plugins/github-copilot-modernization/skills/appmod-hooks/SKILL.md
Lifecycle hooks for the modernize-rearchitecture coordinator. Defines hook points, registered actions, and execution rules.
npx skillsauth add microsoft/github-copilot-modernization appmod-hooksInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Lifecycle hooks that fire at defined points during coordinator execution. Each hook point triggers registered actions in order.
| Point | When | Coordinator context |
|---|---|---|
| before_all | After DAG is generated, before first task dispatch | Full DAG available, no tasks started |
| before_task | Before dispatching each worker | Task ID and role known, profile read for Progress |
| after_task | After worker returns and verify passes | Task artifact available, status decided. If all tasks in the current phase are now ✅, also execute phase-completion actions (git commit, commit-pin, phase counter increment) |
| after_all | After completion criteria met (§3.7) | All tasks resolved |
See references/actions.yml for the action registry. Actions use dotted namespace: appmod.<domain>.<verb>.
optional: false actions MUST execute; optional: true actions execute only if their condition is metdevelopment
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram