plugins/github-copilot-modernization/skills/create-modernization-plan/SKILL.md
Create a modernization plan to migrate the project to Azure
npx skillsauth add microsoft/github-copilot-modernization create-modernization-planInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill is used to create a modernization plan to migrate the a given project to Azure
Read the supported patterns file based on the language:
supported-patterns-dotnet.mdsupported-patterns-java.md. Default option.These files contain the list of supported task patterns with and without skill definitions. If a skill is available, the skill location should be set to builtin.
Given the user input, do this:
Double Check the issues IMPORTANT:
Load context: Retrieve information for plan, you can read
Clarification and Questionnaire (only when the ask_user tool is available): If there are any open issues or ambiguities that need user input, use the following steps to answer any questions. Also ask the questions outlined in questionnaire.md via ask_user tool to scope the modernization plan. For questionnaire questions, if the user input already provides the answer, skip asking that question and use the provided information as the answer.
ask_user tool to ask the user each clarification question directly. Wait for the user's response before proceeding.ask_user tool is not available, skip this step entirely and proceed to plan generation using best-effort defaults.Generate plan and tasks: Generate plan.md and tasks.json using the appropriate templates:
Template Selection:
Plan Generation:
Clarification Outcomes in Plan: Incorporate all clarification answers from steps 3–4 into plan.md and tasks.json:
requirements or description in tasks.json based on the answer. Do NOT create a separate task for an implementation detail—only add a new task when the answer introduces entirely new migration scope.plan.md:
- [x] Q: ... → A: ...- [ ] ...IMPORTANT: The plan.md should NOT contain the detailed task breakdown. Those details go into tasks.json for better tracking and programmatic access.
Task Breakdown Rules: When creating tasks for tasks.json and plan.md:
assessment-report is provided, the task description must identify which specific issues from the assessment report are addressed by that task (e.g., "Addresses issues: <issue-title-1>, <issue-title-2>")skill tool description..github/skills/ versus other skills, MUST use the one defined in project.Java Upgrade Task Guidelines: Only add an upgrade task if the user explicitly requests it. You must refer to the ./java-upgrade-guideline.md for specific rules and guidelines when creating Java upgrade tasks.
.NET Upgrade Task Guidelines: You must refer to the ./dotnet-upgrade-guideline.md for specific rules and guidelines when creating .NET upgrade tasks.
Deployment Task Rules:
containerization if deployment task already exists, deployment task will cover the containerization work if needed.Security Task Guidelines: The security task order should be after all the upgrade and transform tasks and before the deployment tasks in the generated plan. If the user provides specific security requirements, incorporate them into the security task; otherwise, use the default requirements from the template.
IMPORTANT: The upgrade task must be the first task in the task list because subsequent transform tasks (e.g., migrating to Azure services) depend on the upgraded runtime and project format.
Rulebook Compliance Validation (only when rulebook attachments are present):
After generating the plan and tasks, call skill validate-rulebook-compliance to validate that the plan tasks cover the rulebook rules:
${modernization-work-folder}/.metadata/tasks.json${modernization-work-folder}/rulebook-compliance.md${modernization-work-folder}/plan.md and ${modernization-work-folder}/.metadata/tasks.json.${modernization-work-folder}/rulebook-compliance.md explaining that validation was skipped or failed and why, if known.Summary & Confirmation (only when the ask_user tool is available):
ask_user that includes:
ask_user tool is not available, skip this step entirely.ask_user, answers incorporated into plan.md and tasks.json, and outcomes recorded in the "## Open Questions & Questionnaire" section of plan.md${modernization-work-folder}development
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram