PR Metrics

All three GitHub Actions workflow files (build.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml, release-initiate.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-initiate.yml, release-publish.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-publish.yml) set permissions: {} at the top level, defaulting all jobs to no permissions. Individual jobs escalate only the specific permissions they require (e.g., pull-requests: write, attestations: write). This ensures that any job without an explicit permissions block receives the lowest available permissions.

Each release is assigned a unique Semantic Versioning (https://semver.org/) identifier (e.g., v1.7.11). The version is maintained consistently across package.json (https://github.com/microsoft/PR-Metrics/blob/main/package.json), task.json (https://github.com/microsoft/PR-Metrics/blob/main/src/task/task.json), and vss-extension.json (https://github.com/microsoft/PR-Metrics/blob/main/src/vss-extension.json). The Update-Version.ps1 script (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflow-scripts/Update-Version.ps1) ensures all version references are updated atomically during the release process.

GitHub Releases include auto-generated change logs listing all merged pull requests with descriptive titles, author attributions, and links to full PR discussions. For example, the v1.7.11 release (https://github.com/microsoft/PR-Metrics/releases/tag/v1.7.11) includes a "What's Changed" section enumerating each functional modification and a "Full Changelog" comparison link between versions.

The project uses npm (https://www.npmjs.com/), the standard package manager for the Node.js ecosystem, to manage dependencies. package.json (https://github.com/microsoft/PR-Metrics/blob/main/package.json) declares direct dependencies, and package-lock.json (https://github.com/microsoft/PR-Metrics/blob/main/package-lock.json) pins the full transitive dependency tree for deterministic builds. Dependencies are resolved from the npm public registry via HTTPS.

Release artefacts are signed using Sigstore (https://www.sigstore.dev/) keyless signing via cosign (https://github.com/sigstore/cosign), producing a .sigstore.json signature bundle alongside each VSIX release. Additionally, SLSA build provenance attestations (https://slsa.dev/) are generated using actions/attest-build-provenance (https://github.com/actions/attest-build-provenance), linking each artefact to a specific workflow run and commit. Verification instructions are documented in docs/verification.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/verification.md).

The project documents its dependency management practices in docs/dependency-management.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/dependency-management.md), covering how dependencies are selected, obtained from the npm registry, tracked via package.json and package-lock.json, updated through Dependabot (GitHub Actions) and npm-check-updates (npm packages), and scanned for security vulnerabilities via CodeQL and Dependabot alerts.

The GOVERNANCE.md file (https://github.com/microsoft/PR-Metrics/blob/main/GOVERNANCE.md) lists project members and teams with access to sensitive resources, including the @microsoft/omex code-owning team, the primary maintainer (@muiriswoulfe), repository maintainers, and automation accounts (Dependabot, CLA bot). The document describes the specific sensitive resources each role can access, such as release initiation, CI/CD configuration, and repository administration.

The GOVERNANCE.md file (https://github.com/microsoft/PR-Metrics/blob/main/GOVERNANCE.md) describes the roles within the project (Maintainer, Contributor, Automation) and their corresponding responsibilities, including PR review, release management, issue triage, security response, and automated dependency updates.

The CONTRIBUTING.md file (https://github.com/microsoft/PR-Metrics/blob/main/.github/CONTRIBUTING.md) outlines requirements for acceptable contributions, including the Contributor License Agreement (CLA) (https://opensource.microsoft.com/cla) requirement, coding style guidelines referencing the .editorconfig file (https://github.com/microsoft/PR-Metrics/blob/main/.editorconfig), Semantic Versioning requirements for version updates, the requirement to discuss new extensions via GitHub Issues before implementation, and submission guidelines. A pull request template (https://github.com/microsoft/PR-Metrics/blob/main/.github/pull_request_template.md) enforces structured submissions with testing checklists.

