Add Advanced Copilot CLI course to the Learning Hub - #2800

website/src/content/docs/learning-hub/advanced-copilot-cli/multi-stack/02-building-ai-infrastructure.md:13

• Correct the misspelling; the repository's codespell check will flag it.

Every time you start a fresh Copilot CLI session, the agent only sees your raw files in the working directory. Without shared instructions, guidlines and codified conventions, you have to keep re-explaining your stacks and re-establishing your coding standards. That repetition makes sessions much slower and produces inconsistent output, so in this module, we build the **AI infrastructure** that makes future interactions with Copilot faster and more accurate.

.github/aw/actions-lock.json:26

• This downgrades the shared action lock from gh-aw v0.84.3 to v0.81.6 and removes the existing setup-cli entry, while the repository's other generated workflow locks still require setup v0.84.3. Recompile this workflow with the repository's current gh-aw v0.84.3 so both this registry and advanced-copilot-cli-sync.lock.yml are generated consistently.

    "github/gh-aw-actions/setup@v0.81.6": {
      "repo": "github/gh-aw-actions/setup",
      "version": "v0.81.6",
      "sha": "ba6380cc6e5be5d21677bebe04d52fb48e3abec7"

Previously missed (3) — in code that hasn't changed since the last review.

.github/workflows/advanced-copilot-cli-sync.md:28

• The declared source is already ahead of the seeded mirror. Current main uses github-samples/contoso-inventory in Modules 0, 3, and 8 and github-samples/advanced-copilot-cli in the Module 4 download and Module 6 MCP prompt, while the added pages still reference the old GeekTrainer repositories. Refresh the seed from current upstream before publishing so the initial mirror satisfies the PR's alignment claim.

- **Repository:** [`github-samples/advanced-copilot-cli`](https://github.com/github-samples/advanced-copilot-cli)
- **Branch / ref to read from:** `main` (the repository's default branch)

website/src/content/docs/learning-hub/advanced-copilot-cli/multi-stack/02-building-ai-infrastructure.md:202

• .copilot/skills/ is not a supported repository-level Agent Skills location, and this statement contradicts the working .github/skills/ path used in step 5. Learners following this explanation can create a skill that Copilot CLI does not discover.

Custom agents introduce *specialized personas*. **Agent skills** change what Copilot *knows* to do. A skill is a packaged capability, could include an instruction set, optional scripts and resources - that the agent can invoke **at runtime** when the task matches its trigger. Skills live in `.copilot/skills/` (for repo-scoped) or `~/.copilot/skills/` (for user-scoped) and in Copilot CLI, you use `/skills` to view and manage them.

website/src/content/docs/learning-hub/advanced-copilot-cli/multi-stack/06-modernize-apps.md:82

• This renders as a standalone ordered-list item numbered “2,” because the preceding LSP explanation is a normal paragraph rather than item 1. Remove the 2. prefix (or make both extension points a real two-item list) so the section is not visibly misnumbered. Apply the correction upstream as well to preserve mirror fidelity.

This issue also appears on line 258 of the same file.

2. **An MCP server** extends what Copilot can *do*; a documentation MCP server points that extension at first-party docs. [Model Context Protocol (MCP)][mcp-concept] is an open standard for giving a model access to external tools and data, and Copilot CLI ships with the GitHub MCP server built in. For a Spring Boot major upgrade the documentation that matters is the frameworks' own, and the most direct way to reach it is [GitMCP][gitmcp], an open-source server that turns any public GitHub repository into a documentation surface. Point it at `spring-projects/spring-boot` and Copilot reads Spring's own docs straight from the source, with no account or API key — and because it's open source you can self-host it. Pointing Copilot at a live docs surface is what keeps its framework claims tied to current guidance instead of whatever version happened to be current when its training data was frozen. For a framework major upgrade where the whole point is that things changed, that freshness is the difference between advice you can trust and advice you have to re-verify by hand.  

.github/workflows/advanced-copilot-cli-sync.md:18

• create-pull-request currently permits patches to any repository path. This sync agent only needs the course mirror, images, navigation, and optional codespell allowlist, so leaving the output unrestricted unnecessarily expands the blast radius of upstream prompt content.

  create-pull-request:
    labels: [automated-update, learning-hub, advanced-copilot-cli]
    title-prefix: "[bot] "
    base-branch: main

.github/aw/actions-lock.json:26

• This recompilation downgrades the repository-wide gh-aw action pin from v0.84.3 to v0.81.6 and removes the v0.84.3 setup-cli entry, although existing generated workflows and copilot-setup-steps.yml still use those v0.84.3 actions. Recompile this workflow with the repository's current gh-aw version and regenerate both lock artifacts without replacing the shared pins with an older runtime.

    "github/gh-aw-actions/setup@v0.81.6": {
      "repo": "github/gh-aw-actions/setup",
      "version": "v0.81.6",
      "sha": "ba6380cc6e5be5d21677bebe04d52fb48e3abec7"

website/src/content/docs/learning-hub/advanced-copilot-cli/multi-stack/06-modernize-apps.md:258

• Calling Jackson 3.1.4 “still-vulnerable” appears backwards: the published 3.1.x Jackson advisories identify 3.1.4 as the fixed release (for example, GHSA-5jmj-h7xm-6q6v affects versions before 3.1.4). Either cite a newer advisory whose affected range includes 3.1.4 or remove the forced BOM override; otherwise learners are instructed to change dependency management based on an unsupported security claim.

    Watch the agent work the loop: it bumps the `spring-boot-starter-parent` to Spring Boot `4.1.0` and the `java.version` from `17` to `21`, re-points the `jackson-bom` currency pin at a CVE-clean Jackson 3 (Boot 4.1.0 otherwise resolves a still-vulnerable Jackson `3.1.4`), and builds and tests after each phase. When the LSP is active, notice that it locates callers and symbols precisely rather than grepping.