From 1bee3f7d8e1dca104c0b5c5d7a7833946aa7514a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 15 Apr 2026 20:38:28 -0700
Subject: Bump codecov/codecov-action from 5 to 6 (#452)

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v5...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
---
 .github/workflows/codecoverage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/codecoverage.yml b/.github/workflows/codecoverage.yml
index 878ae247..8ce3af36 100644
--- a/.github/workflows/codecoverage.yml
+++ b/.github/workflows/codecoverage.yml
@@ -62,7 +62,7 @@ jobs:
         working-directory: ${{ steps.identify.outputs.collection_path }}
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           directory: ${{ steps.identify.outputs.collection_path }}
           fail_ci_if_error: false
-- 
cgit v1.2.3


From db645c3fc5a66f0fdadd03b5096937f70787e3b0 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Fri, 17 Apr 2026 15:22:01 +0300
Subject: T8523: add Copilot custom review instructions (#465)

* Add easy-wins improvement spec for vyos.vyos collection

Covers five phases: formatting compliance, runtime.yml redirect fix,
deprecated feature cleanup, missing unit tests, and template deduplication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add implementation plan for easy-wins improvements

15 tasks across 5 phases: formatting compliance, runtime.yml bugfix,
deprecated code cleanup, missing unit tests, template deduplication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update spec and plan with architect review corrections

Key changes:
- Defer Phase 5 (template deduplication) to v7.0.0: route_maps
  are not identical, BGP dedup blocked by Python module-level
  scoping, OSPF has fundamentally different command paradigms
- Add .git-blame-ignore-revs step to Phase 1
- Add missing test cases: overridden/rendered for resource modules,
  aggregate/purge/with_address for vyos_vlan
- Fix incorrect claim that version.py LooseVersion is unused
- Add sequential merge requirement to preamble

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add .worktrees/ and .claude/ to .gitignore

* T8523: add Copilot custom review instructions

Add .github/copilot-instructions.md and path-specific instruction
files under .github/instructions/ to teach Copilot project conventions:
copyright attribution, changelog fragment key selection, test mocking
patterns, required state coverage for resource modules, and module
option description standards.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* T8523: remove copyright instructions from Copilot config

Copyright attribution rules are internal guidance kept in Claude
config, not in Copilot review instructions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* T8523: remove docs/superpowers files inadvertently included

These spec/plan files came from local main commits that were
pulled in during rebase. They are unrelated to this PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* T8523: fix inaccuracies flagged by Copilot review

- CLI quoting: clarify that boolean flags and bare keywords are
  unquoted; only string/address values use single quotes
- Test mocking: describe get_device_data / execute_show_command as
  the primary resource module pattern (used by most existing tests);
  note get_resource_connection_facts approach as an alternative
- modules.instructions.md: broaden applyTo to include meta/runtime.yml
  so redirect guidance fires when that file is edited

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* T8523: fix legacy module mocking guidance in tests.instructions.md

Existing legacy tests use side_effect for run_commands, not
return_value. Updated to describe side_effect as the standard
approach, note return_value as also acceptable for fixed responses,
and clarify that the patched helper varies by module (run_commands
for command/facts/ping, load_config/get_config for vyos_config).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* T8523: fix four more inaccuracies flagged by Copilot review

- CLI quoting: address values in firewall groups are unquoted in
  fixtures; instruct reviewers to align with surrounding fixture
  style rather than flagging all unquoted addresses
- Resource module mocking: add .start()/.stop() calls to the snippet
  so it matches the actual setUp/tearDown pattern in existing tests
- terminal plugin versions: reference README.md instead of hardcoding
  a version list that diverges from README
- changelog fragment: remove stale "copyright headers" claim (that
  section was dropped from the instruction files)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/copilot-instructions.md               |  49 +++++++++++
 .github/instructions/modules.instructions.md  |  37 +++++++++
 .github/instructions/tests.instructions.md    | 114 ++++++++++++++++++++++++++
 .gitignore                                    |   6 ++
 changelogs/fragments/copilot-instructions.yml |   4 +
 5 files changed, 210 insertions(+)
 create mode 100644 .github/copilot-instructions.md
 create mode 100644 .github/instructions/modules.instructions.md
 create mode 100644 .github/instructions/tests.instructions.md
 create mode 100644 changelogs/fragments/copilot-instructions.yml

(limited to '.github')

