Why It Matters

Path-specific GitHub Copilot instruction files under .github/instructions/ are meant to scope behavior to a file pattern. Without applyTo, the document is harder to reason about and can silently fail to target the files the author intended.

What Triggers

SEC354 applies only to path-specific GitHub Copilot instruction files:

• .github/instructions/*.instructions.md

It triggers when:

• the file has no frontmatter at all, or
• the frontmatter parses successfully but does not contain applyTo

Examples that trigger:

• .github/instructions/review.instructions.md with no frontmatter
• a path-specific instruction file with frontmatter like title: Review but no applyTo

Examples that stay clean:

• frontmatter with applyTo: "**/*.rs"
• fixture-like paths such as tests/fixtures/.github/instructions/review.instructions.md
• files with invalid YAML frontmatter, which stay outside this rule to avoid mixing parse recovery with applyTo policy

False Positives

This rule now lives in the explicit guidance lane because some repos may still be migrating older instruction layouts. The rule is about deterministic Copilot configuration quality, not a claim that the repository is insecure by itself.

Remediation

Add explicit applyTo frontmatter to each path-specific instruction file, for example:

---
applyTo: "**/*.rs"
---

If the content is meant to be repository-wide instead of path-specific, move it into .github/copilot-instructions.md.