diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 5dded306c2..29a88e7a56 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -1356,7 +1356,7 @@ { "name": "github-security", "source": "plugins/github-security", - "description": "Security extension for GitHub Copilot App with a canvas to work on GHAS findings.", + "description": "GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.", "version": "0.2.0" }, { diff --git a/docs/README.plugins.md b/docs/README.plugins.md index 8fd8282fef..51ef6037f8 100644 --- a/docs/README.plugins.md +++ b/docs/README.plugins.md @@ -73,7 +73,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-plugins) for guidelines on how t | [gem-team](../plugins/gem-team/README.md) | Self-Learning Multi-agent orchestration framework for spec-driven development and automated verification. With smarter tool calling and leaner context. | 14 items | multi-agent, orchestration, tdd, testing, e2e, devops, security-audit, code-review, prd, mobile | | [gesture-review](../plugins/gesture-review/README.md) | Review pull requests with a live camera feed and approve or reject using thumbs-up/thumbs-down gestures. | 1 items | camera-input, gesture-control, github-prs, hands-free, mediapipe, pull-request-review | | [git-worktree-explorer](../plugins/git-worktree-explorer/README.md) | Visualize the active Git repository through worktrees, branches, commits, and optional GitHub pull request context. | 1 items | branch-visualization, canvas, commit-history, git, repository-topology, worktrees | -| [github-security](../plugins/github-security/README.md) | Security extension for GitHub Copilot App with a canvas to work on GHAS findings. | 1 items | security, code-scanning, canvas, ghas, alert, finding | +| [github-security](../plugins/github-security/README.md) | GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts. | 1 items | security, code-scanning, canvas, ghas, alert, finding | | [go-mcp-development](../plugins/go-mcp-development/README.md) | Complete toolkit for building Model Context Protocol (MCP) servers in Go using the official github.com/modelcontextprotocol/go-sdk. Includes instructions for best practices, a prompt for generating servers, and an expert chat mode for guidance. | 2 items | go, golang, mcp, model-context-protocol, server-development, sdk | | [java-development](../plugins/java-development/README.md) | Comprehensive collection of prompts and instructions for Java development including Spring Boot, Quarkus, testing, documentation, and best practices. | 4 items | java, springboot, quarkus, jpa, junit, javadoc | | [java-mcp-development](../plugins/java-mcp-development/README.md) | Build Model Context Protocol (MCP) servers in Java with the official MCP Java SDK 2.x. Includes a skill that generates a server project and an expert agent for guidance. | 2 items | java, mcp, model-context-protocol, mcp-java-sdk, server-development, spring-ai | diff --git a/extensions/github-security/README.md b/extensions/github-security/README.md new file mode 100644 index 0000000000..fb9c90bcba --- /dev/null +++ b/extensions/github-security/README.md @@ -0,0 +1,81 @@ +# GitHub Security + +Bring security into your Copilot workflow. The official GitHub Security extension adds a **GitHub Security** canvas to help you catch vulnerabilities early and work through existing findings, all without leaving your session: + +- **Catch new vulnerabilities before they ship.** Run a security review of the changes you're making in the current session, so you can fix problems before you open a pull request. +- **Fix vulnerabilities already in your code.** Bring your repository's existing code scanning alerts into the session and hand them to Copilot to explain and fix. + +![The GitHub Security canvas in the GitHub Copilot App, listing code scanning findings with Fix and Explain actions](https://raw.githubusercontent.com/github/awesome-copilot/main/extensions/github-security/assets/screenshot.png) + +## Features + +### Catch security issues before your pull request + +- **Review as you work.** Run a security review of your session’s changes and see the findings in the canvas. +- **Fix before you push.** Hand review findings back to Copilot to fix in the same session, while the context is still fresh. + +### Work through existing code scanning alerts + +- **Code scanning alerts in your session.** Load code scanning alerts for the current repository from GitHub.com or GitHub Enterprise Cloud and browse them alongside your code. +- **Filter and triage.** Filter findings by severity, tools, or assignees, and see assignees, tags and linked pull requests at a glance. +- **Dismiss alerts.** Dismiss code scanning alerts with a reason directly from the canvas. + +### Understand and fix each finding + +- **See the code around it.** Findings include a highlighted snippet from your checkout. +- **Get a clear explanation.** Ask Copilot to explain one or more findings. +- **Make a fix you can review.