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 00000000..fc25faa1
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,49 @@
+# Copilot Review Instructions — vyos.vyos
+
+This is the `vyos.vyos` Ansible network collection for managing VyOS devices.
+Namespace `vyos`, name `vyos`, version `6.0.0`. All modules are prefixed `vyos_`.
+
+## Commit and PR standards
+
+- Every commit title must start with a Phorge task ID: `T<number>: description`.
+- Every PR must have exactly one changelog fragment in `changelogs/fragments/`.
+- PR descriptions that state a test count (e.g. "Add 8 unit tests") must match the actual number of test methods in the changed files. Flag mismatches.
+
+## Changelog fragments
+
+Fragments are YAML files under `changelogs/fragments/`. Valid top-level keys:
+
+| Key | Use for |
+|-----|---------|
+| `trivial` | Developer tooling, CI, housekeeping, formatting-only changes |
+| `bugfixes` | Bug fixes |
+| `minor_changes` | New features or user-visible improvements |
+| `major_changes` | Breaking changes |
+| `security_fixes` | Security fixes |
+| `doc_changes` | Documentation-only changes |
+
+Flag any fragment that uses `minor_changes` for what is actually developer tooling (linting, formatting, gitignore, test scaffolding). Those should use `trivial`.
+
+## Module architecture
+
+Two module families:
+
+**Resource modules** (`vyos_interfaces`, `vyos_firewall_rules`, `vyos_bgp_global`, etc.) follow a four-part structure under `plugins/module_utils/network/vyos/`:
+- `argspec/{resource}/` — argument spec
+- `config/{resource}/` — config builder
+- `facts/{resource}/` — facts parser
+- `rm_templates/{resource}.py` — regex/Jinja2 CLI templates
+
+Resource modules support all states: `merged`, `replaced`, `overridden`, `deleted`, `rendered`, `gathered`, `parsed`.
+
+**Legacy modules** (`vyos_vlan`, `vyos_config`, `vyos_command`, `vyos_user`, etc.) do not follow the resource module pattern.
+
+## VyOS CLI conventions
+
+- Set commands: `set interfaces ethernet eth0 address '192.0.2.1/24'`
+- Delete commands: `delete interfaces ethernet eth0 address '192.0.2.1/24'`
+- Quoting varies by context. In general, string values (descriptions, names, ELIN numbers) are single-quoted; boolean flags and bare keywords are not. However, address/prefix values may be quoted or unquoted depending on where they appear:
+  - Quoted: `address '192.0.2.1/24'`, `description 'my-iface'`, `elin '0000000911'`
+  - Unquoted: `address 192.0.2.1` (in firewall groups), `disable`, `mtu-ignore`, `vif 200`
+- When reviewing tests and fixtures, align with the quoting style used by surrounding fixtures rather than flagging a missing quote as an error.
+- Interface types: `ethernet`, `loopback`, `bonding`, `bridge`, `tunnel`, `wireguard`.
diff --git a/.github/instructions/modules.instructions.md b/.github/instructions/modules.instructions.md
new file mode 100644
index 00000000..d7782e1e
--- /dev/null
+++ b/.github/instructions/modules.instructions.md
@@ -0,0 +1,37 @@
+---
+applyTo: "plugins/**,meta/runtime.yml"
+---
+
+# Plugin conventions
+
+## Module option descriptions
+
+- Must be complete English sentences ending with a period.
+- No grammar errors. Common mistake: "the number hops" should be "the number of hops".
+- Deprecated options must include `removed_in_version` and `removed_from_collection` fields.
+- Do not add new options with `deprecated: true` — remove deprecated options entirely.
+
+## rm_templates files
+
+Files in `plugins/module_utils/network/vyos/rm_templates/` define regex parsers and Jinja2 generators for a resource module. Each entry has:
+- `name` — unique identifier
+- `getval` — compiled regex with named groups
+- `setval` — Jinja2 template or callable producing a VyOS CLI command
+- `result` — dict mapping regex groups to facts structure
+- `shared` (optional) — bool, whether the template applies to a shared config block
+
+## meta/runtime.yml redirects
+
+Short-name redirects must point to the actual module name with the `vyos_` prefix. For example:
+```yaml
+snmp_server:
+  redirect: vyos.vyos.vyos_snmp_server   # correct
+  # NOT: vyos.vyos.vyos_snmp_servers     # wrong (pluralized)
+```
+
+Verify any changed redirect target exists as a real module file under `plugins/modules/`.
+
+## cliconf / terminal plugins
+
+`plugins/cliconf/vyos.py` — do not modify without understanding edit-mode and commit semantics.
+`plugins/terminal/vyos.py` — handles prompt detection; regex changes require testing against all supported VyOS versions listed in README.md.
diff --git a/.github/instructions/tests.instructions.md b/.github/instructions/tests.instructions.md
