Why It Matters

Path-specific GitHub Copilot instruction files use applyTo to scope guidance to file patterns. If applyTo is empty or malformed, the file can look valid in review while silently failing to target the intended files.

What Triggers

SEC371 applies only to path-specific GitHub Copilot instruction files:

• .github/instructions/*.instructions.md

It triggers when applyTo exists but is not one of:

• a non-empty string
• a non-empty sequence of non-empty strings

Examples that trigger:

• applyTo: ""
• applyTo: []
• applyTo: [123]
• applyTo: ["**/*.rs", ""]

Examples that stay clean:

• applyTo: "**/*.rs"
• applyTo: ["**/*.rs", "**/*.ts"]
• fixture-like paths such as tests/fixtures/.github/instructions/review.instructions.md

False Positives

This rule now lives in the explicit guidance lane because some repositories may still be migrating older layouts. The signal is deterministic and structural, but the first release remains guidance-only until broader ecosystem usefulness is measured.

Remediation

• set applyTo to a non-empty string glob, or
• set applyTo to a non-empty YAML sequence of non-empty glob strings