Transcription
I created a pull request a little bit ago and let's just say it's not ideal. I didn't follow good coding or security practices. Before the rest of my team sees my mess, I can get some help from both Copilot and code scanning.
Looking through the main page for the PR, I can see Copilot's expanded on the short description that I gave listing out the files that have changed and what it reviewed. Scrolling a little further, I can see the first call out from Copilot. I added in some insecure code. I use the exec command rather than calling the function. Copilot is offering me a suggested fix right here.
Now, for the moment, I'm going to leave this as it is because I know I've got code scanning a little bit later and I want to see what it has to say. Don't worry though, it will get resolved.
Copilot review highlighted a couple of other problems with my code around type hints. Looks like I'm missing one for a return value for this function and I've got another one that's just simply incorrect. Like I said, my PR isn't ideal.
Finally, I can see the results of code scanning, the security tool from GitHub which looks for vulnerabilities in the code we write. It detected the call to the Python exec function. But I'm not a security expert and maybe I'm not sure how to fix this. Copilot Autofix, part of code scanning, has generated both an explanation of the vulnerability and proposed a solution. I'm going to commit that suggestion. So found means fixed.
The update to the branch and PR will automatically cause code scanning to run again, giving me the assurance that the generated code resolved the vulnerability. We can see all of those security scans and those tests, by the way, running against the updated code.
If we explore the files tab to get a better view of the changes, we notice the recommendations from Copilot review are displayed here as well. Let me apply the suggestion about updating my return type right here. I'm able to do this without even having to return to my IDE.
Let's take a quick tour of the settings which allow this to happen. If I open my repo settings, we've got rule sets. There's one created for tests and security. We require a pull request and have set the number of human reviewers to one. We're also automatically requesting reviews from Copilot to streamline our DevOps process. We've turned on status checks in the form of the front-end and back-end tests. This is in a workflow that's defined in the repository and those are required before a merge can be completed. Finally, we're also requiring code scanning results to be clear.
To help Copilot in its review process, we've created a Copilot instructions file. This file is part of the repository and honestly should be created in any repo where developers utilize Copilot. The instruction file allows you to provide additional context. Copilot Review uses this file to get a better sense of our practices and offer better suggestions.
Now, I'm not the only one creating PRs on this repo. Copilot is as well, and we should review that code just like we would any other developer's code. We can see the PR with a great description of what it's built and the files which it changed. I want to open up the code and run the website to see how things look. I can do that right here by opening a Codespace on the branch. That filter functionality that it created seems to be behaving just fine.
But as I open a game, I notice that the star display shows half stars. It'd be nice if we had a gradient fill for the decimal spot. Let me go back to the review, tag Copilot in a comment, and make a request. Copilot gets to work on the update without complaining about scope creep. Once it's done, I return to the Codespace, pull the code, rerun the site, and I can see that update. That's much better. I really like how that looks now.
But I want to ensure all tests are passing for the PR that Copilot made, just like I would for any other developer. For security purposes, the actions for Copilot's PR won't run unless I approve them. Let's do that. Ensure they pass and everything looks good.
We can see we have a full suite of tools to review and validate both our developers' code and Copilot's code as well.