microsoft/github-copilot-modernization

Architect analysis for rewrite/migration: produces structured architecture artifacts plus global prose research views (project-structure, tech-stack, data-model) for planning, implementation, feature-inventory, and gates. This is the single architect task. Triggers: "analyze architecture", "analyze existing application", "analyze the codebase", "codebase architecture analysis", "analyze for migration", "prepare migration analysis", "produce migration artifacts", "analyze before rewrite". NOT for: greenfield projects, pure syntax/version migrations (Python2→3, Java 8→17 — no paradigm shift), runtime validation (use runtime-validation), infrastructure/deployment analysis (use analyzing-operations), feature inventory/spec writing (use feature-inventory).

Generate API and service communication contracts with sequence diagram

Lifecycle hooks for the modernize-rearchitecture coordinator. Defines hook points, registered actions, and execution rules.

Generate architecture diagram with component relationship details from project analysis

Run a fully local application assessment for one Java, .NET, or JavaScript/TypeScript repository

Convert an arbitrary CSV report (e.g. a Black Duck export or a custom migration-issue inventory) into a schema-valid assessment report.json the modernization pipeline can consume — so it appears in the assessment UI and migration solutions resolve automatically. This skill is LLM-driven: you read and interpret the CSV yourself and author report.json by hand against the schema. A small helper script only does deterministic lookups (migration solutions, the ruleId for a solution) and validates the finished report. There is NO "convert everything" script and NO assumed column layout. Triggers: "convert csv to assessment report", "import csv report", "turn this spreadsheet into a report.json", "Black Duck csv to report", "build report.json from csv", "migrate a third-party assessment export". NOT for: AppCAT-style analysis from source (use assessment), generating a modernization plan (use create-modernization-plan), or editing a report.json the pipeline already produced.

Deterministic local control-plane utilities for parsing, preflighting, validating, and tracking multi-repository modernization batches.

Analyzes JVM projects (Java/Kotlin/Scala/Groovy) and generates knowledge graphs with tree-sitter parsing. Requires Python 3 on the host and a JVM project with Maven/Gradle/Ant/Ivy build files. Skips gracefully if either prerequisite is missing. Triggers when asked to "build knowledge graph", "analyze project structure", "parse Java codebase", or "generate dependency graph".

Generate core business workflow documentation with sequence diagram

Evaluates whether a user's modernization/rewrite request provides enough scenario context to proceed (e.g., target component library, screenshots, design system for frontend; API contract policy, data migration strategy for backend). Produces a deterministic clarity score, emits the complete question set at once as an on-disk clarification-questions.json (the source of truth for the Q&A round; rendered externally into a webview/markdown, answers come back as a markdown document), and writes a canonical clarification.md artifact consumed by all downstream agents. Triggers: "clarification gate", "scenario clarification", "elicit missing context", "evaluate prompt completeness", "ask user for screenshots / target library / design system". NOT for: feature specification (use feature-inventory), planning (use creating-implementation-plan), implementation (use implementing-code), or resolving spec-time [NEEDS CLARIFICATION] markers (those remain owned by feature-inventory).

Generate comprehensive configuration and externalized settings inventory

Create a modernization plan to migrate the project to Azure

Create a test baseline for the project to be modernized. The baseline will be used for later verification of modernization tasks.

Creates an implementation plan AND task breakdown from a feature spec by consuming design artifacts. Produces plan.md with implementation steps, inline task list with full REQ traceability, and a Requirement Mapping table. This is the single skill for planning + decomposition. Triggers: "create implementation plan", "plan for implementation", "assemble implementation plan", "generate plan from spec", "break down tasks", "generate tasks from plan", "create implementation tasks", "decompose the plan into work items". NOT for: architecture analysis (use analyzing-architecture), implementation (use implementing-code), coordinator task decomposition.

Detect known CVEs in Maven, NuGet, or npm dependencies using the GitHub Security Advisories API

Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).

Assess codebase for CWE code quality vulnerabilities (CWE-130, CWE-456, CWE-457, CWE-477, CWE-570, CWE-571, CWE-606, CWE-665, CWE-681, CWE-682, CWE-772, CWE-775, CWE-783, CWE-789, CWE-835, CWE-1057)

Assess codebase for CWE concurrency & synchronization vulnerabilities (CWE-543, CWE-567, CWE-662, CWE-667, CWE-820, CWE-821)

Assess codebase for CWE credentials & secrets vulnerabilities (CWE-259, CWE-321, CWE-732, CWE-778, CWE-798)

Assess codebase for CWE file & path security vulnerabilities (CWE-22, CWE-23, CWE-36, CWE-434, CWE-611)

Assess codebase for CWE injection attacks vulnerabilities (CWE-77, CWE-78, CWE-79, CWE-88, CWE-89, CWE-90, CWE-91, CWE-99, CWE-502, CWE-564, CWE-643, CWE-652)

Assess codebase for CWE memory safety vulnerabilities (CWE-119, CWE-120, CWE-123, CWE-125, CWE-415, CWE-416, CWE-672, CWE-786, CWE-787, CWE-788, CWE-805, CWE-822, CWE-823, CWE-824, CWE-825)

Generate task DAGs for modernization projects — select fragments from task catalog, produce initial DAG (Stage 1), and execute/validate DAG from plan artifacts (Stage 2).

