Revamp code review skill

[jonathanpeppers]

🤖 GitHub recommends a review-focused skill directory such as code-review when Copilot code review should reliably load repository guidance. Rename the existing dotnes skill to follow that convention and strengthen its review coverage.

Summary

• Rename code-reviewer to code-review, including matching frontmatter and workflow references.
• Incorporate applicable guidance from dotnet/android for target-framework compatibility, cancellation and thread safety, process handling, MSBuild incrementality, path and archive safety, deterministic testing, and false-positive control.
• Add dotnes-specific native C and cc65 review rules for behavioral reference parity, memory limits, ownership, and fixed-width data.
• Update the agentic reviewer workflow to use gpt-5.6-sol with unrestricted shell and network access for this personal project.
• Regenerate the workflow lock with gh-aw v0.88.7, which also refreshes its generated action and runtime pins.
• Update Microsoft.SourceLink.GitHub to 10.0.401 to clear GHSA-23fw-v26w-5fgq and unblock Copilot review setup.

[Copilot]

🟡 Changes recommended

Several new rules contradict supported transpiler behavior, and the firewall configuration prevents the newly enabled Azure DevOps CLI access.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Renames and expands the repository’s code-review skill while upgrading its agentic workflow.

Changes:

• Renames code-reviewer to code-review and broadens review guidance.
• Adds framework, NES, cc65, security, testing, and MSBuild rules.
• Upgrades the reviewer workflow, model, and generated gh-aw lock.

File summaries

File	Description
.github/workflows/dotnes-reviewer.md	Updates model, tools, and skill paths.
.github/workflows/dotnes-reviewer.lock.yml	Regenerates the compiled workflow.
.github/skills/code-review/SKILL.md	Renames and expands the review methodology.
references/transpiler-rules.md	Adds transpiler-specific checks.
references/testing-rules.md	Expands determinism and concurrency guidance.
references/security-rules.md	Adds path, archive, and process safety rules.
references/repo-conventions.md	Adds repository conventions.
references/nes-program-rules.md	Adds NES program guidance.
references/native-rules.md	Adds native C and cc65 rules.
references/msbuild-rules.md	Expands MSBuild guidance.
references/csharp-rules.md	Adds compatibility and concurrency guidance.
references/ai-pitfalls.md	Adds AI-review pitfalls.
.github/aw/actions-lock.json	Updates pinned workflow setup action.
.gitattributes	Removes the custom lock-file merge driver.

Review details

Suppressed comments (1)

.github/skills/code-review/references/security-rules.md:13

• 🤖 ⚠️ Documentation — $(OutputPath)/$(NESTargetPath) are normal caller-controlled MSBuild destinations and may legitimately point outside the project directory. Requiring containment under an “expected” build directory would flag valid configurations and encourage a breaking restriction; containment belongs where an untrusted path component is resolved beneath a trusted root.

• Files reviewed: 11/14 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Build the project

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🔵 Needs a closer look

Several new rules contradict supported transpiler behavior, and the workflow cannot access the Actions logs it now requires reviewers to inspect.

Review details

Suppressed comments (1)

.github/skills/code-review/SKILL.md:69

• 🤖 ❌ Operational implications — The reviewer is now required to inspect failed job logs, but .github/workflows/dotnes-reviewer.md:7-23 grants no actions: read permission and exposes only the pull_requests and repos GitHub toolsets; the generated agent job likewise has only contents/PR read permissions. The agent therefore cannot reliably perform this step. Grant Actions read access and expose the Actions toolset when regenerating the workflow.

• Files reviewed: 12/15 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Several new rules contradict supported transpiler behavior and would produce incorrect reviews.

Review details

• Files reviewed: 12/15 changed files
• Comments generated: 0 new
• Review effort level: Balanced