Add Copilot instructions for repository-specific agent guidance

[Copilot]

Configures Copilot coding agent instructions per best practices to address repository-specific requirements that aren't obvious from code inspection.

Changes

Created .github/copilot-instructions.md with:

• Package feed constraints: Agents may temporarily use public feeds (nuget.org, npmjs.com) during work but must revert nuget.config and .npmrc.pipeline before committing. Private Azure DevOps feed config must remain in commits.
• Mandatory changelog updates: All PRs require Changelog.md update with next patch version and current date. Format: Keep a Changelog with semantic versioning.
• Build/test commands for C# (DevSkim-DotNet) and TypeScript (DevSkim-VSCode-Plugin) components
• Repository structure overview (library, CLI, VS extension, VSCode plugin, security rules)
• Code style conventions and common development workflows

Updated Changelog.md:

• Added version 1.0.72 entry documenting this change
• Follows existing format and versioning convention

The instructions ensure agents understand non-obvious repository constraints (private feeds, changelog gates) that would otherwise cause CI failures.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• gh.io
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>✨ Set up Copilot instructions</issue_title>
<issue_description>Configure instructions for this repository as documented in Best practices for Copilot coding agent in your repository.

Important special caveats for this repository in particular:

• As an agent you may have to modify the nuget.config or npmrc to use public feed while working, but do not commit changes to these files, the private feed should remain defined in the repository commits.
• PR gates for this project check for a change to CHANGELOG.md - when working as an agent, and this project uses squash merges - accordingly, when making a change to the project you should create an accurate changelog entry in the style previously used for a patch version number one greater than the previous version with the current date.

</issue_description>

Comments on the Issue (you are Copilot in this section)

• Fixes ✨ Set up Copilot instructions #718

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR adds Copilot coding agent instructions to help automated tools understand repository-specific requirements that are not obvious from code inspection alone.

Changes:

• Created .github/copilot-instructions.md with guidance on package feed constraints, mandatory changelog updates, build/test workflows, and repository structure
• Updated Changelog.md with version 1.0.72 entry documenting these additions

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/copilot-instructions.md	New file providing comprehensive repository-specific guidance for Copilot coding agents, including critical rules about package management, changelog requirements, build commands, and development workflows
Changelog.md	Added version 1.0.72 entry documenting the addition of Copilot instructions file

Comments suppressed due to low confidence (1)

.github/copilot-instructions.md:20

• Inconsistent capitalization of "VS Code". The repository consistently uses "VS Code" (with a space) in documentation and changelog entries. Change "VSCode plugin" to "VS Code plugin" to match the established convention.

- **.npmrc files**: VSCode plugin uses `.npmrc.pipeline` for private feeds

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Inconsistent capitalization of "VS Code". The repository consistently uses "VS Code" (with a space) in documentation and changelog entries. Change "VSCode extension" to "VS Code extension" to match the established convention.