GitHub Copilot modernization agent
Install
npx skills add microsoft/github-copilot-modernizationgh skill install microsoft/github-copilot-modernizationgit clone --depth 1 https://github.com/microsoft/github-copilot-modernizationSkills in this collection
- Analyzing ArchitectureMicrosoftOfficialArchitect analysis for rewrite/migration: produces structured architecture artifacts plus global prose research views (project-structure, tech-stack, data-model) for planning, implementation, feature-inventory, and gates. This is the single architect task.
- API Service ContractsMicrosoftOfficialGenerate API and service communication contracts with sequence diagram
- Appmod HooksMicrosoftOfficialLifecycle hooks for the modernize-rearchitecture coordinator. Defines hook points, registered actions, and execution rules.
- Architecture DiagramMicrosoftOfficialGenerate architecture diagram with component relationship details from project analysis
- AssessmentMicrosoftOfficialRun a fully local application assessment for one Java, .NET, or JavaScript/TypeScript repository
- Assessment Report ConverterMicrosoftOfficialConvert an arbitrary CSV report (e.g. a Black Duck export or a custom migration-issue inventory) into a schema-valid assessment `report.json` the modernization pipeline can consume — so it appears in the assessment UI and migration solutions resolve automatically. This skill is LLM-driven: you read and interpret the CSV yourself and author `report.json` by hand against the schema.
- Batch ModernizationMicrosoftOfficialDeterministic local control-plane utilities for parsing, preflighting, validating, and tracking multi-repository modernization batches.
- Building Java Knowledge GraphMicrosoftOfficialAnalyzes JVM projects (Java/Kotlin/Scala/Groovy) and generates knowledge graphs with tree-sitter parsing. Requires Python 3 on the host and a JVM project with Maven/Gradle/Ant/Ivy build files. Skips gracefully if either prerequisite is missing. Triggers when asked to "build knowledge graph", "analyze project structure", "parse Java codebase", or "generate dependency graph".
- Business WorkflowsMicrosoftOfficialGenerate core business workflow documentation with sequence diagram
- Clarifying ScenariosMicrosoftOfficialEvaluates whether a user's modernization/rewrite request provides enough scenario context to proceed (e.g., target component library, screenshots, design system for frontend; API contract policy, data migration strategy for backend).
- Configuration InventoryMicrosoftOfficialGenerate comprehensive configuration and externalized settings inventory
- Create Modernization PlanMicrosoftOfficialCreate a modernization plan to migrate the project to Azure
- Create Test BaselineMicrosoftOfficialCreate a test baseline for the project to be modernized. The baseline will be used for later verification of modernization tasks.
- Creating Implementation PlanMicrosoftOfficialCreates an implementation plan AND task breakdown from a feature spec by consuming design artifacts. Produces plan.md with implementation steps, inline task list with full REQ traceability, and a Requirement Mapping table. This is the single skill for planning + decomposition.
- Cve Known VulnerabilitiesMicrosoftOfficialDetect known CVEs in Maven, NuGet, or npm dependencies using the GitHub Security Advisories API
- Cve RemediationMicrosoftOfficialScan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest.
- Cwe Code QualityMicrosoftOfficialAssess codebase for CWE code quality vulnerabilities (CWE-130, CWE-456, CWE-457, CWE-477, CWE-570, CWE-571, CWE-606, CWE-665, CWE-681, CWE-682, CWE-772, CWE-775, CWE-783, CWE-789, CWE-835, CWE-1057)
- Cwe Concurrency SynchronizationMicrosoftOfficialAssess codebase for CWE concurrency & synchronization vulnerabilities (CWE-543, CWE-567, CWE-662, CWE-667, CWE-820, CWE-821)
- Cwe Credentials SecretsMicrosoftOfficialAssess codebase for CWE credentials & secrets vulnerabilities (CWE-259, CWE-321, CWE-732, CWE-778, CWE-798)
- Cwe File Path SecurityMicrosoftOfficialAssess codebase for CWE file & path security vulnerabilities (CWE-22, CWE-23, CWE-36, CWE-434, CWE-611)
- Cwe Injection AttacksMicrosoftOfficialAssess codebase for CWE injection attacks vulnerabilities (CWE-77, CWE-78, CWE-79, CWE-88, CWE-89, CWE-90, CWE-91, CWE-99, CWE-502, CWE-564, CWE-643, CWE-652)
- Cwe Memory SafetyMicrosoftOfficialAssess codebase for CWE memory safety vulnerabilities (CWE-119, CWE-120, CWE-123, CWE-125, CWE-415, CWE-416, CWE-672, CWE-786, CWE-787, CWE-788, CWE-805, CWE-822, CWE-823, CWE-824, CWE-825)
- Dag GenerationMicrosoftOfficialGenerate task DAGs for modernization projects — select fragments from task catalog, produce initial DAG (Stage 1), and execute/validate DAG from plan artifacts (Stage 2).
