Copilot instructions

1---
2applyTo: ".github/workflows/**/*.{yml,yaml}"
3---
4 
5# CI Workflow Review Guidelines
6 
7## Security
8 
9- Pin action versions to at least a named tag (`actions/checkout@v4`); prefer full commit SHA for security-critical actions
10- Set `permissions` explicitly on any job that needs elevated access (e.g., `pull-requests: write`) — do not rely on repository-wide defaults
11- Never print secret values to logs — use GitHub's secret masking for dynamic secrets
12 
13```yaml
14# Prefer explicit permissions scoping
15permissions:
16  pull-requests: write
17  contents: read
18```
19 
20## Node.js Version Requirements
21 
22- Node 22 is the minimum supported version (`engines.node >= 22.0.0` in `package.json`)
23- The CI matrix must include at least Node 22 and the latest even-numbered LTS — do not drop below 22
24- `node:sqlite` (built-in, Node 22.5+) is used by OpenCode and Crush parsers — do not add third-party SQLite packages
25 
26## Package Manager
27 
28- Use `pnpm` exclusively — not `npm ci` or `yarn` — to stay consistent with `pnpm-lock.yaml`
29- Always run `pnpm install --frozen-lockfile` in CI to prevent accidental lockfile mutations
30- Use `pnpm/action-setup@v4` for pnpm setup
31 
32## Build and Test Order
33 
34- Run `pnpm run build` (TypeScript compile) before `pnpm test` — `tsc` validates type correctness; test failures may be caused by type errors caught at build time
35- The `test-quality` job posts a PR comment summarizing test counts and flags source-file changes without corresponding test changes — do not remove this job without an equivalent replacement
36- The `test-quality` job should only run on `pull_request` events (not push to `main`)
37