Creates a weekly deps upgrade skill and workflow by dluces · Pull Request #263 · microsoft/SharePoint-Embedded-Samples

Diego Luces (dluces) · 2026-08-14T18:27:56Z

Add weekly dependency upgrade skill
Require sample validation evidence for agent PRs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds automated weekly dependency upgrades and repository-wide validation evidence handling.

Changes:

Adds dependency-upgrade workflow, agent, and skills.
Adds validation orchestration, sanitization, and publishing scripts.
Establishes mandatory PR validation evidence requirements.

Validation gate: Required validation evidence is absent from the provided PR metadata.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`AGENTS.md`	Defines validation requirements.
`.gitattributes`	Marks generated workflow locks.
`.github/agents/dependency-upgrade.agent.md`	Configures the upgrade agent.
`.github/copilot-instructions.md`	Enforces validation evidence.
`.github/skills/sample-validation-evidence/SKILL.md`	Documents evidence publication.
`.github/skills/weekly-dependency-upgrade/SKILL.md`	Defines upgrade procedures.
`.github/workflows/weekly-dependency-upgrades.md`	Defines weekly automation.
`.github/workflows/weekly-dependency-upgrades.lock.yml`	Compiled workflow definition.
`Tools/powershell/Invoke-RepositoryValidation.ps1`	Runs sample validators.
`Tools/powershell/Publish-ValidationArtifacts.ps1`	Publishes sanitized evidence.
`Tools/powershell/README.md`	Documents validation tooling.
`Tools/powershell/Sanitize-ValidationArtifacts.ps1`	Sanitizes validation artifacts.

Suppressed comments (1)

.github/workflows/weekly-dependency-upgrades.md:50

The installed upgrade skill requires both gnjoseph and dluces, but the compiled safe-output configuration derives reviewers only from this list and currently assigns just gnjoseph. Add dluces here and recompile the lock file so the workflow can satisfy its own reviewer requirement.

    reviewers:
      - gnjoseph

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Diego Luces (dluces) · 2026-08-18T20:54:20Z

+$outputPath = [System.IO.Path]::GetFullPath($OutputDirectory)
+$allowedOutputRoot = [System.IO.Path]::GetFullPath((Join-Path $repositoryRootPath '.validation/sanitized'))
+if (-not $outputPath.StartsWith($allowedOutputRoot, [System.StringComparison]::OrdinalIgnoreCase)) {
+    throw "OutputDirectory must be under '$allowedOutputRoot'."


Copilot make this suggested change.

Diego Luces (dluces) · 2026-08-18T20:53:58Z

+$artifactPath = (Resolve-Path $ArtifactDirectory).Path
+if (-not $artifactPath.StartsWith($sanitizedRoot, [System.StringComparison]::OrdinalIgnoreCase)) {
+    throw "ArtifactDirectory must be under '$sanitizedRoot'. Raw validation artifacts cannot be published."


Copilot make this suggested change.

Diego Luces (dluces) · 2026-08-18T20:54:50Z

+foreach ($validationDirectory in $validationDirectories) {
+    foreach ($sourceFile in Get-ChildItem -Path $validationDirectory.FullName -File -Recurse -Force) {


Copilot make this suggested change.

Diego Luces (dluces) · 2026-08-18T20:53:06Z

+$discoveredScripts = Get-ChildItem -Path $repositoryRoot -Filter 'validate-sample.ps1' -File -Recurse |
+    Where-Object { $_.FullName -notmatch '[\\/](?:node_modules|bin|obj)[\\/]' } |
+    ForEach-Object { [System.IO.Path]::GetRelativePath($repositoryRoot, $_.FullName).Replace('\', '/') }


Copilot update the README to remove support for PowerShell 5.1 or any version of .NET Framework (only the latest PowerShell version and .Net core should be supported).

Diego Luces (dluces) · 2026-08-18T20:55:16Z

+            continue
+        }
+
+        $relativePath = [System.IO.Path]::GetRelativePath($repositoryRootPath, $sourceFile.FullName)


Copilot declare PowerShell 7 as required.

Co-authored-by: dluces <262662+dluces@users.noreply.github.com>

Agent-Logs-Url: https://github.com/microsoft/SharePoint-Embedded-Samples/sessions/d28f0ca7-1959-47ee-9096-c11d59f17ae9 Co-authored-by: dluces <262662+dluces@users.noreply.github.com>

Gregory Joseph (gnjoseph) · 2026-08-18T20:56:08Z

+
+Before opening or updating a pull request:
+
+1. Run every sample validator with:


should the agent just limit the validator to the sample code it changess

Gregory Joseph (gnjoseph) · 2026-08-19T20:53:10Z

+$homePath = [Environment]::GetFolderPath('UserProfile')
+$sensitiveKeyPattern = '(?i)(authorization|proxy-authorization|cookie|set-cookie|x-api-key|api-key|client[_-]?secret|password|passwd|access[_-]?token|refresh[_-]?token|id[_-]?token|private[_-]?key|connection[_-]?string|account[_-]?key|sas[_-]?token|secret)'


