chore: 🤖 sync copilot instructions - 2026-07-03

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,7 +14,7 @@ when referring to the issue.
 
 ## PR Checklist
 
-(~Strikethrough~ any points that are not applicable.)
+(~~Strikethrough~~ any points that are not applicable.)
 
 - [ ] This comment contains a description of changes with justifications, with any relevant issues linked.
 - [ ] Update docs if there are any API changes.

.github/copilot-instructions.md

@@ -9,9 +9,9 @@
 
 ## CI & enforcement suggestions (automatable)
 
-1. **PR template**: include optional AI-assistance disclosure fields (model used, high-level prompt intent, manual review confirmation).
+1. **Pull Request template**: include optional AI-assistance disclosure fields (model used, high-level prompt intent, manual review confirmation).
 2. **Pre-merge check (GitHub Action)**: verify `.github/copilot-instructions.md` is present in the repository and that new pipeline files include a `# CRAFT:` header.
-3. **Lint jobs**: `ruff` for Python, `shellcheck` for shell, `lintr` for R, and `nf-core lint` or Snakemake lint checks where applicable.
+3. **Lint jobs**: `ruff` for Python, `shellcheck` for shell, `lintr` for R, and `nf-core lint` for Snakemake, or Snakemake lint checks where applicable.
 4. **Secrets scan**: run `TruffleHog` or `Gitleaks` on PRs to detect accidental credentials.
 5. **AI usage label**: if AI usage is declared, an Action should add `generated-by-AI` label (create this label if it does not exist); the PR body should end with the italicized Markdown line: _Generated using AI_, and any associated commit messages should end with the plain footer line: `Generated using AI`.
 
@@ -108,7 +108,7 @@ Rules:
 
 ## Pull Requests
 
-When opening a pull request, use the repository's pull request template (usually it is `.github/PULL_REQUEST_TEMPLATE.md`).
+When opening a pull request, agents and authors must use the repository's pull request template (`.github/PULL_REQUEST_TEMPLATE.md`).
 Different repos have different PR templates depending on their needs.
 Ensure that the pull request follows the repository's PR template and includes all required information.
 Do not allow the developer to proceed with opening a PR if it does not fill out all sections of the template.
@@ -138,6 +138,18 @@ Example:
 - Fix bug in `detect_absolute_paths()` to ignore comments. (#123, @username)
 ```
 
+## Release Process
+
+To cut a new release in a repo, first use the draft-release workflow
+(`.github/workflows/draft-release.yml`) to draft the release.
+Then the human developer must review the draft release and ensure it meets
+quality standards, then publish the release.
+AI agents must not publish a release, it can only be done by human developers.
+When the release is published, the post-release workflow (`.github/workflows/post-release.yml`)
+will run automatically and open a new Pull Request.
+The human developer must then review the PR, and approve & merge it if the PR
+meets quality standards.
+
 ## Onboarding checklist for new developers
 
 - [ ] Read `.github/CONTRIBUTING.md` and `.github/copilot-instructions.md`.
@@ -148,17 +160,17 @@ Example:
 
 ```json
 {
-  "Insert CRAFT prompt": {
-    "prefix": "craft",
-    "body": [
-      "/* C: Context: Repo=${workspaceFolderBasename}; bioinformatics pipelines; NIH HPC (Biowulf/Helix); containers: quay.io/ccbr */",
-      "/* R: Rules: no PHI, no secrets, containerize, pin versions, follow style */",
-      "/* F: Flow: inputs/ -> results/, conf/, tests/ */",
-      "/* T: Tests: provide a one-line TEST_CMD and expected output */",
-      "",
-      "A: $1"
-    ],
-    "description": "Insert CRAFT prompt and place cursor at Actions"
-  }
+    "Insert CRAFT prompt": {
+        "prefix": "craft",
+        "body": [
+            "/* C: Context: Repo=${workspaceFolderBasename}; bioinformatics pipelines; NIH HPC (Biowulf/Helix); containers: quay.io/ccbr */",
+            "/* R: Rules: no PHI, no secrets, containerize, pin versions, follow style */",
+            "/* F: Flow: inputs/ -> results/, conf/, tests/ */",
+            "/* T: Tests: provide a one-line TEST_CMD and expected output */",
+            "",
+            "A: $1"
+        ],
+        "description": "Insert CRAFT prompt and place cursor at Actions"
+    }
 }
 ```

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Maintained Versions
 
-Actively maintained versions of contained software will vary from repository to repository, or may not be relevant at all.  
+Actively maintained versions of contained software will vary from repository to repository, or may not be relevant at all.
 The developers of this repository will update this section if any actively maintained versions of the software need to be publicly disclosed. Otherwise, contact the developers directly for any version information.
 
 ## Vulnerability Disclosure:
@@ -16,4 +16,3 @@ Follow the instructions listed in the [HHS vulnerability disclosure policy](http
 1. Click on the **Security and quality** tab of this repository.
 2. Locate the **Report a vulnerability** button. If the button is not on the **Security and quality** landing page, look under the **Advisories** section in the side bar.
 3. Click the **Report a vulnerability** button and submit the form. The developers will receive a notification of your submission.
-