Publish github-security 0.2.0

.github/plugin/marketplace.json

@@ -1356,7 +1356,7 @@
     {
       "name": "github-security",
       "source": "plugins/github-security",
-      "description": "Security extension for GitHub Copilot App with a canvas to work on GHAS findings.",
+      "description": "GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.",
       "version": "0.2.0"
     },
     {

docs/README.plugins.md

@@ -73,7 +73,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-plugins) for guidelines on how t
 | [gem-team](../plugins/gem-team/README.md) | Self-Learning Multi-agent orchestration framework for spec-driven development and automated verification. With smarter tool calling and leaner context. | 14 items | multi-agent, orchestration, tdd, testing, e2e, devops, security-audit, code-review, prd, mobile |
 | [gesture-review](../plugins/gesture-review/README.md) | Review pull requests with a live camera feed and approve or reject using thumbs-up/thumbs-down gestures. | 1 items | camera-input, gesture-control, github-prs, hands-free, mediapipe, pull-request-review |
 | [git-worktree-explorer](../plugins/git-worktree-explorer/README.md) | Visualize the active Git repository through worktrees, branches, commits, and optional GitHub pull request context. | 1 items | branch-visualization, canvas, commit-history, git, repository-topology, worktrees |
-| [github-security](../plugins/github-security/README.md) | Security extension for GitHub Copilot App with a canvas to work on GHAS findings. | 1 items | security, code-scanning, canvas, ghas, alert, finding |
+| [github-security](../plugins/github-security/README.md) | GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts. | 1 items | security, code-scanning, canvas, ghas, alert, finding |
 | [go-mcp-development](../plugins/go-mcp-development/README.md) | Complete toolkit for building Model Context Protocol (MCP) servers in Go using the official github.com/modelcontextprotocol/go-sdk. Includes instructions for best practices, a prompt for generating servers, and an expert chat mode for guidance. | 2 items | go, golang, mcp, model-context-protocol, server-development, sdk |
 | [java-development](../plugins/java-development/README.md) | Comprehensive collection of prompts and instructions for Java development including Spring Boot, Quarkus, testing, documentation, and best practices. | 4 items | java, springboot, quarkus, jpa, junit, javadoc |
 | [java-mcp-development](../plugins/java-mcp-development/README.md) | Build Model Context Protocol (MCP) servers in Java with the official MCP Java SDK 2.x. Includes a skill that generates a server project and an expert agent for guidance. | 2 items | java, mcp, model-context-protocol, mcp-java-sdk, server-development, spring-ai |

