eutd-mmo-fes-core-infra

Guidelines for creating and updating GitHub Copilot Agent Skills (SKILL.md) with accurate discovery metadata, portable structure, and safe bundled resources. Use when asked to create a skill, new skill, custom skill, add/update SKILL.md, add content under .github/skills/, or improve skill discovery, slash-command behavior, or skill packaging.

Bicep coding standards and lint/fix enforcement for infrastructure as code. Use when (1) writing or editing Bicep files, (2) lint or validate Bicep templates, (3) fix Bicep warnings or errors, (4) enforce naming, parameter, or security conventions, (5) review Bicep templates for best-practice compliance, (6) remediate code quality issues, or (7) align with Azure Verified Module (AVM) patterns.

Azure DevOps pipeline YAML best practices for authoring, reviewing, and troubleshooting CI/CD pipelines. Use when asked to (1) create or edit azure-pipelines YAML files, (2) review pipeline structure or stages, (3) fix pipeline errors or anti-patterns, (4) optimize pipeline performance or caching, (5) implement deployment strategies, or (6) enforce pipeline security, variable management, or template reuse conventions.

PowerShell coding standards and quality enforcement for scripts and modules. Use when (1) writing or editing PowerShell scripts (.ps1, .psm1), (2) audit or review scripts for quality, (3) enforce Verb-Noun naming or parameter validation, (4) fix style issues like aliases or missing error handling, (5) add SupportsShouldProcess or WhatIf/Confirm to destructive functions, (6) improve logging and Write-Host/Write-Output usage, or (7) ensure comment-based help is present.

Audit for hardcoded secrets and environment-specific identifiers across Bicep, YAML pipelines, JSON, and PowerShell files, then report findings with remediation guidance. Does NOT modify code by default — only proposes fixes unless the user explicitly requests changes. Use this when asked to (1) scan for secret leakage or credential exposure, (2) detect hardcoded subscription, tenant, or client IDs, (3) audit security posture of infrastructure code, (4) check for inline passwords, tokens, SAS strings, or connection strings, (5) verify secrets are stored in Key Vault and not in source, or (6) perform a security review of pipelines or scripts.