr 26, 2026

Codebase Audit System

How it works

Usage

Preset audits

New files

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!