new file mode 100644
index 00000000..150db41e
--- /dev/null
+++ b/.github/instructions/tests.instructions.md
@@ -0,0 +1,114 @@
+---
+applyTo: "tests/unit/**"
+---
+
+# Unit test conventions
+
+## Base class and structure
+
+All test classes inherit from `TestVyosModule` in `tests/unit/modules/network/vyos/vyos_module.py`.
+
+```python
+class TestVyosFooModule(TestVyosModule):
+    module = vyos_foo
+
+    def setUp(self): ...
+    def tearDown(self): ...
+    def load_fixtures(self, commands=None, filename=None): ...
+    def test_...(self): ...
+```
+
+## Mocking: resource modules
+
+Resource module tests require two framework-level patches in `setUp` with corresponding cleanup in `tearDown`:
+
+```python
+# in setUp:
+self.mock_get_resource_connection_config = patch(
+    "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.cfg.base.get_resource_connection"
+)
+self.get_resource_connection_config = self.mock_get_resource_connection_config.start()
+
+self.mock_get_resource_connection_facts = patch(
+    "ansible_collections.ansible.netcommon.plugins.module_utils.network.common.facts.facts.get_resource_connection"
+)
+self.get_resource_connection_facts = self.mock_get_resource_connection_facts.start()
+
+# in tearDown:
+self.mock_get_resource_connection_config.stop()
+self.mock_get_resource_connection_facts.stop()
+```
+
+Most resource module tests also patch the facts class's `get_device_data` method directly and use it in `load_fixtures`:
+
+```python
+# in setUp:
+self.mock_execute_show_command = patch(
+    "ansible_collections.vyos.vyos.plugins.module_utils.network.vyos."
+    "facts.{resource}.{resource}.{Resource}Facts.get_device_data"
+)
+self.execute_show_command = self.mock_execute_show_command.start()
+
+# in load_fixtures:
+def load_from_file(*args, **kwargs):
+    return load_fixture("vyos_{resource}_config.cfg")
+self.execute_show_command.side_effect = load_from_file
+```
+
+An alternative pattern sets `self.get_resource_connection_facts.return_value.get_config.return_value = fixture_data` in `load_fixtures` instead — both approaches work, but the `get_device_data` pattern is used by most existing tests.
+
+## Mocking: legacy modules
+
+Legacy modules (`vyos_vlan`, `vyos_config`, `vyos_command`, etc.) patch the specific helper the module calls, directly in the module under test. Which helper depends on the module:
+
+```python
+# vyos_command, vyos_facts, vyos_ping — patch run_commands
+self.mock_run_commands = patch("ansible_collections.vyos.vyos.plugins.modules.vyos_foo.run_commands")
+# vyos_config — patch get_config / load_config
+self.mock_load_config = patch("ansible_collections.vyos.vyos.plugins.modules.vyos_foo.load_config")
+```
+
+In `load_fixtures`, configure the mock using `side_effect` (for dynamic fixture loading) or `return_value` (for a fixed response):
+
+```python
+# side_effect — used by most existing legacy tests
+def load_from_file(*args, **kwargs):
+    return load_fixture("vyos_foo_config.cfg")
+self.run_commands.side_effect = load_from_file
+
+# return_value — acceptable for simple fixed responses
+self.run_commands.return_value = [SHOW_OUTPUT]
+```
+
+## load_fixtures and filename
+
+`execute_module()` always calls `load_fixtures()`. Never set mock return values inside a test method — they will be overwritten by the next `execute_module` call. Use the `filename` parameter to vary the fixture:
+
+```python
+def load_fixtures(self, commands=None, filename=None):
+    if filename == "empty":
+        self.run_commands.return_value = [EMPTY_OUTPUT]
+    else:
+        self.run_commands.return_value = [DEFAULT_OUTPUT]
+```
+
+Then call: `self.execute_module(changed=True, commands=commands, filename="empty")`
+
+## Fixture files
+
+Raw device CLI output lives in `tests/unit/modules/network/vyos/fixtures/` as `.cfg` files.
+Load with `load_fixture("vyos_foo_config.cfg")`.
+
+## Required test coverage for resource modules
+
+A complete resource module test file should cover all applicable states:
+- `merged` (including an idempotent case)
+- `replaced`
+- `overridden`
+- `deleted`
+- `rendered` — assert `result["rendered"]` matches expected CLI commands
+- `gathered` — assert `result["gathered"]` contains expected structured data
+- `parsed` — pass `running_config=raw_string` and assert `result["parsed"]`
+
+Flag test files that are missing `rendered`, `gathered`, or `parsed` tests without explanation.
+
diff --git a/.gitignore b/.gitignore
index cbe347c4..1dbe8b0e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -120,3 +120,9 @@ changelogs/.plugin-cache.yaml
 inventory.network
 
