[auto] chore: add three reviewer-derived rules to Copilot instructions

[github-actions]

Proposed by the Update Instructions From PR Reviews workflow.

Settings

• Repo mined: Azure/azure-dev
• Range: merged since 2026-01-13 (last 6 months, no prior successful run found)
• Branch: automated/update-instructions-from-pr-reviews @ 602c349

Stats

• Signal ratio: ~60 non-bot comments kept / ~120 total (50%)
• Resolved PRs examined: 48

PR comment themes promoted

• Dead code removal before merge — jongio flagged unused functions/types 3× across review rounds of #8782. Added to go.instructions.md.
• No CRLF (\r\n) in generated text files — jongio flagged unconditional Windows line endings in generated Dockerfiles/Python scripts 3× in #8782. Added to extensions.instructions.md.
• URL startsWith() validation bypassed by dot segments — richardpark-msft flagged that raw prefix checks on URL strings are bypassable via /../ or %2e%2e 3× in #9042. Added to extensions.instructions.md.

Generated by Update Instructions From PR Reviews · 140.2 AIC · ⌖ 13.2 AIC · ⊞ 8K · ◷

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch automated/update-instructions-from-pr-reviews.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (69 of 69 lines)

From 602c3492eccd77aedff68cf83e1555b9c728a741 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:58:05 +0000
Subject: [PATCH] chore: add three reviewer-derived rules to Copilot
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From mining 48 recently-merged PRs, three recurring reviewer themes
reached the promotion threshold:

1. Dead code removal (go.instructions.md) — jongio flagged unused
   functions/types 3× in #8782.
2. CRLF in generated files (extensions.instructions.md) — jongio
   flagged unconditional \\r\\n in generated files 3× in #8782.
3. URL startsWith bypass (extensions.instructions.md) — richardpark-msft
   flagged dot-segment path-traversal bypasses 3× in #9042.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../instructions/extensions.instructions.md    | 18 ++++++++++++++++++
 .github/instructions/go.instructions.md        |  6 ++++++
 2 files changed, 24 insertions(+)

diff --git a/.github/instructions/extensions.instructions.md b/.github/instructions/extensions.instructions.md
index f46a73d..e0b43f1 100644
--- a/.github/instructions/extensions.instructions.md
+++ b/.github/instructions/extensions.instructions.md
@@ -16,3 +16,21 @@ applyTo:
 - Follow extension guidelines in: cli/azd/docs/extensions/extensions-style-guide.md. If the work
   violates any of these principles, include a link to the guide so the user can read it and get
   ahead of some of the problems.
+
+- When generating text files (Dockerfiles, Python scripts, TOML files, etc.), never force Windows
+  line endings (`\r\n`) on all platforms. Use `\n` (Unix LF) exclusively. Unconditional CRLF breaks
+  shebang parsing inside Linux containers, causes `exec format error`, and introduces noisy git
+  diffs on Linux/macOS. If the Go `text/template` or `os.WriteFile` path writes through a
+  `strings.NewReplacer` or similar that co
... (truncated)