Generate data architecture and persistence layer documentation with data model diagram

Generate dependency map diagram from project build files

Catalogs existing features from a codebase (API endpoints, user flows, UI screens, observable behaviors) and generates structured feature specs with REQ-XXX IDs, user scenarios, and success criteria. Triggers: "inventory features", "catalog existing functionality", "list what the app does", "extract requirements from code", "generate feature specs from research", "write a spec", "create feature specification", "define requirements". NOT for: implementation planning (use creating-implementation-plan), implementation (use implementing-code).

Collection of framework-to-framework migration rules and transformation patterns (e.g., Struts→Spring MVC, JSP→Thymeleaf, EJB→Spring Boot). Triggers: "check migration guidelines", "look up transformation rules", "find Struts-to-Spring patterns", "apply migration conventions", "conversion rules for X→Y". Also consumed automatically by planning and implementation skills during migration workflows. NOT for: direct execution — other skills scan this directory.

Executes a batch of implementation tasks with TDD workflow, source-anchored rewrite for behavioral fidelity, guideline-based code transformation, and full requirement tracing. Returns a structured batch report. Triggers: "implement tasks", "execute the batch", "write code for these tasks", "implement with source anchoring", "run the implementation". NOT for: task generation (use breaking-down-tasks), implementation planning (use creating-implementation-plan).

Discovers valid migration plans in the workspace and returns the selected plan path. A valid plan is a subdirectory of .github/modernize/ that contains plan.md AND tasks.json (tasks.json may be in the plan folder or in a .metadata subfolder). Handles 0, 1, or multiple plans and returns structured NEEDS_INPUT when a choice is needed. Triggers: "list plans", "find plans", "select plan", "list-and-select-plan", "discover plans".

Run multi-layer integration tests for modernized Java applications. Supports 4 layers - Layer 1 (TestContainers), Layer 2 (Smoke Tests), Layer 3 (Azure Integration), Layer 4 (Behavioral Comparison). Java projects only - skip if source code is not Java. Triggers: "generate integration tests", "add integration tests", "create Layer 1 tests", "create Layer 2 tests" NOT for: unit tests, performance tests, load tests.

Single-source codebase decomposition: scans a project scope, builds the module dependency graph, counts LOC by language, computes skip patterns (caller-supplied ∪ .gitignore ∪ baseline), and (when grouping is required) produces topology groupings with L3 quality validation. One skill owns ProjectProfile JSON, grouping protocols, and quality gates. Triggers: "before generating a workflow plan", "before topology grouping", "project sizing", "LOC counting", "module grouping", "topology splitting rules", "topology consumer rules", "scale-aware splitting", "large codebase decomposition", "module dependency graph", "scope measurement". NOT for: semantic architecture analysis, implementation planning, running tests/builds/linters.

Zero-dependency shell recon for any code repository — detect languages, count LOC, and report project scale. Pure POSIX find/wc or PowerShell, no Python or third-party tools required. Triggers: "how big is this project", "what languages", "project sizing", "repo recon", "LOC count", "scope check".

Runs quality gate validation at each workflow stage. Supports 4 gate types: spec-quality, spec-to-plan, plan-to-tasks, completeness. Produces gate pass/fail reports with actionable feedback. Triggers: "run quality gate", "validate spec quality", "spec quality", "plan coverage", "check plan coverage", "validate plan to tasks", "check task traceability", "verify task completeness", "run completeness review", "review implementation", "check plan traceability", "check coverage", "completeness quality gate", "final sign-off", "feature parity sign-off", "completeness gate", "feature parity", "sign-off report", "verify all requirements". Requires type parameter to select the gate. NOT for: code review, implementation (use implementing-code), spec writing.

Runtime validation for migrated applications — covers testing strategy (planning phase) and test execution (validation phase): startup verification, integration testing, and end-to-end flow validation. Use when: (1) designing test strategy during planning phase (teamlead reads Part 1) (2) verifying a migrated app starts and runs correctly (3) writing or executing integration / E2E tests (tester reads Part 2) (4) choosing test tooling and environment setup (5) producing structured test evidence and verdicts Triggers: "runtime validation", "testing strategy", "test strategy", "test design", "verify the app", "integration test", "e2e test", "end-to-end test", "smoke test", "startup check", "write tests", "run tests", "test the migration", "playwright", "testcontainers", "test strategy", "test plan", "runtime gate", "testing phase", "validation phase"

Creates or updates the project constitution that defines migration principles, constraints, and conventions. Triggers: "set up constitution", "define migration principles", "create project rules", "establish conventions", "establish migration constitution". NOT for: implementation, implementation planning, task generation.

How to record project learnings so that later-phase workers and future agent runs can consume them.

Reference guide for creating a new Spring Boot project during rewrite migration.

Migration guideline for transforming Apache Struts 2 applications to Spring Boot 3.x and Spring MVC.

Provides role charters (mission, ownership, core principles, quality bar) for a multi-agent coding team. Each charter defines the role's mission, ownership scope, core principle (boundary constraints), and quality bar. Most roles also include communication rules. Consumed by the coordinator during task decomposition to assign work to the correct role. Triggers: "look up role charter", "what does the architect own", "check role boundaries", "find team roles", "which role handles X", "list agent charters", "role responsibilities". NOT for: task decomposition (use breaking-down-tasks), implementation (use implementing-code), architecture analysis (use analyzing-architecture).

How team members request infrastructure connection info and handle secrets in team mode

Generate and run post-migration tests from the frozen baseline specification.