Why It Matters

Path-specific GitHub Copilot instruction files under .github/instructions/ need the .instructions.md suffix to participate in the expected layout contract. A plain .md filename can look correct in review but silently miss the intended path-specific behavior.

What Triggers

SEC370 applies only to path-specific GitHub Copilot instruction markdown under:

• .github/instructions/*.md

It triggers when:

• the file is under .github/instructions/
• the file ends with .md
• the file does not end with .instructions.md

Examples that trigger:

• .github/instructions/review.md
• .github/instructions/security-guidelines.md

Examples that stay clean:

• .github/instructions/review.instructions.md
• .github/copilot-instructions.md
• fixture-like paths such as tests/fixtures/.github/instructions/review.md

False Positives

This rule stays Preview because some repositories may still be migrating older layouts. The signal is deterministic and structural, but the first release remains guidance-only until broader ecosystem usefulness is measured.

Remediation

• rename path-specific Copilot instruction files to *.instructions.md
• keep repository-wide Copilot guidance in .github/copilot-instructions.md