 *.bak
+
+# Git worktrees
+.worktrees/
+
+# Claude Code
+.claude/
diff --git a/changelogs/fragments/copilot-instructions.yml b/changelogs/fragments/copilot-instructions.yml
new file mode 100644
index 00000000..c7af5c74
--- /dev/null
+++ b/changelogs/fragments/copilot-instructions.yml
@@ -0,0 +1,4 @@
+---
+trivial:
+  - Add Copilot custom review instructions to guide automated code review with
+    project-specific conventions for tests, changelog fragments, and module patterns.
-- 
cgit v1.2.3


From 80035465ca7345e9ba5aae8e6d49cf536bd75aa0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 26 Apr 2026 17:19:48 +0300
Subject: Bump ansible/team-devtools/.github/workflows/ah_token_refresh.yml
 (#448)

Bumps [ansible/team-devtools/.github/workflows/ah_token_refresh.yml](https://github.com/ansible/team-devtools) from 26.1.0 to 26.2.0.
- [Release notes](https://github.com/ansible/team-devtools/releases)
- [Commits](https://github.com/ansible/team-devtools/compare/v26.1.0...v26.2.0)

---
updated-dependencies:
- dependency-name: ansible/team-devtools/.github/workflows/ah_token_refresh.yml
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
---
 .github/workflows/ah_token_refresh.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/ah_token_refresh.yml b/.github/workflows/ah_token_refresh.yml
index 0346920e..0c8cba7b 100644
--- a/.github/workflows/ah_token_refresh.yml
+++ b/.github/workflows/ah_token_refresh.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
     refresh:
-        uses: ansible/team-devtools/.github/workflows/ah_token_refresh.yml@v26.1.0
+        uses: ansible/team-devtools/.github/workflows/ah_token_refresh.yml@v26.2.0
         with:
             environment: release
         secrets:
-- 
cgit v1.2.3


From 29aac3de8d3b222ee3644ba1a192daaa765adbf7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 16:45:46 -0700
Subject: Bump ansible/team-devtools/.github/workflows/ah_token_refresh.yml
 (#468)

Bumps [ansible/team-devtools/.github/workflows/ah_token_refresh.yml](https://github.com/ansible/team-devtools) from 26.2.0 to 26.4.0.
- [Release notes](https://github.com/ansible/team-devtools/releases)
- [Commits](https://github.com/ansible/team-devtools/compare/v26.2.0...v26.4.0)

---
updated-dependencies:
- dependency-name: ansible/team-devtools/.github/workflows/ah_token_refresh.yml
  dependency-version: 26.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
---
 .github/workflows/ah_token_refresh.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/ah_token_refresh.yml b/.github/workflows/ah_token_refresh.yml
index 0c8cba7b..09d2f9db 100644
--- a/.github/workflows/ah_token_refresh.yml
+++ b/.github/workflows/ah_token_refresh.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
     refresh:
-        uses: ansible/team-devtools/.github/workflows/ah_token_refresh.yml@v26.2.0
+        uses: ansible/team-devtools/.github/workflows/ah_token_refresh.yml@v26.4.0
         with:
             environment: release
         secrets:
-- 
cgit v1.2.3


From f1e00c85fea01b805e0b4f86aed014ccf4fae00e Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Fri, 8 May 2026 21:27:40 +0300
Subject: general: T8595: add AGENTS.md (#472)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* general: T8595: add AGENTS.md

* general: T8595: clean leaked internal references

* general: T8595: restore eaten spaces in shell command examples

* general: T8595: correct CI scope (no integration in CI yet) and version-matrix attribution

* general: T8595: add changelog fragment + refine CI scope (unit-galaxy/unit-source)

* general: T8595: address Copilot review threads on test command and commit convention

- Line 15: add `ansible-test units` alongside the existing pytest
  command; the two correspond to the unit-galaxy and unit-source CI
  jobs respectively, so documenting both gives contributors accurate
  options for each CI path.

