Copilot instructions

1---
2applyTo: "**/.github/workflows/**, **/Jenkinsfile, **/Jenkinsfile*, **/jenkins/**/*.groovy, **/pipeline/**"
3description: "CI/CD pipeline standards: GitHub Actions workflow structure, Jenkins declarative pipeline patterns, quality gate requirements, and deployment job conventions."
4---
5 
6## Context
7 
8This instruction file applies to GitHub Actions workflow files (`.github/workflows/*.yml`) and Jenkins pipeline files (`Jenkinsfile`). CI/CD pipelines are production code — they must be reviewed, version-controlled, and must not bypass quality gates.
9 
10---
11 
12## Pipeline Quality Gate Requirements
13 
14Every pipeline must enforce the following gates in order:
15 
161. **Compile** — build passes with zero errors
172. **Unit tests** — all tests pass; no flaky tests allowed in `main`
183. **Coverage** — JaCoCo 80% line / 70% branch (business logic); Angular Istanbul 80/70/80/80
194. **SAST** — SonarQube/SonarCloud quality gate: no new blockers or critical issues
205. **Dependency scan** — OWASP dependency-check: no unfixed CVSS ≥ 8.0 CVEs
216. **Container build** — Docker image builds successfully (on `main`/release branches only)
227. **Deploy** — only after all gates pass; requires approval for production
23 
24---
25 
26## GitHub Actions Standards
27 
28### Workflow File Naming
29 
30| Purpose | File Name |
31|---------|-----------|
32| PR build and test | `ci.yml` |
33| Main branch build + deploy to dev | `cd-dev.yml` |
34| Release deploy to staging/prod | `cd-release.yml` |
35| Scheduled scans (weekly) | `scheduled-scan.yml` |
36| Dependency updates | `dependabot.yml` |
37 
38### Required Elements
39 
40```yaml
41name: CI
42
43on:
44  push:
45    branches: [main, develop]
46  pull_request:
47    branches: [main, develop]
48
49jobs:
50  build:
51    runs-on: ubuntu-latest
52    permissions:
53      contents: read
54      id-token: write   # Required for OIDC-based AWS auth
55      security-events: write  # Required for SARIF upload (SAST)
56```
57 
58### AWS Authentication (OIDC — Required)
59 
60Never use long-lived AWS access keys in GitHub Actions. Use OIDC:
61 
62```yaml
63- name: Configure AWS credentials
64  uses: aws-actions/configure-aws-credentials@v4
65  with:
66    role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
67    aws-region: eu-west-1
68```
69 
70### Caching
71 
72```yaml
73- uses: actions/cache@v4
74  with:
75    path: ~/.m2/repository
76    key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
77    restore-keys: |
78      ${{ runner.os }}-maven-
79```
80 
81### Artefact Retention
82 
83```yaml
84- uses: actions/upload-artifact@v4
85  if: always()   # Upload even on failure for debugging
86  with:
87    name: test-reports
88    path: target/surefire-reports/
89    retention-days: 7
90```
91 
92---
93 
94## Jenkins Declarative Pipeline Standards
95 
96```groovy
97pipeline {
98  agent { label 'java21' }
99 
100  options {
101    timeout(time: 30, unit: 'MINUTES')
102    buildDiscarder(logRotator(numToKeepStr: '10'))
103    disableConcurrentBuilds()
104  }
105 
106  stages {
107    stage('Build & Test') {
108      parallel {
109        stage('Maven Build') {
110          steps { sh 'mvn clean verify -B -T 2' }
111        }
112        stage('OWASP Scan') {
113          steps { sh 'mvn dependency-check:check -B' }
114        }
115      }
116    }
117    stage('SonarQube') {
118      steps {
119        withSonarQubeEnv('SonarQube') {
120          sh 'mvn sonar:sonar -B'
121        }
122        timeout(time: 5, unit: 'MINUTES') {
123          waitForQualityGate abortPipeline: true
124        }
125      }
126    }
127    stage('Docker Build') {
128      when { branch 'main' }
129      steps { sh 'docker build -t ${IMAGE_TAG} .' }
130    }
131    stage('Deploy Dev') {
132      when { branch 'main' }
133      steps {
134        sh 'npx cdk deploy AppStack --context env=dev --require-approval never'
135      }
136    }
137    stage('Deploy Prod') {
138      when { branch 'release/*' }
139      input { message 'Deploy to production?' }
140      steps {
141        sh 'npx cdk deploy AppStack --context env=prod --require-approval never'
142      }
143    }
144  }
145 
146  post {
147    always {
148      junit 'target/surefire-reports/*.xml'
149      publishHTML target: [reportDir: 'target/site/jacoco', reportFiles: 'index.html', reportName: 'JaCoCo']
150    }
151    failure {
152      slackSend(channel: '#build-alerts', message: "Build FAILED: ${JOB_NAME} #${BUILD_NUMBER}")
153    }
154  }
155}
156```
157 
158---
159 
160## Anti-Patterns
161 
162- ❌ `--no-verify` or `--skip-tests` in CI pipeline commands
163- ❌ Hardcoded AWS credentials as environment variables
164- ❌ Production deployment without quality gate success
165- ❌ Concurrent deploys to the same environment without a lock
166- ❌ `continue-on-error: true` on security scan steps
167