Skip to content

Commit 721df5c

Browse files
jacwujacwu
committed
Add PR Copilot PII Review workflow
- Create a new GitHub Actions workflow for PR Copilot PII Review. - Set up triggers for pull request events. - Define job steps to check out code, set up Node.js, compute diffs, and run PII reviews. - Install Copilot CLI and handle review output formatting. - Post review results as comments on the pull request and upload relevant artifacts. - Update GitHub Copilot features documentation to reflect changes in agent capabilities.
1 parent eb8c93f commit 721df5c

2 files changed

Lines changed: 145 additions & 1 deletion

File tree

‎.github/workflows/pr-copilot-PII-review.yml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
name: PR Copilot PII Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, ready_for_review, synchronize]
6+
7+
8+
permissions:
9+
contents: read
10+
pull-requests: write
11+
12+
jobs:
13+
copilot_pii_review:
14+
name: Copilot PII Review
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0
21+
22+
- name: Set up Node.js
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: '22'
26+
27+
- name: Compute diff and changed files
28+
id: diff
29+
run: |
30+
BASE_SHA="${{ github.event.pull_request.base.sha }}"
31+
HEAD_SHA="${{ github.event.pull_request.head.sha }}"
32+
33+
git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed_files.txt
34+
git diff --unified=3 "$BASE_SHA" "$HEAD_SHA" > diff.patch
35+
36+
if [ ! -s changed_files.txt ]; then
37+
echo "no_changes=true" >> "$GITHUB_OUTPUT"
38+
else
39+
echo "no_changes=false" >> "$GITHUB_OUTPUT"
40+
fi
41+
42+
- name: Install Copilot CLI
43+
if: steps.diff.outputs.no_changes == 'false'
44+
run: |
45+
npm install -g @github/copilot
46+
copilot --version
47+
48+
- name: Run Copilot PII review
49+
env:
50+
GITHUB_TOKEN: ${{ secrets.COPILOT_CLI_PAT }}
51+
if: steps.diff.outputs.no_changes == 'false'
52+
run: |
53+
if [ -z "$GITHUB_TOKEN" ]; then
54+
echo "GITHUB_TOKEN secret is not configured." >&2
55+
exit 1
56+
fi
57+
58+
printf 'GITHUB_TOKEN is set: ${{secrets.COPILOT_CLI_PAT}}'
59+
60+
HEADER="You are a professional security expert specializing in PII (Personally Identifiable Information) detection. The current working directory is a Git repository undergoing a Pull Request code review."
61+
62+
REVIEW_REQUIREMENTS="**Review Task**:
63+
Analyze the provided code diff for potential PII exposure and privacy concerns.
64+
65+
**Changed Files**: $(cat changed_files.txt | tr '\n' ', ' | sed 's/,$//')
66+
67+
**Review Requirements**:
68+
Please focus on the following PII-related aspects and provide a detailed security review:
69+
1. Direct PII exposure (names, emails, phone numbers, addresses, SSN, credit card numbers, etc.)
70+
2. Indirect PII that could identify individuals when combined
71+
3. Hardcoded credentials, API keys, or tokens
72+
4. Logging or printing of sensitive user data
73+
5. Insufficient data masking or anonymization
74+
6. PII stored in comments, test data, or configuration files
75+
7. Potential GDPR, CCPA, or other privacy regulation violations"
76+
77+
RULES="**Output Format Requirements**:
78+
Provide specific, actionable feedback including:
79+
1. Relevant file names and line numbers
80+
2. Clear issue descriptions
81+
3. Concrete fix recommendations
82+
4. Severity levels (info, minor, major, critical)
83+
5. Organize the review report in markdown format with clear section structure
84+
85+
**Mandatory Requirements**:
86+
1. Base your review on the actual diff content provided below
87+
2. Provide comprehensive PII analysis with specific examples where applicable
88+
3. Prioritize critical privacy concerns that could lead to data breaches"
89+
90+
REVIEW_FALLBACK="No Personally Identifiable Information (PII) exposure or privacy concerns were detected in the analyzed code changes."
91+
92+
DIFF_SECTION="**Unified diff**:\n$(cat diff.patch)"
93+
94+
export COPILOT_PROMPT="$HEADER\n\n$REVIEW_REQUIREMENTS\n\n$RULES\n\n$DIFF_SECTION"
95+
96+
printf '%s\n' "$COPILOT_PROMPT"
97+
98+
copilot -p "$COPILOT_PROMPT" | tee copilot_raw.txt >/dev/null
99+
100+
printf '\n\nRaw Copilot Output:\n%s\n' "$(cat copilot_raw.txt)"
101+
102+
sed -E 's/\x1B\[[0-9;]*[A-Za-z]//g' copilot_raw.txt | tr -d '\r' > raw_review.md
103+
104+
if ! grep -q '|' raw_review.md; then
105+
printf '%s\n' "$REVIEW_FALLBACK" > raw_review.md
106+
fi
107+
108+
- name: Format review output
109+
run: |
110+
PR_NUMBER="${{ github.event.pull_request.number }}"
111+
112+
cat > review_result.md <<EOF
113+
**GitHub Copilot CLI PII Review**
114+
115+
---
116+
117+
This is an PII security review generated by GitHub Copilot CLI for pull request #${PR_NUMBER}.
118+
119+
### Review Feedback
120+
121+
$(cat raw_review.md)
122+
123+
---
124+
125+
This is an PII security review by GitHub Copilot CLI. Please use human judgment when evaluating suggestions.
126+
EOF
127+
128+
- name: Post review as PR comment
129+
env:
130+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
131+
run: |
132+
gh pr comment ${{ github.event.pull_request.number }} --body-file review_result.md
133+
134+
- name: Upload Copilot raw output
135+
if: steps.diff.outputs.no_changes == 'false'
136+
uses: actions/upload-artifact@v4
137+
with:
138+
name: copilot-review-logs
139+
path: |
140+
copilot_raw.txt
141+
raw_review.md
142+
review_result.md
143+
diff.patch
144+
changed_files.txt

‎github-copilot-features-status/copilot-ide-features.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
| Custom Code Review Instruction | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
6565
| Custom PR Description Instruction | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
6666
| Reusable Prompt File | ✅ | ❌ | ✅ | ✅ | ❌ | ❌ |
67-
| AGENTS.md | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
67+
| AGENTS.md | ✅ | ❌ | ✅ | ❌ | ❌ | ✅ |
6868

6969
# GitHub Copilot Misc Features Comparison
7070

0 commit comments

Comments
 (0)