Why It Matters

Path-specific GitHub Copilot instruction files under .github/instructions/ need the .instructions.md suffix to participate in the expected layout contract. A plain .md filename can look correct in review but silently miss the intended path-specific behavior.

What Triggers

SEC370 applies only to path-specific GitHub Copilot instruction markdown under:

• .github/instructions/*.md

It triggers when:

• the file is under .github/instructions/
• the file ends with .md
• the file does not end with .instructions.md

Examples that trigger:

• .github/instructions/review.md
• .github/instructions/security-guidelines.md

Examples that stay clean:

• .github/instructions/review.instructions.md
• .github/copilot-instructions.md
• fixture-like paths such as tests/fixtures/.github/instructions/review.md

False Positives

This rule now lives in the explicit guidance lane because some repositories may still be migrating older layouts. The signal is deterministic and structural, but the first release remains guidance-only until broader ecosystem usefulness is measured.

Remediation

• rename path-specific Copilot instruction files to *.instructions.md
• keep repository-wide Copilot guidance in .github/copilot-instructions.md