- Line 30: change "Commit / PR title" to "Commit headline". No
  workflow in this repo enforces PR title format; the PR template
  checklist confirms only commit headlines must carry a Phorge task ID.

🤖 Generated by [robots](https://vyos.io)
---
 .github/copilot-instructions.md              | 50 +---------------------------
 AGENTS.md                                    | 39 ++++++++++++++++++++++
 changelogs/fragments/T8595_add_agents_md.yml |  2 ++
 3 files changed, 42 insertions(+), 49 deletions(-)
 mode change 100644 => 120000 .github/copilot-instructions.md
 create mode 100644 AGENTS.md
 create mode 100644 changelogs/fragments/T8595_add_agents_md.yml

(limited to '.github')

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
deleted file mode 100644
index fc25faa1..00000000
--- a/.github/copilot-instructions.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# Copilot Review Instructions — vyos.vyos
-
-This is the `vyos.vyos` Ansible network collection for managing VyOS devices.
-Namespace `vyos`, name `vyos`, version `6.0.0`. All modules are prefixed `vyos_`.
-
-## Commit and PR standards
-
-- Every commit title must start with a Phorge task ID: `T<number>: description`.
-- Every PR must have exactly one changelog fragment in `changelogs/fragments/`.
-- PR descriptions that state a test count (e.g. "Add 8 unit tests") must match the actual number of test methods in the changed files. Flag mismatches.
-
-## Changelog fragments
-
-Fragments are YAML files under `changelogs/fragments/`. Valid top-level keys:
-
-| Key | Use for |
-|-----|---------|
-| `trivial` | Developer tooling, CI, housekeeping, formatting-only changes |
-| `bugfixes` | Bug fixes |
-| `minor_changes` | New features or user-visible improvements |
-| `major_changes` | Breaking changes |
-| `security_fixes` | Security fixes |
-| `doc_changes` | Documentation-only changes |
-
-Flag any fragment that uses `minor_changes` for what is actually developer tooling (linting, formatting, gitignore, test scaffolding). Those should use `trivial`.
-
-## Module architecture
-
-Two module families:
-
-**Resource modules** (`vyos_interfaces`, `vyos_firewall_rules`, `vyos_bgp_global`, etc.) follow a four-part structure under `plugins/module_utils/network/vyos/`:
-- `argspec/{resource}/` — argument spec
-- `config/{resource}/` — config builder
-- `facts/{resource}/` — facts parser
-- `rm_templates/{resource}.py` — regex/Jinja2 CLI templates
-
-Resource modules support all states: `merged`, `replaced`, `overridden`, `deleted`, `rendered`, `gathered`, `parsed`.
-
-**Legacy modules** (`vyos_vlan`, `vyos_config`, `vyos_command`, `vyos_user`, etc.) do not follow the resource module pattern.
-
-## VyOS CLI conventions
-
-- Set commands: `set interfaces ethernet eth0 address '192.0.2.1/24'`
-- Delete commands: `delete interfaces ethernet eth0 address '192.0.2.1/24'`
-- Quoting varies by context. In general, string values (descriptions, names, ELIN numbers) are single-quoted; boolean flags and bare keywords are not. However, address/prefix values may be quoted or unquoted depending on where they appear:
-  - Quoted: `address '192.0.2.1/24'`, `description 'my-iface'`, `elin '0000000911'`
-  - Unquoted: `address 192.0.2.1` (in firewall groups), `disable`, `mtu-ignore`, `vif 200`
-- When reviewing tests and fixtures, align with the quoting style used by surrounding fixtures rather than flagging a missing quote as an error.
-- Interface types: `ethernet`, `loopback`, `bonding`, `bridge`, `tunnel`, `wireguard`.
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 120000
index 00000000..be77ac83
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1 @@
+../AGENTS.md
\ No newline at end of file
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..436b6785
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,39 @@