** Ask Copilot to update your code, then review its changes. + +## Requirements + +- The GitHub Copilot App. Standalone Copilot CLI is not supported. +- A repository on GitHub.com or GitHub Enterprise Cloud. GitHub Enterprise Server is not supported. +- Access to code scanning alerts for the repository (GitHub Advanced Security or GitHub Code Security), to work with existing alerts. +- A local checkout of the repository, opened as a session in the Copilot App. + +To load existing code scanning alerts, your Copilot App version must support GitHub authentication for extensions. Security reviews of your session's changes work without it. + +## Install + +### From the Copilot App + +1. Open **Customize** and select the **Plugins** tab. +2. Find **github-security** in the **awesome-copilot** marketplace and select **Install**. +3. Reload extensions. You may need to start a new session before the **GitHub Security** canvas appears. + +### From the terminal + +With the Copilot App closed, run: + +```shell +copilot plugin install github-security@awesome-copilot +``` + +To keep the extension current, open the **Update all** menu on the **Plugins** tab and select **Update plugins automatically**, or run `copilot plugin update github-security@awesome-copilot`. + +## Agent tools + +The extension registers tools that Copilot can call during a session. Each call goes through Copilot's normal per-invocation approval, the extension never bypasses tool permission prompts. + +| Tool | What it does | +| --- | --- | +| `fetchGhasFindings` | Loads code scanning alerts for the current repository into the canvas. | +| `loadLocalFindings` | Adds findings from a local security review to the canvas. | +| `runFindingWorkflow` | Runs the explain, fix or recheck workflow for selected findings. | +| `reportFindingStatus` | Records whether a finding is resolved or still present after a fix or recheck. | +| `getExtensionState` | Reads the canvas state so Copilot knows which findings you're looking at. | + +## Data and permissions + +- The extension authenticates with the GitHub account you're signed in to in the Copilot App. It doesn't ask for or store tokens. +- Code scanning API requests use the repository's host, and the canvas loads assignee avatars from URLs returned by GitHub. The canvas runs on a local loopback server: static assets do not require authentication, while state, command and code-snippet endpoints require a per-instance token. +- Explain, fix and recheck run in your existing Copilot session and model. The extension doesn't call any other AI service. +- **Resolved** and **In progress** statuses set by Copilot are local to your session. They don't close or change code scanning alerts. Only an explicit **Dismiss** action updates the alert on GitHub. + +Security findings and generated fixes require review. They don't guarantee that a repository is free of vulnerabilities. + +## Third-party notices + +The bundled dependencies' versions, licenses and notices are included with the +[extension](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/THIRD_PARTY_NOTICES.md) and +[canvas](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/client/THIRD_PARTY_NOTICES.md). diff --git a/extensions/github-security/assets/preview.png b/extensions/github-security/assets/preview.png index c8987b829f..072cf13df1 100644 Binary files a/extensions/github-security/assets/preview.png and b/extensions/github-security/assets/preview.png differ diff --git a/extensions/github-security/assets/screenshot.png b/extensions/github-security/assets/screenshot.png new file mode 100644 index 0000000000..072cf13df1 Binary files /dev/null and b/extensions/github-security/assets/screenshot.png differ diff --git a/extensions/github-security/extension.mjs b/extensions/github-security/extension.mjs index 6ed8583975..43eed41812 100644 --- a/extensions/github-security/extension.mjs +++ b/extensions/github-security/extension.mjs @@ -10552,7 +10552,7 @@ var session = await joinSession({ ], canvases: [createCanvas({ id: "security", - displayName: "Security", + displayName: "GitHub Security", description: "Canvas to display and act on security findings.", open: async (ctx) => { sessionInfo.setWorkingDirectory(ctx.session?.workingDirectory); diff --git a/plugins/github-security/README.md b/plugins/github-security/README.md index d4b8506b19..fb9c90bcba 100644 --- a/plugins/github-security/README.md +++ b/plugins/github-security/README.md @@ -1,27 +1,81 @@ -# Security extension +# GitHub Security -The Security extension for GitHub Copilot App provides a canvas for reviewing -GitHub Advanced Security code scanning alerts and local security findings. -Use the canvas to inspect findings and ask Copilot to explain, fix, or recheck -selected local findings. +Bring security into your Copilot workflow. The official GitHub Security extension adds a **GitHub Security** canvas to help you catch vulnerabilities early and work through existing findings, all without leaving your session: + +- **Catch new vulnerabilities before they ship.** Run a security review of the changes you're making in the current session, so you can fix problems before you open a pull request. +- **Fix vulnerabilities already in your code.** Bring your repository's existing code scanning alerts into the session and hand them to Copilot to explain and fix. + +![The GitHub Security canvas in the GitHub Copilot App, listing code scanning findings with Fix and Explain actions](https://raw.githubusercontent.com/github/awesome-copilot/main/extensions/github-security/assets/screenshot.png) + +## Features + +### Catch security issues before your pull request + +- **Review as you work.** Run a security review of your session’s changes and see the findings in the canvas. +- **Fix before you push.