Add human review gates to code review skill

[David Pine (IEvangelist)]

Description

Issue #19370 exposed a gap in our AI-assisted review workflow. PR #18858 changed a public npm registry to an internal feed, propagated that choice into customer-facing CLI and generated artifacts, changed supply-chain checks, and added tests that asserted the new internal default. Material behavior also changed after the last human approval. The review process found several local issues but did not challenge whether internal build infrastructure should become shipped customer behavior.

This PR keeps the code-review skill's existing high-confidence findings model and adds a separate, provenance-neutral semantic risk pass. A single sensitive trigger now requires human review:

• Trust, security, or supply-chain boundary changes.
• Internal infrastructure flowing into customer-facing behavior or generated artifacts.
• Customer-facing defaults, fallbacks, or source-precedence changes.
• Scope mismatches where dependency, security, generated-file, mechanical, or refactoring work also changes production behavior.
• Material changes added after the latest human approval.

Triggered changes appear in a distinct Human review required section rather than being presented as proven defects. Each item must identify the exact evidence, affected surfaces, implications, required human validation, and whether an existing approval covers the current head. The skill will not recommend or submit APPROVE until the user explicitly confirms that the listed human review occurred.

The review guidance also now requires tracing sensitive values to shipped sinks, separating repository infrastructure from product behavior, comparing removed security controls with their replacements, preferring outcome-oriented boundary validation over implementation-shaped tests, and checking approval freshness. Issue #19370 is included as a calibration case so the guidance generalizes to registries, mirrors, endpoints, credentials, and security controls without special-casing npm.

docs/contributing.md now describes the new human-review escalation and approval gate.

Note

These Copilot skills are living guidance. If these triggers become too noisy or over-escalate routine changes, we can continue to tune the categories, wording, and threshold based on real review experience.

Validation

• Checked the skill's front matter and required output/gating sections.
• Ran the npm registry hard-coded to internal dnceng feed — breaks aspire agent init, and ships as the customer default #19370 scenario as a regression calibration against PR [auto-sec] Consolidate Aspire JavaScript template dependency security remediations #18858, including its internal-customer default, security-control change, generated-artifact default, implementation-shaped test, and ten material commits after the last human approval.
• Confirmed the existing concrete-findings and inline-comment workflow remains separate from human-review disclosures.

Related to #19370

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
    • This is a skill and contributor-documentation change; it was validated structurally and against the historical regression scenario.
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19434

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19434"

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.