[pablonete]

Publish Security extension version 0.2.2 for GitHub Copilot App. Contains the built canvas extension, its plugin manifest and README, the regenerated marketplace and plugin docs, and a codespell skip for the bundled third-party code.

[github-actions]

🔒 PR Risk Scan Results

Scanned 7 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	extensions/github-security/manifest.json	5	"github-app": "^0.2.0"

Skipped non-text or missing files

• extensions/github-security/assets/preview.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:low — Documentation, metadata, generated output, or a small update to an existing resource
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Small update (36 changed lines) to existing resources with no added or removed files

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Canvas extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the resource owner.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for f28fc02 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🧩 Canvas smoke test

✅ Passed · 0 error(s), 0 warning(s)

Check	Result
Syntax, imports, file safety	✅
Preview image (≥ 400×160 PNG)	✅
Plugin manifests	✅
Materialize	✅
Install (Copilot CLI)	✅

Plugin github-security v0.2.2

Field	Value
Description	Review your session's changes for vulnerabilities and fix code scanning alerts
Author	—
License	—
Keywords	security, code-scanning, canvas, ghas, alert, finding
Extensions	github-security
Materialize	✅
Install	✅

Changed plugin files

• plugins/github-security/README.md
• plugins/github-security/plugin.json

Extension github-security

Field	Value
Registered by	github-security
Package	—
Preview	1680×984, 1011.9 KB
Modules	61 (60 reachable from extension.mjs)
Files	70

Permissions and capabilities (static analysis of modules reachable from extension.mjs)

• Spawns processes (node:child_process)
• File system access (node:fs)
• Network sockets / local server (node:http, node:net, ...)
• Outbound HTTP requests (fetch)
• Reads environment variables (process.env)

Changed extension files

• extensions/github-security/README.md
• extensions/github-security/assets/preview.png
• extensions/github-security/client/index.html
• extensions/github-security/extension.mjs
• extensions/github-security/manifest.json

---

Static checks compile modules without executing them. Minimum preview size is configurable with CANVAS_PREVIEW_MIN_WIDTH/CANVAS_PREVIEW_MIN_HEIGHT. Workflow run

[Copilot]

🟢 Approval recommended

The narrow release-metadata, display-title, and documentation changes are consistent, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Publishes github-security 0.2.2 for GitHub Copilot App, aligning release metadata and display names across the extension, plugin, and generated catalog.

Changes:

• Bumps the extension and plugin versions to 0.2.2.
• Standardizes canvas and page titles to “GitHub Security.”
• Shortens the catalog description and corrects punctuation in both READMEs.

File	Description
plugins/​github-security/​README.md	Corrects punctuation in the tool-approval explanation.
plugins/​github-security/​plugin.json	Updates the version and description.
extensions/​github-security/​README.md	Applies the same punctuation correction.
extensions/​github-security/​manifest.json	Updates the version and reformats existing fields.
extensions/​github-security/​extension.mjs	Renames both canvas titles to “GitHub Security.”
extensions/​github-security/​client/​index.html	Updates the browser page title.
docs/​README.plugins.md	Synchronizes the generated plugin description.
.github/​plugin/​marketplace.json	Synchronizes the marketplace version and description.

_{Review effort: Max}