@schalkneethling/calavera-skill-code-review 0.2.0-next.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Schalk Neethling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/calavera-artifact.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://calavera.schalkneethling.com/schemas/calavera-artifact.schema.json",
+  "schemaVersion": 1,
+  "id": "skill-code-review",
+  "type": "skill",
+  "displayName": "Code review",
+  "payload": "payload/code-review",
+  "compatibility": {
+    "calavera": ">=2.2.0 <3"
+  }
+}

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@schalkneethling/calavera-skill-code-review",
+  "version": "0.2.0-next.1",
+  "description": "Code review artifact for Calavera.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/schalkneethling/create-project-calavera.git",
+    "directory": "packages/artifacts/skill-code-review"
+  },
+  "files": [
+    "calavera-artifact.json",
+    "payload"
+  ],
+  "type": "module",
+  "exports": {
+    ".": "./calavera-artifact.json",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/payload/code-review/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: code-review
+description: Review code changes for correctness, security, performance, accessibility, maintainability, tests, dependencies, design-system adherence, and localization. Use when the user asks for a code review, PR review, review of local changes, risk assessment, code quality feedback, or actionable findings before merge.
+disable-model-invocation: true
+---
+
+# Code Review
+
+Review code to catch issues the original engineer may have missed and to improve the codebase without creating unnecessary friction. Prioritize real risks over style noise.
+
+## Review Workflow
+
+1. Determine the review scope:
+   - Inspect `git status`, the relevant diff, and any user-specified files or PR context.
+   - Preserve unrelated user changes. Do not modify code unless the user asks for fixes.
+   - Identify whether the change is frontend, backend, library, CLI, infrastructure, docs, or mixed.
+2. Check project context before judging:
+   - Frameworks and languages.
+   - Test tooling and CI coverage.
+   - Linting, formatting, type checking, and build scripts.
+   - Dependency management and lockfiles.
+   - Accessibility, localization, and design-system tooling when UI code is involved.
+3. Review the change for material issues:
+   - Correctness: broken behavior, edge cases, data loss, error handling, and regressions.
+   - Security: injection risks, unsafe auth, secret handling, dependency risk, and permission scope.
+   - Performance and resources: unnecessary CPU, memory, network use, leaks, race conditions, deadlocks, async coordination, and missing back-pressure or throttling.
+   - Accessibility: semantic HTML, labels, keyboard support, focus management, ARIA misuse, and contrast.
+   - Maintainability: naming, structure, type safety, readability, duplication, and fit with local patterns.
+   - Tests and docs: missing coverage for new behavior, insufficient regression tests, and stale public docs.
+   - Dependencies: added packages, bundle/runtime impact, maintenance state, security posture, and whether built-in or existing project utilities would be enough.
+   - Design systems and branding: token usage, component reuse, theme consistency, and justified deviations.
+   - Localization: hard-coded UI strings, date/number formatting, translation keys, and future translation workflow.
+4. Produce review feedback:
+   - Lead with findings, ordered by severity.
+   - Include file and line references for repo-local issues.
+   - Explain impact and give a concrete fix.
+   - Group repeated instances when one root cause explains them.
+   - Mark non-blocking refactors as follow-up suggestions, not merge blockers.
+   - If no issues are found, say so clearly and mention any residual test or tooling gaps.
+
+## Context Skills
+
+Load related skills only when the diff makes that domain relevant:
+
+- Load `frontend-engineering` when reviewing markup-producing or style-producing code: HTML templates, JSX/TSX, Astro/Vue/Svelte components, Lit templates, Twig/ERB/Handlebars/Nunjucks, MDX, CSS, Sass/Less, CSS modules, scoped component styles, CSS-in-JS, or code that materially changes rendered HTML structure, selectors, layout, cascade, responsive behavior, colors, motion, or focus states.
+
+For large or high-risk diffs, consider a focused specialist subagent for the relevant skill. Pass only the user request, relevant diff, surrounding component context, and known project conventions. Reconcile specialist feedback into one prioritized final review rather than forwarding it verbatim.
+
+## Setup Deficiencies
+
+If essential review infrastructure is missing, call it out early before deep findings:
+
+- No runnable tests or tests absent from CI.
+- No linting, formatting, type checking, or build validation for the changed area.
+- Missing lockfile or unpinned dependencies.
+- No dependency or supply-chain scanning for publishable/server code.
+- No accessibility checks for UI-heavy changes.
+- No i18n framework or translation process for localized UI.
+- Missing design-system tokens/components when the project clearly depends on them.
+
+When a setup deficiency would make the review noisy or unreliable, report the deficiency as the primary finding and then provide only the highest-confidence code findings.
+
+## Feedback Standards
+
+- Be direct, specific, and respectful. Focus on code and impact, never the author.
+- Avoid nitpicks that an existing formatter or linter should handle.
+- Prefer established local helpers, components, patterns, and style systems over new abstractions.
+- Flag redundant implementations when the project already has an equivalent helper, component, CSS pattern, or service.
+- Challenge clever but opaque code. Prefer readable control flow and well-named helpers.
+- Encourage comments only for non-obvious decisions, tradeoffs, constraints, or nuanced behavior. Discourage comments that restate the code.
+- Include positive feedback after findings when something is genuinely strong, such as clean tests, simple abstractions, or thoughtful design.
+
+## Severity Guide
+
+- `P0`: Must fix immediately. Security exploit, data loss, severe outage, or merge-blocking broken core behavior.
+- `P1`: Should fix before merge. Likely bug, serious regression, accessibility blocker, unsafe dependency/auth pattern, or missing critical test.
+- `P2`: Important but may be follow-up. Maintainability issue, incomplete edge coverage, performance concern, duplicate implementation, or design-system drift.
+- `P3`: Optional improvement. Clarity, small refactor, documentation polish, or non-blocking suggestion.
+
+## Output Shape
+
+Use this order for review responses:
+
+1. Findings, ordered by severity, with `file:line`.
+2. Open questions or assumptions.
+3. Brief positive notes, if useful.
+4. Validation performed or not performed.
+
+Keep summaries short. The findings are the review.

package/payload/code-review/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review code changes for risk and quality."
+  default_prompt: "Use $code-review to review my current changes and prioritize actionable findings."
+policy:
+  allow_implicit_invocation: false