plugins/github-copilot-modernization/skills/dag-generation/SKILL.md
Generate task DAGs for modernization projects — select fragments from task catalog, produce initial DAG (Stage 1), and execute/validate DAG from plan artifacts (Stage 2).
npx skillsauth add microsoft/github-copilot-modernization dag-generationInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Two-stage DAG generation for modernization projects:
references/task-catalog.md — fragment library with when/skip-when/after/scopereferences/dag-rules.md — DAG construction rules (dependencies, compression, sizing)Select fragments from the task catalog and produce a DAG.
{{BASE_PATH}}/artifacts/project-profile.yaml (project.loc, project.languages, project.modules, assessment.change_type, assessment.grouping_needed)If user_ask names an explicit target stack or version, preserve it verbatim in every selected task. Do not replace, downgrade, or reinterpret the requested version based on model familiarity or LTS defaults.
Decide whether the project needs deep planning (two-stage DAG) or can produce a complete DAG upfront.
deep_planning: true when:
deep_planning: false when:
Read references/task-catalog.md. For each fragment, decide include/exclude based on:
deep_planning decision from Step 1 (drives implementation-plan selection)Always include target-env-prep when the target runtime/framework/language/tooling differs from source or when the user specifies an explicit target version. This is an environment preparation task: it must install/provision/activate the requested target when possible, produce a preparation artifact, and run before scaffold/implementation/build/test tasks. It normally has no dependency on architecture/source analysis and should run in parallel with those tasks. This is true even for small projects and even when deep_planning: false.
Respect when / skip-when conditions and after ordering from the catalog.
⛔ Skip-when enforcement (mandatory post-selection gate):
After initial selection, sweep every selected fragment and check its skip-when against the current context (deep_planning value, change_type, project scale, other selected fragments). Any fragment whose skip-when condition is satisfied MUST be removed — no exceptions. Specifically:
implementation-plan: remove if deep_planning: falseThis gate catches cases where the initial selection included fragments that looked relevant but conflict with the deep_planning decision or project scale.
✅ Explicit-request override (runs AFTER skip-when enforcement — highest precedence):
If user_ask explicitly requests a completeness, consistency, or feature-parity check (e.g. "run a completeness check", "verify nothing was missed", "enforce consistency", "feature parity sign-off"), force-include the completeness/conformance validation fragment (conformance-review, and feature-parity-signoff when applicable) even if its skip-when condition matched and removed it above. User intent overrides the size/type heuristic. This override is one-directional — it can only ADD a gate the heuristics dropped, never remove one they selected. It must run after the skip-when sweep, otherwise the sweep would strip the fragment back out (e.g. skip-when: same-stack upgrade).
Fragment selection is an internal decision — do NOT output the selection rationale to the user. The DAG itself is the user-facing result.
Read references/dag-rules.md for construction rules.
deep_planning: true → produce only plan-phase tasks as JSONdeep_planning: false → produce the complete DAG (plan + execute + validate) as JSONReturn JSON to the coordinator (do NOT write files):
{
"deep_planning": true,
"tasks": [
{"id": "t1", "role": "<role>", "title": "<title>", "depends_on": [], "phase_label": "<label>"},
{"id": "t2", "role": "<role>", "title": "<title>", "depends_on": ["t1"], "phase_label": "<label>"}
]
}
When plan phase completes and deep_planning: true, generate the execute+validate DAG from plan artifacts.
references/dag-rules.md for construction rulesreferences/task-catalog.md for fragment definitions{"tasks": [{"id": "t<N>", "role": "<role>", "title": "<title>", "depends_on": ["<id>", ...], "phase_label": "<label>"}]}
project-decomposition)development
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram