Implement custom GitHub Action with Copilot CLI integration and full CI/CD pipeline

[Copilot]

Creates a marketplace-ready GitHub Action that delegates tasks to Copilot CLI, automatically creates PRs, and assigns reviewers. Implements the complete workflow: sanitize → copilot → branch → commit → review → PR → assign.

Core Implementation

• Action definition (action.yml): Three inputs - PRIVATE_TOKEN (required PAT), filename (optional), branch (optional, defaults to main)
• Main logic (src/index.js): 323-line JavaScript implementation with security-hardened file operations
  • File sanitization with path traversal prevention and 1MB size limits
  • Copilot CLI integration with automatic extension installation
  • Git operations using diff-index for reliable change detection
  • PR creation and automatic actor assignment

// File content is truncated and size-checked before passing to Copilot
const stats = fs.statSync(filePath);
if (stats.size > MAX_FILE_SIZE) {
  core.warning(`File too large, using generic instructions`);
} else {
  const content = fs.readFileSync(filePath, 'utf8');
  instructions = `${content.substring(0, MAX_INSTRUCTION_LENGTH)}`;
}

Tooling & CI/CD

• Code quality: ESLint + Prettier + Commitlint for conventional commits
• Workflows: CI pipeline with lint/build/test, release-please automation, SonarCloud analysis, Codecov integration
• Dependencies: Dependabot with weekly npm and GitHub Actions updates
• Distribution: Compiled dist/index.js using @vercel/ncc for zero-install action execution

Security

• Input validation against directory traversal (../, absolute paths, invalid characters)
• File size limits prevent memory exhaustion attacks
• No hardcoded secrets, proper token scoping
• Known issue: Low-severity undici vulnerability in @actions/github transitive dependency (tracked upstream)

Documentation

• README with shields.io badges and usage examples
• SECURITY.md detailing threat model and mitigations
• CONTRIBUTING.md with conventional commit guidelines
• Example workflow demonstrating concurrency control and permission configuration

Original prompt

Custom Marketplace GitHub Action with release-please, Node 24 (NO TYPES), prettier, eslint, commitlint, dependabot, sonar, codecov, copilot CLI, shields. Accept a secret as PRIVATE_TOKEN = user PAT for Copilot CLI, single optional filename in repo, optional branch. Concurrency, permissions, timeout. Follows steps: 1. sanitize file, 2. copilot --base ref -F "follow instructions" 3. 3. New branch, 4. Commit/push, 5. copilot "review work|create docs|create tests" 6. New PR, 7.Assign actor.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[sonarqubecloud]

Quality Gate failed

Failed conditions
25.2% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud