Add GitHub Copilot code review custom instructions

[Qadra42]

Add GitHub Copilot Code Review Custom Instructions

Summary

This PR adds layered custom instructions for GitHub Copilot Code Review, enabling automated, context-aware code reviews based on file paths and domains.

How It Works

                    ┌─────────────────────────────────────┐
                    │   copilot-instructions.md (global)  │
                    │   • Review priorities               │
                    │   • General principles              │
                    │   • Always applies to all files     │
                    └──────────────────┬──────────────────┘
                                       │
          ┌────────────────────────────┼────────────────────────────┐
          │                            │                            │
          ▼                            ▼                            ▼
┌─────────────────────┐  ┌─────────────────────┐  ┌─────────────────────┐
│  nestjs.instructions │  │ security.instructions│  │  testing.instructions│
│  ─────────────────── │  │  ─────────────────── │  │  ─────────────────── │
│  applyTo: src/**/*.ts│  │  applyTo: src/auth/**│  │  applyTo: **/*.spec.ts│
│                      │  │           *.guard.ts │  │           **/*.e2e-*  │
│  • DI patterns       │  │           *.strategy │  │                      │
│  • Thin controllers  │  │                      │  │  • Test isolation    │
│  • DTO validation    │  │  • OWASP principles  │  │  • Cleanup in after  │
└─────────────────────┘  │  • JWT security      │  │  • Edge cases        │
                         │  • Input sanitization │  └─────────────────────┘
                         └─────────────────────┘
                                       │
                                       ▼
                         ┌─────────────────────┐
                         │ database.instructions│
                         │  ─────────────────── │
                         │  applyTo: *.entity.ts│
                         │           *.service  │
                         │                      │
                         │  • N+1 prevention    │
                         │  • Query safety      │
                         │  • Transactions      │
                         └─────────────────────┘

Layer Combination Examples

File Changed	Instructions Applied
src/auth/auth.service.ts	global + nestjs + security + database
src/targets/target.entity.ts	global + nestjs + database
src/test/users/login.e2e-spec.ts	global + testing
src/users/users.controller.ts	global + nestjs

File Structure

.github/
├── copilot-instructions.md          # Global rules (all PRs)
└── instructions/
    ├── nestjs.instructions.md       # NestJS patterns
    ├── security.instructions.md     # Auth & OWASP
    ├── database.instructions.md     # TypeORM & queries
    └── testing.instructions.md      # Test quality

Key Design Decisions

• Short files (<1000 chars each): Copilot only reads first 4,000 characters per file
• Imperative bullet points: More effective than narrative paragraphs
• Priority system: CRITICAL / IMPORTANT / SUGGESTION
• Code examples: Show correct vs incorrect patterns
• No external links: Copilot doesn't follow them

References

• GitHub Blog: Mastering Instruction Files
• Official Tutorial
• Community Examples

[Copilot]

Pull request overview

Adds GitHub Copilot Code Review custom instruction files under .github/ to provide layered, path-scoped review guidance (NestJS, security, database, and testing) on top of a global baseline.

Changes:

• Add global Copilot code review guidelines at .github/copilot-instructions.md
• Add scoped instruction packs in .github/instructions/ for NestJS, security, database, and testing concerns
• Define applyTo globs to control which instruction packs apply to which file domains

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/copilot-instructions.md	Establishes global review priorities/principles for all reviews.
.github/instructions/nestjs.instructions.md	Adds NestJS architecture/validation guidance scoped to src/**/*.ts.
.github/instructions/security.instructions.md	Adds auth/OWASP-focused guidance scoped to auth/guards/strategies.
.github/instructions/database.instructions.md	Adds TypeORM/query guidance scoped to entities/services/repositories.
.github/instructions/testing.instructions.md	Adds test quality/isolation/async guidance scoped to test files.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.