+# AGENTS.md
+
+## Project purpose
+The official Ansible Collection for managing VyOS network appliances (`vyos.vyos` namespace). Provides modules, plugins, action handlers, terminal plugins, and resource modules for BGP, OSPF, firewall, interfaces, NTP, etc.
+
+## Tech stack
+- Ansible Collection (Galaxy). Python control-plane code under `plugins/`.
+- `galaxy.yml` declares `namespace: vyos`, `name: vyos`, `version: 6.0.0`, dep `ansible.netcommon >= 2.5.1`, license_file `LICENSE` (GPL-3.0).
+- Test stack: `pytest` + `tox-ansible.ini`; lint via flake8, isort, black (line-length 100), pre-commit, ansible-lint.
+- Runtime deps: `paramiko`, `scp` (`requirements.txt`); `bindep.txt` for system deps.
+
+## Build / test / run
+- Build: `ansible-galaxy collection build` produces a `vyos-vyos-<version>.tar.gz`.
+- Install local dev: `ansible-galaxy collection install . --force`.
+- Test (unit): `ansible-test units` (matches `unit-galaxy` CI job; requires collection installed under `~/.ansible/collections/`). Fast local alternative: `source .venv/bin/activate && PYTHONPATH=".collections" python -m pytest tests/unit` (matches `unit-source` CI path; config in `pyproject.toml`). CI (`.github/workflows/tests.yml`) runs the changelog / build-import / ansible-lint / sanity / unit-galaxy / unit-source jobs; integration tests live under `tests/integration/` but are not yet wired into CI. Per `README.md`, the collection targets VyOS 1.3.8 / 1.4.1 / 1.5-rolling (no version matrix in the workflow itself).
+
+## Repository layout
+- `plugins/{action,cliconf,doc_fragments,filter,inventory,module_utils,modules,terminal}/` — collection content.
+- `tests/` — sanity, unit, integration directories. CI (`.github/workflows/tests.yml`) runs sanity + unit-galaxy + unit-source (plus changelog / build-import / ansible-lint); integration is not yet wired into CI.
+- `docs/` — generated module docs.
+- `meta/`, `changelogs/`, `CHANGELOG.rst` — Galaxy + release metadata.
+- `pyproject.toml` (black/pytest config), `.flake8`, `.isort.cfg`, `.ansible-lint`, `.pre-commit-config.yaml`.
+- `.github/workflows/` — `tests.yml`, `release.yml`, `codecoverage.yml`, `cla-check.yml`, `ah_token_refresh.yml`, `check_label.yaml`.
+
+## Cross-repo context
+- Consumed by Ansible users running playbooks against VyOS routers built by `vyos/vyos-build`.
+- The `vyos.vyos` collection talks to VyOS via `network_cli` connections; supports the same train branches (`current`, `circinus`, `sagitta`, `equuleus`).
+
+## Conventions
+- Commit headline: `T12345: description` (Phorge ID at https://vyos.dev mandatory). No workflow enforces PR title format in this repo.
+- Every PR must include exactly one changelog fragment under `changelogs/fragments/`; use `doc_changes` for documentation-only updates, or `trivial` for tooling / housekeeping changes.
+- Default branch `main` (not `current` — this repo predates the rename convention).
+- Issues tracked at https://vyos.dev (see `galaxy.yml`).
+- Codecov + CodeRabbit configured (`codecov.yml`, `.coderabbit.yaml`).
+
+## Notes for future contributors
+- Galaxy versioning is independent of VyOS train versioning — bump in `galaxy.yml` per release.
+- Tested matrix is in README; expand only after smoketesting against real images.
+- `PR408_README.md` plus `pr408-diagram.png` document a non-trivial historical refactor; read before touching resource-module structure.
diff --git a/changelogs/fragments/T8595_add_agents_md.yml b/changelogs/fragments/T8595_add_agents_md.yml
new file mode 100644
index 00000000..5d7fb0a4
--- /dev/null
+++ b/changelogs/fragments/T8595_add_agents_md.yml
@@ -0,0 +1,2 @@
+trivial:
+  - Add AGENTS.md tool-neutral contributor documentation, with .github/copilot-instructions.md symlink for Copilot code review compatibility.
-- 
cgit v1.2.3


