Enhance CI workflow with security-focused code review instructions #38

Author: shps951023

.github/workflows/ci.yml

@@ -56,3 +56,12 @@ jobs:
         uses: github/copilot-code-review-action@v1
         with:
           model: gpt-4o
+          custom_instructions: |
+            You are a rigorous senior code reviewer tasked with preventing security vulnerabilities in code submissions.
+            Your assessment must be based on the code diffs of each commit.
+            - Language: English
+            - Focus on .NET security policy and best practices
+            - Flag any potential SQL injection, XSS, path traversal, insecure deserialization, or other OWASP Top 10 risks
+            - Check for hardcoded secrets, credentials, or sensitive data exposure
+            - Verify proper input validation and output encoding
+            - Ensure secure file I/O patterns (no arbitrary file access)

.github_issue_body.md

@@ -0,0 +1,62 @@
+## Summary
+
+Determine the scope, supported features, and requirements for the MiniPdf library — a minimal, zero-dependency .NET library for converting Excel (.xlsx) files to PDF.
+
+## Current State
+
+The library today (`v0.1.0`, `net9.0`) supports:
+- **Text-to-PDF**: positioned and auto-wrapped text using Helvetica / PDF 1.4
+- **Excel-to-PDF**: basic cell text rendering with automatic column layout, pagination, and per-cell font color (`PdfColor`)
+- **I/O**: file paths (`Convert(string)`, `ConvertToFile`) and streams (`Convert(Stream)`) for both input and output, plus `byte[]` via `ToArray()`
+- **Options**: `ConversionOptions` with font size, margins, column padding, line spacing, page dimensions (Letter/A4), and sheet-name header toggle
+- Zero external dependencies (built-in `System.IO.Compression` for ZIP, `System.Xml` for OOXML parsing)
+
+## Decisions Needed
+
+### 1. Target Frameworks
+- [ ] Keep `net9.0` only, or add `netstandard2.0` / `net6.0` / `net8.0` TFMs for broader adoption?
+
+### 2. Formatting Support
+| Feature | Priority | Notes |
+|---|---|---|
+| Bold / italic / underline | ? | Requires Helvetica-Bold/Oblique font references |
+| Font size per cell | ? | Currently uses a single global `FontSize` |
+| Cell background / fill color | ? | Would need `re` (rectangle fill) PDF operators |
+| Text alignment (left/center/right) | ? | Currently left-aligned only |
+| Column width from Excel (`<col>` widths) | ? | Currently auto-calculated from content length |
+| Row height from Excel | ? | Currently uses fixed `FontSize × LineSpacing` |
+| Merged cells | ? | Not currently handled |
+| Number / date formatting | ? | Cells are rendered as raw shared-string text |
+
+### 3. Advanced Content
+- [ ] **Images** — Embedded pictures in worksheets (JPEG/PNG → PDF image XObjects)
+- [ ] **Charts** — Likely out of scope for a "mini" library; document the decision
+- [ ] **Conditional formatting** — Color scales, data bars, icon sets
+- [ ] **Hyperlinks** — PDF link annotations from Excel hyperlinks
+
+### 4. Multi-Sheet Handling
+- [ ] Current behavior: all sheets rendered sequentially. Should each sheet start on a new page (current) or allow a single-sheet filter?
+- [ ] Sheet tab color or separator between sheets?
+
+### 5. Page Setup
+- [ ] Read Excel print-area / page-break settings?
+- [ ] Landscape vs. portrait auto-detection from Excel page setup?
+- [ ] Headers / footers (page numbers, sheet name, date)?
+- [ ] Configurable paper sizes beyond Letter / A4?
+
+### 6. Input / Output Contracts
+- [ ] Accept `ReadOnlyMemory<byte>` or `ReadOnlySpan<byte>` for zero-copy scenarios?
+- [ ] Async `ConvertAsync` overloads?
+- [ ] Progress callback for large files?
+
+### 7. .NET Security and Compliance
+- [ ] Follow .NET security policy (referenced in `AGENTS.md`)
+- [ ] XML parsing hardened against XXE (already using default `XDocument.Load`)
+- [ ] Validate ZIP entries to prevent zip-bomb or path-traversal attacks
+
+## Acceptance Criteria
+
+- [ ] Document the supported feature matrix in the README
+- [ ] Update `MiniPdf.csproj` `TargetFramework(s)` if multi-targeting is agreed
+- [ ] Create follow-up issues for each approved feature area
+- [ ] Add a `ROADMAP.md` or GitHub milestone to track incremental delivery