- Data ArchitectureMicrosoftOfficialGenerate data architecture and persistence layer documentation with data model diagram
- Dependency MapMicrosoftOfficialGenerate dependency map diagram from project build files
- Feature InventoryMicrosoftOfficialCatalogs existing features from a codebase (API endpoints, user flows, UI screens, observable behaviors) and generates structured feature specs with REQ-XXX IDs, user scenarios, and success criteria. Triggers: "inventory features", "catalog existing functionality", "list what the app does", "extract requirements from code", "generate feature specs from research", "write a spec", "create feature…
- GuidelinesMicrosoftOfficialCollection of framework-to-framework migration rules and transformation patterns (e.g., Struts→Spring MVC, JSP→Thymeleaf, EJB→Spring Boot). Triggers: "check migration guidelines", "look up transformation rules", "find Struts-to-Spring patterns", "apply migration conventions", "conversion rules for X→Y". Also consumed automatically by planning and implementation skills during migration workflows.
- Implementing CodeMicrosoftOfficialExecutes a batch of implementation tasks with TDD workflow, source-anchored rewrite for behavioral fidelity, guideline-based code transformation, and full requirement tracing. Returns a structured batch report. Triggers: "implement tasks", "execute the batch", "write code for these tasks", "implement with source anchoring", "run the implementation".
- List PlansMicrosoftOfficialDiscovers valid migration plans in the workspace and returns the selected plan path. A valid plan is a subdirectory of .github/modernize/ that contains plan.md AND tasks.json (tasks.json may be in the plan folder or in a .metadata subfolder). Handles 0, 1, or multiple plans and returns structured NEEDS_INPUT when a choice is needed.
- Modernization Integration TestsMicrosoftOfficialRun multi-layer integration tests for modernized Java applications. Supports 4 layers - Layer 1 (TestContainers), Layer 2 (Smoke Tests), Layer 3 (Azure Integration), Layer 4 (Behavioral Comparison). Java projects only - skip if source code is not Java.
- Project DecompositionMicrosoftOfficialSingle-source codebase decomposition: scans a project scope, builds the module dependency graph, counts LOC by language, computes skip patterns (caller-supplied ∪ .gitignore ∪ baseline), and (when grouping is required) produces topology groupings with L3 quality validation. One skill owns ProjectProfile JSON, grouping protocols, and quality gates.
- Project ReconMicrosoftOfficialZero-dependency shell recon for any code repository — detect languages, count LOC, and report project scale. Pure POSIX find/wc or PowerShell, no Python or third-party tools required. Triggers: "how big is this project", "what languages", "project sizing", "repo recon", "LOC count", "scope check".
- Quality GatesMicrosoftOfficialRuns quality gate validation at each workflow stage. Supports 4 gate types: spec-quality, spec-to-plan, plan-to-tasks, completeness. Produces gate pass/fail reports with actionable feedback. Triggers: "run quality gate", "validate spec quality", "spec quality", "plan coverage", "check plan coverage", "validate plan to tasks", "check task traceability", "verify task completeness", "run…
- Runtime ValidationMicrosoftOfficialRuntime validation for migrated applications — covers testing strategy (planning phase) and test execution (validation phase): startup verification, integration testing, and end-to-end flow validation. Use when: (1) designing test strategy during planning phase (teamlead reads Part 1) (2) verifying a migrated app starts and runs correctly (3) writing or executing integration / E2E tests (tester…
- Setting Up ConstitutionMicrosoftOfficialCreates or updates the project constitution that defines migration principles, constraints, and conventions. Triggers: "set up constitution", "define migration principles", "create project rules", "establish conventions", "establish migration constitution". NOT for: implementation, implementation planning, task generation.
- Sharing LearningsMicrosoftOfficialHow to record project learnings so that later-phase workers and future agent runs can consume them.
- Spring Boot ScaffoldingMicrosoftOfficialReference guide for creating a new Spring Boot project during rewrite migration.
- Struts To SpringMicrosoftOfficialMigration guideline for transforming Apache Struts 2 applications to Spring Boot 3.x and Spring MVC.
- Team ChartersMicrosoftOfficialProvides role charters (mission, ownership, core principles, quality bar) for a multi-agent coding team. Each charter defines the role's mission, ownership scope, core principle (boundary constraints), and quality bar. Most roles also include communication rules. Consumed by the coordinator during task decomposition to assign work to the correct role.
- Team RequestMicrosoftOfficialHow team members request infrastructure connection info and handle secrets in team mode
- Verify Test BaselineMicrosoftOfficialGenerate and run post-migration tests from the frozen baseline specification.