From 8e3b18f034d7183d6d756c10ec8c7c93b574d01d Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Thu, 28 May 2026 13:09:00 +0300
Subject: T8615: add Mergify config (extends: mergify central template) (#476)

* T8615: add Mergify config (extends: mergify central template)

Adds the org-local central-config inheritance file per the T8615 sweep
(re-scoped 2026-05-28). 4-line minimum: extends: mergify resolves to
vyos/mergify which provides commands_restrictions (9 slash commands x
4-sender allowlist), conflict labeler, PR-title T-ID format check,
opt-in auto-update, and the backport-conflict merge protection.

merge_protections_settings: reporting_method: check-runs declared
explicitly per-repo because only defaults and commands_restrictions are
documented as merging across extends: -- pin to current behavior pre
the 2026-07-31 default flip per data/github.md Mergify gotchas table.

Phase 0 CR: 0 finding(s). Known false positive: CR flags
extends: mergify as 'not a documented built-in preset' but Mergify
documents the org-local form at https://docs.mergify.com/configuration/sharing/.

Refs: T8615 (re-scoped 2026-05-28), IS-421

Generated by robots https://vyos.io

* T8615: switch yaml-language-server schema URL to JSON-schema

Replaces the human-docs file-format URL (which serves HTML and cannot
drive editor validation) with the machine-readable JSON-schema URL
that yaml-language-server actually resolves for autocomplete and
schema validation.

Old: https://docs.mergify.com/configuration/file-format/
New: https://docs.mergify.com/mergify-configuration-schema.json

Phase 0 CR: 0
0 finding(s).

Refs: T8615 (re-scoped 2026-05-28), IS-421

Generated by robots https://vyos.io
---
 .github/mergify.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .github/mergify.yml

(limited to '.github')

diff --git a/.github/mergify.yml b/.github/mergify.yml
new file mode 100644
index 00000000..525594cc
--- /dev/null
+++ b/.github/mergify.yml
@@ -0,0 +1,4 @@
+# yaml-language-server: $schema=https://docs.mergify.com/mergify-configuration-schema.json
+extends: mergify
+merge_protections_settings:
+  reporting_method: check-runs
-- 
cgit v1.2.3


From c1e3b4d9009bda56b21bcb8f34d936393f9d7650 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sat, 30 May 2026 16:06:21 +0300
Subject: ci: T8943: sweep HIGH-producer pins to renamed branches (rollout 1c)
 (#477)

Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github,
vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their
old default branch to the new production compat branch staged in Task 1.
No functional change; pin-ref rewrite only.

Tracking: T8943
---
 .github/workflows/cla-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
index da3e6efd..fa96d19d 100644
--- a/.github/workflows/cla-check.yml
+++ b/.github/workflows/cla-check.yml
@@ -11,5 +11,5 @@ on:
     types: [created]
 jobs:
   call-cla-assistant:
-    uses: vyos/vyos-cla-signatures/.github/workflows/cla-reusable.yml@current
+    uses: vyos/vyos-cla-signatures/.github/workflows/cla-reusable.yml@production
     secrets: inherit
-- 
cgit v1.2.3


From 55758ebb3578d01db3e54a052eb6c2ab775162ca Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sat, 6 Jun 2026 00:00:34 +0300
Subject: ci: T8966: add product T-ID title/commit check (opt-in relocation)
 (#481)

---
 .github/mergify.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to '.github')

diff --git a/.github/mergify.yml b/.github/mergify.yml
index 525594cc..bd832b72 100644
--- a/.github/mergify.yml
+++ b/.github/mergify.yml
@@ -2,3 +2,22 @@
 extends: mergify
 merge_protections_settings:
   reporting_method: check-runs
+
+pull_request_rules:
+  - name: Flag product T-ID format violation in PR title or commit messages
+    description: >
+      Product-repo convention: PR title and every commit's first line must
+      match `T<digits>: <text>` (optional `scope: ` prefix). Relocated from
+      the central config (T8966) so the T-ID convention is opt-in per product
+      repo. Name is intentionally distinct from any central rule name so this
+      stays additive (not an `extends:` override).
+    conditions:
+      - '-closed'
+      - '-merged'
+      - or:
+          - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
+          - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+    actions:
+      label:
+        toggle:
+          - invalid-task-id
-- 
cgit v1.2.3


From 69fccf7db6857106e13fa29fee63176c3b52248d Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sat, 6 Jun 2026 19:02:37 +0300
Subject: ci: T8966: exempt bots from product T-ID (invalid-task-id) gate
 (#482)

---
 .github/mergify.yml | 3 +++
 1 file changed, 3 insertions(+)

(limited to '.github')

diff --git a/.github/mergify.yml b/.github/mergify.yml
index bd832b72..49298b52 100644
--- a/.github/mergify.yml
+++ b/.github/mergify.yml
@@ -14,6 +14,9 @@ pull_request_rules:
     conditions:
       - '-closed'
       - '-merged'
+      - '-author~=\[bot\]$'
+      - 'author!=copilot-swe-agent'
+      - 'author!=vyosbot'
       - or:
           - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
           - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
-- 
cgit v1.2.3


From 95d335540ff8dd9c7d2ad618c8d9b569f15c6252 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Mon, 8 Jun 2026 01:34:47 +0300
Subject: T8966: add legacy-label escape to invalid-task-id rule (commit check
 exempt) (#483)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The per-repo T-ID rule flagged every commit's first line, but on repos that
squash-merge AND block force-push (vyos.vyos enforces non_fast_forward on ~ALL
branches, zero bypass) authors cannot rewrite history to make existing commits
conform. The label became unclearable. Keep the title check (always fixable),
and exempt the per-commit check when a maintainer applies the new `legacy`
label. New PRs are still nudged toward the convention.

