Align Repository Defaults with the agent onboarding model, workflow filename, and supported Dependabot ecosystems

[MariusStorhaug]

Problem

Three entries in Repository Defaults describe a state that does not match how PSModule module repositories actually work, so anyone following the page literally produces a broken or redundant repository.

1. .github/copilot-instructions.md is no longer the agent entry point

Both the "Default repository layout" table and the "Required common files" table list .github/copilot-instructions.md as a required file.

The agent onboarding model is AGENTS.md at the repository root, with CLAUDE.md importing it. Agent runtimes, including VS Code and GitHub Copilot, read AGENTS.md natively, so a separate Copilot-only pointer file is duplication that can drift. Agentic Development already describes the per-repository pointer files as AGENTS.md, the CLAUDE.md that imports it, and path-scoped instruction files — it does not mention copilot-instructions.md.

The page's own "Agent onboarding files" section is already correct and lists only AGENTS.md and CLAUDE.md. The two tables contradict it.

Only two repositories in the organization carry the file at all (PSModule/docs and PSModule/GitHub), and Template-PSModule removed it in PSModule/Template-PSModule#33.

2. Workflow filename

The "Default repository layout" table lists .github/workflows/workflow.yml as the "Reusable Process-PSModule workflow entry point".

Every module repository actually uses .github/workflows/Process-PSModule.yml. Surveyed 24 module repositories — GitHub, Context, Sodium, Utilities, Domeneshop, Ast, Base64, Jwt, Markdown, Yaml, Toml, Json, Path, PSSemVer, DynamicParams, Fonts, NerdFonts, Dns, PublicIP, Uri, CasingStyle, TimeSpan, PowerShellGallery, and Lovdata — plus Template-PSModule. All 24 use Process-PSModule.yml; none has a workflow.yml.

workflow.yml is the filename of the called reusable workflow inside PSModule/Process-PSModule, not the caller in the module repository. The table has confused the callee with the caller.

3. Dependabot ecosystems are documented as a fixed list containing one that does not exist

The "Supply-chain defaults" section shows a literal configuration block that module repositories should use, containing package-ecosystem: "github-actions" and package-ecosystem: "powershell".

Dependabot has no powershell package ecosystem. As of dependabot-core@dc2e4422d (2026-07-24) the supported ecosystems are bazel, bun, bundler, cargo, composer, conda, deno, devcontainers, docker, dotnet_sdk, elm, git_submodules, github_actions, go_modules, gradle, helm, hex, julia, maven, nix, npm_and_yarn, nuget, omnibus, opentofu, pre_commit, pub, python, rust_toolchain, sbt, swift, terraform, uv, and vcpkg. There is nothing for PowerShell or the PowerShell Gallery.

A repository that adds the documented block gets a Dependabot configuration error and stops receiving update pull requests entirely, including the github-actions ones it would otherwise get.

No module repository uses it. Of the 24 surveyed, all configure github-actions, and Sodium adds nuget because it ships a .NET assembly. The only place the powershell entry exists is the managed source in PSModule/Distributor (Repos/Module/dependabot.yml), which has never been distributed.

The deeper problem is the shape of the guidance, not just the one wrong value. A hardcoded literal block goes stale every time Dependabot's ecosystem support changes, and it cannot express "this repository also ships a .NET assembly". The rule should be stated as a requirement, not a copy-paste snippet.

Desired outcome

Repository Defaults describes the agent onboarding model, layout, and supply-chain configuration that module repositories actually use, so Template-PSModule and generated repositories can match the page exactly, and so the supply-chain guidance stays correct as Dependabot evolves.

Acceptance criteria

• .github/copilot-instructions.md is removed from both the layout table and the required-files table, leaving AGENTS.md and CLAUDE.md as the agent entry points, consistent with the page's own "Agent onboarding files" section.
• The layout table names .github/workflows/Process-PSModule.yml as the workflow entry point.
• The supply-chain section states the rule rather than a fixed list: a module repository configures github-actions, plus every additional ecosystem that applies to the repository and is supported by the current version of Dependabot. It links to the supported ecosystems reference as the authority for what is currently available, so the page does not need editing each time Dependabot adds or removes support.
• The powershell entry is removed. If PowerShell Gallery support is wanted, it is captured as a future capability that must not be configured today, with a note that adding an unsupported ecosystem breaks the entire Dependabot configuration.
• The PSModule/Distributor managed dependabot.yml is flagged for the same correction so the broken powershell entry is not carried into MSXOrg/Custo.

References

• Found while adding the missing baseline files to the template: Ship the full required baseline file set in the module template Template-PSModule#36 and 🩹 [Patch]: New module repositories ship the required community and governance files Template-PSModule#37
• Agentic Development: https://msxorg.github.io/docs/Ways-of-Working/Agentic-Development/
• Dependabot supported ecosystems: https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories
• dependabot-core: https://github.com/dependabot/dependabot-core

[MariusStorhaug]

Item 2 is already fixed — no need to carry it here.

#101 (open before this issue was filed, closing #100) already renames the row to .github/workflows/Process-PSModule.yml and adds a Caller workflow and reusable workflow subsection with a role/repository/file table and the uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@<sha> snippet, so the caller-versus-reusable distinction is explicit. It also names the caller file in Modules/Process-PSModule/repository-structure.md, which previously described it only as "workflow entrypoint".

Items 1 and 3 are now in that same pull request, rather than a second one against the same file:

• Item 1 — .github/copilot-instructions.md is removed from both the layout table and the required-files table, leaving AGENTS.md + CLAUDE.md as the required set. One nuance worth recording: MSX guidance is not uniform on this. Ways of Working → Agentic Development lists only AGENTS.md, the importing CLAUDE.md, and path-scoped adapters, but the agentic development capability spec and its design page name .github/copilot-instructions.md explicitly as a client adapter that MAY add runtime-specific loading rules. Neither makes it mandatory, so the page now describes it as optional rather than forbidden, and says which source says what. Verified independently: 2 of 96 org repositories carry the file (PSModule/GitHub and PSModule/docs), and Template-PSModule dropped it in refactor: slim template scaffolding to minimum baseline Template-PSModule#33.
• Item 3 — the package-ecosystem: powershell example is gone. Confirmed against PACKAGE_MANAGER_LOOKUP in dependabot-core's common/lib/dependabot/config/file.rb and GitHub's options reference, neither of which contains powershell. The example is now what Template-PSModule really ships (github-actions, daily, cooldown.default-days: 7), with nuget documented for .NET dependencies as Sodium uses it, plus a subsection stating that no PowerShell ecosystem exists and that the entry must not be left in as a placeholder. Also confirmed that no repository ever adopted it, so this was drift rather than live breakage.

Fourth acceptance criterion — the PSModule/Distributor managed dependabot.yml (Repos/Module/dependabot.yml/.github/dependabot.yml), which is where the page's snippet came from, still contains the invalid entry. That is outside this repository, so it is filed as PSModule/Distributor#16 with an explicit note not to port it into MSXOrg/Custo.

So this issue can be narrowed to items 1 and 3; #101 closes it along with #100.