** Hand review findings back to Copilot to fix in the same session, while the context is still fresh. + +### Work through existing code scanning alerts + +- **Code scanning alerts in your session.** Load code scanning alerts for the current repository from GitHub.com or GitHub Enterprise Cloud and browse them alongside your code. +- **Filter and triage.** Filter findings by severity, tools, or assignees, and see assignees, tags and linked pull requests at a glance. +- **Dismiss alerts.** Dismiss code scanning alerts with a reason directly from the canvas. + +### Understand and fix each finding + +- **See the code around it.** Findings include a highlighted snippet from your checkout. +- **Get a clear explanation.** Ask Copilot to explain one or more findings. +- **Make a fix you can review.** Ask Copilot to update your code, then review its changes. ## Requirements -- GitHub Copilot App. Standalone Copilot CLI is not supported. -- Access to code scanning alerts in the selected repository when loading - GitHub Advanced Security findings. +- The GitHub Copilot App. Standalone Copilot CLI is not supported. +- A repository on GitHub.com or GitHub Enterprise Cloud. GitHub Enterprise Server is not supported. +- Access to code scanning alerts for the repository (GitHub Advanced Security or GitHub Code Security), to work with existing alerts. +- A local checkout of the repository, opened as a session in the Copilot App. + +To load existing code scanning alerts, your Copilot App version must support GitHub authentication for extensions. Security reviews of your session's changes work without it. + +## Install + +### From the Copilot App + +1. Open **Customize** and select the **Plugins** tab. +2. Find **github-security** in the **awesome-copilot** marketplace and select **Install**. +3. Reload extensions. You may need to start a new session before the **GitHub Security** canvas appears. + +### From the terminal + +With the Copilot App closed, run: + +```shell +copilot plugin install github-security@awesome-copilot +``` + +To keep the extension current, open the **Update all** menu on the **Plugins** tab and select **Update plugins automatically**, or run `copilot plugin update github-security@awesome-copilot`. + +## Agent tools + +The extension registers tools that Copilot can call during a session. Each call goes through Copilot's normal per-invocation approval, the extension never bypasses tool permission prompts. + +| Tool | What it does | +| --- | --- | +| `fetchGhasFindings` | Loads code scanning alerts for the current repository into the canvas. | +| `loadLocalFindings` | Adds findings from a local security review to the canvas. | +| `runFindingWorkflow` | Runs the explain, fix or recheck workflow for selected findings. | +| `reportFindingStatus` | Records whether a finding is resolved or still present after a fix or recheck. | +| `getExtensionState` | Reads the canvas state so Copilot knows which findings you're looking at. | -## Getting started +## Data and permissions -Install the `github-security` plugin from your configured marketplace, then -open the **Security** canvas in a repository session. GitHub access uses the -repository's GitHub account in Copilot App. +- The extension authenticates with the GitHub account you're signed in to in the Copilot App. It doesn't ask for or store tokens. +- Code scanning API requests use the repository's host, and the canvas loads assignee avatars from URLs returned by GitHub. The canvas runs on a local loopback server: static assets do not require authentication, while state, command and code-snippet endpoints require a per-instance token. +- Explain, fix and recheck run in your existing Copilot session and model. The extension doesn't call any other AI service. +- **Resolved** and **In progress** statuses set by Copilot are local to your session. They don't close or change code scanning alerts. Only an explicit **Dismiss** action updates the alert on GitHub. -Security findings and generated fixes require review; they do not guarantee -that a repository is free of vulnerabilities. +Security findings and generated fixes require review. They don't guarantee that a repository is free of vulnerabilities. ## Third-party notices -The bundled dependencies' versions, licenses, and notices are included with the +The bundled dependencies' versions, licenses and notices are included with the [extension](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/THIRD_PARTY_NOTICES.md) and [canvas](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/client/THIRD_PARTY_NOTICES.md). diff --git a/plugins/github-security/assets/preview.png b/plugins/github-security/assets/preview.png new file mode 100644 index 0000000000..c8987b829f Binary files /dev/null and b/plugins/github-security/assets/preview.png differ diff --git a/plugins/github-security/plugin.json b/plugins/github-security/plugin.json index 30c139503d..031bb380f9 100644 --- a/plugins/github-security/plugin.json +++ b/plugins/github-security/plugin.json @@ -2,7 +2,7 @@ "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "github-security", "version": "0.2.0", - "description": "Security extension for GitHub Copilot App with a canvas to work on GHAS findings.", + "description": "GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.", "keywords": [ "security", "code-scanning",