Do we have an eval for this

Gregory Joseph (gnjoseph) · 2026-08-19T20:54:23Z

+$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).Path
+$sanitizedRoot = [System.IO.Path]::GetFullPath((Join-Path $repositoryRoot '.validation/sanitized'))
+
+function Test-PathIsInDirectory {


nit, a lot of these are repeated across different scripts, maybe they should be moved to a utility script thats preimported

Gregory Joseph (gnjoseph) · 2026-08-19T20:56:51Z

+
+Before creating or updating any pull request, use the
+`sample-validation-evidence` skill in
+`.github/skills/sample-validation-evidence/SKILL.md`. Run all sample validation


i still suspect that validations should only be run for the project the agent is changing

Gregory Joseph (gnjoseph) · 2026-08-19T20:59:42Z

+  pull-requests: read
+  issues: read
+  copilot-requests: write
+engine: copilot


can we select a model here? gpt vs claude?

dilucesr and others added 4 commits August 14, 2026 09:58

Add weekly dependency upgrade skill

cfd5e16

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add weekly dependency upgrade skill

c078985

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Require sample validation evidence for agent PRs

98f5224

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge remote upgrade skill branch

30c9795

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Diego Luces (dluces) requested review from Gregory Joseph (gnjoseph) and a balanced review from Copilot August 14, 2026 18:27

Copilot started reviewing on behalf of Diego Luces (dluces) August 17, 2026 22:24 View session

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Copilot started work on behalf of Diego Luces (dluces) August 18, 2026 20:53 View session

Document supported PowerShell and .NET runtimes

6a25808

Co-authored-by: dluces <262662+dluces@users.noreply.github.com>

Copilot stopped work on behalf of Diego Luces (dluces) due to an error August 18, 2026 21:00
Execution failed: CAPIError: 400 Error while downloading file. Upstream status code: 404. (Request ID: D84B:356BF7:514FB62:5C26850:6A84C7E6)

Copilot started work on behalf of Diego Luces (dluces) August 18, 2026 21:00 View session

Changes before error encountered

f123a17

Agent-Logs-Url: https://github.com/microsoft/SharePoint-Embedded-Samples/sessions/d28f0ca7-1959-47ee-9096-c11d59f17ae9 Co-authored-by: dluces <262662+dluces@users.noreply.github.com>

Copilot stopped work on behalf of Diego Luces (dluces) due to an error August 18, 2026 21:08
Execution failed: CAPIError: 400 Error while downloading file. Upstream status code: 404. (Request ID: A433:26AFAD:3F5AB1C:4B0BD04:6A84C9BD)

Gregory Joseph (gnjoseph) reviewed Aug 19, 2026

View reviewed changes

Navigation Menu

Uh oh!

Creates a weekly deps upgrade skill and workflow - #263

Creates a weekly deps upgrade skill and workflow#263
Diego Luces (dluces) wants to merge 6 commits into
mainfrom
user/dilucesr/upgrade_skill

Diego Luces (dluces) commented Aug 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Diego Luces (dluces) Aug 18, 2026

Uh oh!

Diego Luces (dluces) Aug 18, 2026

Uh oh!

Diego Luces (dluces) Aug 18, 2026

Uh oh!

Diego Luces (dluces) Aug 18, 2026

Uh oh!

Uh oh!

Diego Luces (dluces) Aug 18, 2026

Uh oh!

Gregory Joseph (gnjoseph) Aug 18, 2026

Uh oh!

Gregory Joseph (gnjoseph) Aug 19, 2026

Uh oh!

Gregory Joseph (gnjoseph) Aug 19, 2026

Uh oh!

Gregory Joseph (gnjoseph) Aug 19, 2026

Uh oh!

Gregory Joseph (gnjoseph) Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		foreach ($validationDirectory in $validationDirectories) {
		foreach ($sourceFile in Get-ChildItem -Path $validationDirectory.FullName -File -Recurse -Force) {


		Before opening or updating a pull request:

		1. Run every sample validator with:

		$homePath = [Environment]::GetFolderPath('UserProfile')
		$sensitiveKeyPattern = '(?i)(authorization\|proxy-authorization\|cookie\|set-cookie\|x-api-key\|api-key\|client[_-]?secret\|password\|passwd\|access[_-]?token\|refresh[_-]?token\|id[_-]?token\|private[_-]?key\|connection[_-]?string\|account[_-]?key\|sas[_-]?token\|secret)'

Uh oh!

Conversation

Diego Luces (dluces) commented Aug 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants