Automate ADR-backed component review guidance

[adierkens]

Closes #

Builds on #8173's small ADR-backed review trial by replacing its hand-authored instruction with a complete, validated policy generation system. Public ADRs and maintained contributor guidance produce path-scoped Copilot Code Review instructions; sanitized internal direction is limited to outcome-only rules.

Changelog

New

• Structured public and outcome-only internal policy manifests
• Deterministic path-scoped instruction generation
• Reusable component-review skill and read-only reviewer agent
• Schema, privacy, source-digest, and generated-output tests

Changed

• Replaces the base PR trial instruction with the generated policy catalog
• ADR authoring guidance identifies review-policy impact
• CI checks generated guidance and lint autofix regenerates stale output

Removed

• The hand-authored four-rule trial instruction from the base PR

Rollout strategy

• Patch release
• Minor release
• Major release; if selected, include a written rollout or migration plan
• None; review tooling, documentation, and CI only. No published package behavior changes.

Testing & Reviewing

Review this after the base trial establishes that path-scoped ADR rules produce useful CCR feedback. Compare contributor-docs/review-guidance/ with the generated instructions and consolidated skill reference. The internal policy intentionally excludes private provenance, identifiers, rationale, links, and alternatives.

Run npm run test:review-guidance and npm run check:review-guidance.

[github-actions]

⚠️ Action required

👋 Hi, this pull request contains changes to the source code that github/github-ui depends on. If you are GitHub staff, test these changes with github/github-ui using the integration workflow. If this doesn't work, you can also use the original workflow here. Check the integration testing docs for step-by-step instructions. Or, apply the integration-tests: skipped manually label to skip these checks.

To publish a canary release for integration testing, apply the Canary Release label to this PR.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e9ca907

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[joshblack]

I tried running this to see what kind of stuff it would output and I was surprised that it didn't seem to honor some of the ADRs 🤔

As an example, I tried to create an accordion component locally and was surprised that it didn't follow the file conventions ADR to include a test file.

Could you do like a before/after kind of approach for what this kind of stuff would help out with compared to baseline? In just a one-off test it didn't seem to provide a better outcome but I also get how unscientific that is lol.

Happy to keep testing if that would be better, just wanted to leave a note while looking at this today 👀

[adierkens]

@joshblack What prompts were you using?

I had it take a similar component, and same prompt and I could see the tool calls to the ADRs which made some changes to how it generated code. In the baseline example it used CSS modules, but didn't use shared mixins for focus (and did in the other), similarly my test-branch generated VRT and ART tests but the baseline one didn't.