extensions/github-security/README.md

@@ -0,0 +1,81 @@
+# GitHub Security
+
+Bring security into your Copilot workflow. The official GitHub Security extension adds a **GitHub Security** canvas to help you catch vulnerabilities early and work through existing findings, all without leaving your session:
+
+- **Catch new vulnerabilities before they ship.** Run a security review of the changes you're making in the current session, so you can fix problems before you open a pull request.
+- **Fix vulnerabilities already in your code.** Bring your repository's existing code scanning alerts into the session and hand them to Copilot to explain and fix.
+
+![The GitHub Security canvas in the GitHub Copilot App, listing code scanning findings with Fix and Explain actions](https://raw.githubusercontent.com/github/awesome-copilot/main/extensions/github-security/assets/screenshot.png)
+
+## Features
+
+### Catch security issues before your pull request
+
+- **Review as you work.** Run a security review of your session’s changes and see the findings in the canvas.
+- **Fix before you push.** Hand review findings back to Copilot to fix in the same session, while the context is still fresh.
+
+### Work through existing code scanning alerts
+
+- **Code scanning alerts in your session.** Load code scanning alerts for the current repository from GitHub.com or GitHub Enterprise Cloud and browse them alongside your code.
+- **Filter and triage.** Filter findings by severity, tools, or assignees, and see assignees, tags and linked pull requests at a glance.
+- **Dismiss alerts.** Dismiss code scanning alerts with a reason directly from the canvas.
+
+### Understand and fix each finding
+
+- **See the code around it.** Findings include a highlighted snippet from your checkout.
+- **Get a clear explanation.** Ask Copilot to explain one or more findings.
+- **Make a fix you can review.** Ask Copilot to update your code, then review its changes.
+
+## Requirements
+
+- The GitHub Copilot App. Standalone Copilot CLI is not supported.
+- A repository on GitHub.com or GitHub Enterprise Cloud. GitHub Enterprise Server is not supported.
+- Access to code scanning alerts for the repository (GitHub Advanced Security or GitHub Code Security), to work with existing alerts.
+- A local checkout of the repository, opened as a session in the Copilot App.
+
+To load existing code scanning alerts, your Copilot App version must support GitHub authentication for extensions. Security reviews of your session's changes work without it.
+
+## Install
+
+### From the Copilot App
+
+1. Open **Customize** and select the **Plugins** tab.
+2. Find **github-security** in the **awesome-copilot** marketplace and select **Install**.
+3. Reload extensions. You may need to start a new session before the **GitHub Security** canvas appears.
+
+### From the terminal
+
+With the Copilot App closed, run:
+
+```shell
+copilot plugin install github-security@awesome-copilot
+```
+
+To keep the extension current, open the **Update all** menu on the **Plugins** tab and select **Update plugins automatically**, or run `copilot plugin update github-security@awesome-copilot`.
+
+## Agent tools
+
+The extension registers tools that Copilot can call during a session. Each call goes through Copilot's normal per-invocation approval, the extension never bypasses tool permission prompts.
+
+| Tool | What it does |
+| --- | --- |
+| `fetchGhasFindings` | Loads code scanning alerts for the current repository into the canvas. |
+| `loadLocalFindings` | Adds findings from a local security review to the canvas. |
+| `runFindingWorkflow` | Runs the explain, fix or recheck workflow for selected findings. |
+| `reportFindingStatus` | Records whether a finding is resolved or still present after a fix or recheck. |
+| `getExtensionState` | Reads the canvas state so Copilot knows which findings you're looking at. |
+
+## Data and permissions
+
+- The extension authenticates with the GitHub account you're signed in to in the Copilot App. It doesn't ask for or store tokens.
+- Code scanning API requests use the repository's host, and the canvas loads assignee avatars from URLs returned by GitHub. The canvas runs on a local loopback server: static assets do not require authentication, while state, command and code-snippet endpoints require a per-instance token.
+- Explain, fix and recheck run in your existing Copilot session and model. The extension doesn't call any other AI service.
+- **Resolved** and **In progress** statuses set by Copilot are local to your session. They don't close or change code scanning alerts. Only an explicit **Dismiss** action updates the alert on GitHub.
+
+Security findings and generated fixes require review. They don't guarantee that a repository is free of vulnerabilities.
+
+## Third-party notices
+
+The bundled dependencies' versions, licenses and notices are included with the
+[extension](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/THIRD_PARTY_NOTICES.md) and
+[canvas](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/client/THIRD_PARTY_NOTICES.md).

extensions/github-security/extension.mjs

@@ -10552,7 +10552,7 @@ var session = await joinSession({
 	],
 	canvases: [createCanvas({
 		id: "security",
-		displayName: "Security",
+		displayName: "GitHub Security",
 		description: "Canvas to display and act on security findings.",
 		open: async (ctx) => {
 			sessionInfo.setWorkingDirectory(ctx.session?.workingDirectory);

plugins/github-security/README.md

@@ -1,27 +1,81 @@
-# Security extension
+# GitHub Security
 
-The Security extension for GitHub Copilot App provides a canvas for reviewing
-GitHub Advanced Security code scanning alerts and local security findings.
-Use the canvas to inspect findings and ask Copilot to explain, fix, or recheck
-selected local findings.
+Bring security into your Copilot workflow. The official GitHub Security extension adds a **GitHub Security** canvas to help you catch vulnerabilities early and work through existing findings, all without leaving your session:
+
+- **Catch new vulnerabilities before they ship.** Run a security review of the changes you're making in the current session, so you can fix problems before you open a pull request.
+- **Fix vulnerabilities already in your code.** Bring your repository's existing code scanning alerts into the session and hand them to Copilot to explain and fix.
+
+![The GitHub Security canvas in the GitHub Copilot App, listing code scanning findings with Fix and Explain actions](https://raw.githubusercontent.com/github/awesome-copilot/main/extensions/github-security/assets/screenshot.png)
+
+## Features
+
+### Catch security issues before your pull request
+
+- **Review as you work.** Run a security review of your session’s changes and see the findings in the canvas.
+- **Fix before you push.** Hand review findings back to Copilot to fix in the same session, while the context is still fresh.
+
+### Work through existing code scanning alerts
+
+- **Code scanning alerts in your session.** Load code scanning alerts for the current repository from GitHub.com or GitHub Enterprise Cloud and browse them alongside your code.
+- **Filter and triage.** Filter findings by severity, tools, or assignees, and see assignees, tags and linked pull requests at a glance.
+- **Dismiss alerts.** Dismiss code scanning alerts with a reason directly from the canvas.
+
+### Understand and fix each finding
+
+- **See the code around it.** Findings include a highlighted snippet from your checkout.
+- **Get a clear explanation.** Ask Copilot to explain one or more findings.
+- **Make a fix you can review.** Ask Copilot to update your code, then review its changes.
 