🤖 Generated by [robots](https://vyos.io)
---
 .github/mergify.yml | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

(limited to '.github')

diff --git a/.github/mergify.yml b/.github/mergify.yml
index 49298b52..43353ea4 100644
--- a/.github/mergify.yml
+++ b/.github/mergify.yml
@@ -6,11 +6,17 @@ merge_protections_settings:
 pull_request_rules:
   - name: Flag product T-ID format violation in PR title or commit messages
     description: >
-      Product-repo convention: PR title and every commit's first line must
-      match `T<digits>: <text>` (optional `scope: ` prefix). Relocated from
-      the central config (T8966) so the T-ID convention is opt-in per product
-      repo. Name is intentionally distinct from any central rule name so this
-      stays additive (not an `extends:` override).
+      Product-repo convention: the PR title AND every commit's first line must
+      match `T<digits>: <text>` (optional `scope: ` prefix). The title is always
+      checked; the per-commit check is exempted when a maintainer applies the
+      `legacy` label — an escape hatch for grandfathered PRs whose commit history
+      cannot be rewritten (repos that squash-merge AND block force-push, e.g.
+      vyos.vyos enforces `non_fast_forward` on ~ALL branches with zero bypass).
+      New PRs are still nudged toward the convention; `legacy` is the deliberate,
+      maintainer-controlled opt-out. Relocated from the central config (T8966)
+      so the convention is opt-in per product repo. Name is intentionally
+      distinct from any central rule name so this stays additive (not an
+      `extends:` override). Legacy-label escape added 2026-06-08 (T8966).
     conditions:
       - '-closed'
       - '-merged'
@@ -19,7 +25,9 @@ pull_request_rules:
       - 'author!=vyosbot'
       - or:
           - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
-          - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+          - and:
+              - 'label!=legacy'
+              - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
     actions:
       label:
         toggle:
-- 
cgit v1.2.3


From 6e53f1eaaab328d38a5c5fd82a29b77b34d5143b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 8 Jun 2026 19:03:15 +0000
Subject: Bump codecov/codecov-action from 6 to 7

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6 to 7.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codecoverage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to '.github')

diff --git a/.github/workflows/codecoverage.yml b/.github/workflows/codecoverage.yml
index 8ce3af36..ee71e179 100644
--- a/.github/workflows/codecoverage.yml
+++ b/.github/workflows/codecoverage.yml
@@ -62,7 +62,7 @@ jobs:
         working-directory: ${{ steps.identify.outputs.collection_path }}
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           directory: ${{ steps.identify.outputs.collection_path }}
           fail_ci_if_error: false
-- 
cgit v1.2.3


From 17041b6f6953b993762854a67953fb35176b46e7 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Tue, 14 Jul 2026 22:42:23 +0300
Subject: ci: T9082: onboard CodeQL scanning (#488)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* ci: T9082: onboard CodeQL scanning via central reusable workflow

🤖 Generated by [robots](https://vyos.io)

* ci: T9082: add trivial changelog fragment for the CodeQL workflow

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/codeql.yml                   | 30 ++++++++++++++++++++++++++
 changelogs/fragments/T9082-codeql-workflow.yml |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 changelogs/fragments/T9082-codeql-workflow.yml

(limited to '.github')

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..b83b94e0
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,30 @@
+name: "Perform CodeQL Analysis"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '!**/*.md'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '!**/*.md'
+  schedule:
+    - cron: '52 13 * * 0'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  codeql-analysis-call:
+    uses: vyos/.github/.github/workflows/codeql-analysis.yml@production
+    with:
+      languages: "['python']"
diff --git a/changelogs/fragments/T9082-codeql-workflow.yml b/changelogs/fragments/T9082-codeql-workflow.yml
new file mode 100644
index 00000000..5d09acd7
--- /dev/null
+++ b/changelogs/fragments/T9082-codeql-workflow.yml
@@ -0,0 +1,2 @@
+trivial:
+  - Add CodeQL analysis workflow calling the VyOS org-wide central reusable (T9082).
-- 
cgit v1.2.3