The project requires all contributors to sign the Microsoft Contributor License Agreement (CLA) (https://opensource.microsoft.com/cla) before contributions are accepted. A CLA bot automatically checks each pull request and blocks merging until the agreement is signed. Per CONTRIBUTING.md (https://github.com/microsoft/PR-Metrics/blob/main/.github/CONTRIBUTING.md): "a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately." The CLA satisfies this requirement as an alternative to a Developer Certificate of Origin (DCO).

The repository is protected by multiple rulesets (default-ruleset, microsoft-production-ruleset) that prevent direct commits to the main branch and require pull request reviews. CI/CD workflows (build.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml) run automated status checks on every pull request, including unit tests, linting, CodeQL analysis, and Super-Linter validation. These checks must pass before a pull request can be merged. See repository rulesets at https://github.com/microsoft/PR-Metrics/rules.

The build.yml workflow (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml) runs a comprehensive automated test suite on every pull request to the main branch. The test suite uses Mocha (https://mochajs.org/) for unit testing with c8 (https://github.com/bcoe/c8) code coverage reporting. Tests can be run locally via "npm test" from the src/task folder, as documented in docs/development.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/development.md). Additional CI checks include CodeQL security analysis, ESLint, and Super-Linter.

The project includes comprehensive design documentation: docs/cross-platform-architecture.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/cross-platform-architecture.md) contains a Mermaid diagram illustrating the system's actors (PR Metrics, API wrappers, Azure DevOps APIs, GitHub APIs) and the flow of API calls between them, and describes how platform abstraction layers route requests to the appropriate platform implementation. docs/development.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/development.md) explains the internal architecture, including the repos and runners wrapper abstractions, dependency injection patterns, and the build process. AGENTS.md (https://github.com/microsoft/PR-Metrics/blob/main/AGENTS.md) provides a detailed architectural overview of all core components, their interactions, and integration points.

All external software interfaces are documented: The README.md (https://github.com/microsoft/PR-Metrics/blob/main/README.md) documents all input parameters (base-size, growth-rate, test-factor, file-matching-patterns, test-matching-patterns, code-file-extensions), their default values, and usage examples for both GitHub Actions and Azure DevOps Pipelines. action.yml (https://github.com/microsoft/PR-Metrics/blob/main/action.yml) formally defines the GitHub Action's input interface. src/task/task.json (https://github.com/microsoft/PR-Metrics/blob/main/src/task/task.json) formally defines the Azure DevOps task's input interface. docs/azure-pipelines-task.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/azure-pipelines-task.md) provides platform-specific configuration and authentication documentation.

A security assessment is documented in docs/security-assessment.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-assessment.md), which identifies the system's trust boundaries, sensitive assets, and the most likely and impactful security threats, including access token exposure, injection via untrusted PR content, supply chain attacks on dependencies, CI/CD permission escalation, and Git command injection. Each threat includes a likelihood and impact rating, along with the specific mitigations in place.

The SECURITY.md file (https://github.com/microsoft/PR-Metrics/blob/main/SECURITY.md) documents the project's coordinated vulnerability disclosure (CVD) policy, following Microsoft's CVD principles (https://www.microsoft.com/msrc/cvd). The policy directs reporters to the Microsoft Security Response Center (MSRC) (https://msrc.microsoft.com/create-report) and includes a clear response timeframe: "You should receive a response within 24 hours."

The SECURITY.md file (https://github.com/microsoft/PR-Metrics/blob/main/SECURITY.md) provides two mechanisms for private vulnerability reporting: The MSRC web form (https://msrc.microsoft.com/create-report) for authenticated submissions. Email to secure@microsoft.com with optional PGP encryption using the MSRC PGP key (https://aka.ms/opensource/security/pgpkey). Both methods ensure that vulnerability details remain confidential until a fix is available.

The project uses GitHub Security Advisories (https://github.com/microsoft/PR-Metrics/security/advisories) as the public channel for publishing data about discovered vulnerabilities. Microsoft also publishes security information through the MSRC portal (https://msrc.microsoft.com/). No vulnerabilities have been discovered or disclosed for this project to date; however, the infrastructure for publishing advisory data is in place and operational.