 ## Requirements
 
-- GitHub Copilot App. Standalone Copilot CLI is not supported.
-- Access to code scanning alerts in the selected repository when loading
-  GitHub Advanced Security findings.
+- The GitHub Copilot App. Standalone Copilot CLI is not supported.
+- A repository on GitHub.com or GitHub Enterprise Cloud. GitHub Enterprise Server is not supported.
+- Access to code scanning alerts for the repository (GitHub Advanced Security or GitHub Code Security), to work with existing alerts.
+- A local checkout of the repository, opened as a session in the Copilot App.
+
+To load existing code scanning alerts, your Copilot App version must support GitHub authentication for extensions. Security reviews of your session's changes work without it.
+
+## Install
+
+### From the Copilot App
+
+1. Open **Customize** and select the **Plugins** tab.
+2. Find **github-security** in the **awesome-copilot** marketplace and select **Install**.
+3. Reload extensions. You may need to start a new session before the **GitHub Security** canvas appears.
+
+### From the terminal
+
+With the Copilot App closed, run:
+
+```shell
+copilot plugin install github-security@awesome-copilot
+```
+
+To keep the extension current, open the **Update all** menu on the **Plugins** tab and select **Update plugins automatically**, or run `copilot plugin update github-security@awesome-copilot`.
+
+## Agent tools
+
+The extension registers tools that Copilot can call during a session. Each call goes through Copilot's normal per-invocation approval, the extension never bypasses tool permission prompts.
+
+| Tool | What it does |
+| --- | --- |
+| `fetchGhasFindings` | Loads code scanning alerts for the current repository into the canvas. |
+| `loadLocalFindings` | Adds findings from a local security review to the canvas. |
+| `runFindingWorkflow` | Runs the explain, fix or recheck workflow for selected findings. |
+| `reportFindingStatus` | Records whether a finding is resolved or still present after a fix or recheck. |
+| `getExtensionState` | Reads the canvas state so Copilot knows which findings you're looking at. |
 
-## Getting started
+## Data and permissions
 
-Install the `github-security` plugin from your configured marketplace, then
-open the **Security** canvas in a repository session. GitHub access uses the
-repository's GitHub account in Copilot App.
+- The extension authenticates with the GitHub account you're signed in to in the Copilot App. It doesn't ask for or store tokens.
+- Code scanning API requests use the repository's host, and the canvas loads assignee avatars from URLs returned by GitHub. The canvas runs on a local loopback server: static assets do not require authentication, while state, command and code-snippet endpoints require a per-instance token.
+- Explain, fix and recheck run in your existing Copilot session and model. The extension doesn't call any other AI service.
+- **Resolved** and **In progress** statuses set by Copilot are local to your session. They don't close or change code scanning alerts. Only an explicit **Dismiss** action updates the alert on GitHub.
 
-Security findings and generated fixes require review; they do not guarantee
-that a repository is free of vulnerabilities.
+Security findings and generated fixes require review. They don't guarantee that a repository is free of vulnerabilities.
 
 ## Third-party notices
 
-The bundled dependencies' versions, licenses, and notices are included with the
+The bundled dependencies' versions, licenses and notices are included with the
 [extension](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/THIRD_PARTY_NOTICES.md) and
 [canvas](https://github.com/github/awesome-copilot/blob/main/extensions/github-security/client/THIRD_PARTY_NOTICES.md).

plugins/github-security/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "github-security",
   "version": "0.2.0",
-  "description": "Security extension for GitHub Copilot App with a canvas to work on GHAS findings.",
+  "description": "GitHub Security canvas for Copilot. Review your session's changes for vulnerabilities and fix code scanning alerts.",
   "keywords": [
     "security",
     "code-scanning",