feat(sdlc-pipeline): Azure DevOps mode, Figma design-to-code, brainstorming skill, work item reporting - #13
Conversation
- New adapter: scripts/targets/azure-devops-cli.js - Registered in scripts/targets/index.js - Provides az CLI work-item, iteration, PR, pipeline management for Azure DevOps mode
- 8 files: SKILL.md, spec-document-reviewer-prompt.md, visual-companion.md - Scripts: frame-template.html, helper.js, server.cjs, start/stop-server.sh - Installed by default during onboarding (Step 0.0) - PM Agent uses it first for interactive spec/requirement brainstorming
…gistry - New agent: figma-design-agent.md (sole consumer of figma MCP tools) - SKILL.md: updated agent list and permissions - mcp-settings.json: Figma MCP server config with --figma-api-key - env-template.env: FIGMA_API_KEY placeholder - skill-registry.json: registered figma MCP and azure-devops-cli
…diagram Topics in this commit: - service-onboarding.md: copy 8 agents + shared/developer-agent-base.md, brainstorming install, azure-pipelines.yml deferred to Step 6 - multi-tool-selection-plan.md: split ci-cd.yml (onboarding) vs azure-pipelines.yml (DevOps agent Step 6) - config-reference.md: updated azure-pipelines.yml description - sdlc-e2e-diagram.md (new): full pipeline flow diagram - azure-pipelines.yml (new): template for DevOps agent - sprint-scripts/README.md: minor update
…im, code push, report-to-comment, work item hierarchy, Figma permissions Topics in this commit (files span multiple topics): - Azure DevOps state mapping: 'Resolved' is Bug-only; Tasks use New->Active->Closed (Agile) / To Do->Doing->Done (Basic). Fixed wrong 'In Review' state for Azure DevOps Task in devops-agent.md. branch-strategy.md, developer-agent-base.md, devops-agent.md, pipeline.md - Azure DevOps CLI command fixes: iteration project create requires --name, team set-default-iteration uses --path not --iteration, added update fallback. pipeline.md - Verbose text trimming: replaced 'Use azure-devops-cli skill...' with direct az commands, trimmed long explanatory notes. branch-strategy.md, developer-agent-base.md, devops-agent.md, pipeline.md, tester-agent.md, code-reviewer-agent.md - Code push to Azure Repos: explicit git push after initial code (3.3), before PR (3.7), and after error throwback fix. developer-agent-base.md, pipeline.md - Work item report-to-comment: post full report content (implementation, tests, review, CI/CD) to work item comments, not just short routing messages. developer-agent-base.md, backend-agent.md, frontend-agent.md, code-reviewer-agent.md, tester-agent.md, devops-agent.md, pipeline.md, branch-strategy.md - Epic->Issue->Task work item hierarchy: PM Agent creates linked tree, routing labels on Task level only, only Tasks added to sprint. pm-agent.md, pipeline.md - Figma agent permissions: figma:true only for figma-design-agent, figma:false for all others. pm-agent.md, architect-agent.md
📝 WalkthroughWalkthroughThe change adds Figma design processing, Azure DevOps support, Azure deployment options, a brainstorming browser companion, and an Azure DevOps CLI installer target across the SDLC skill set. ChangesSDLC pipeline integrations
Brainstorming companion
Azure DevOps CLI installer
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant ServiceOnboarding
participant FigmaDesignAgent
participant PMAgent
participant AzureBoards
participant DeveloperAgent
participant AzurePipelines
User->>ServiceOnboarding: Select Figma and Azure DevOps
ServiceOnboarding->>FigmaDesignAgent: Configure exclusive Figma MCP access
FigmaDesignAgent->>PMAgent: Provide extracted design and SDD handoff
PMAgent->>AzureBoards: Create Epic, Issue, and leaf Tasks
AzureBoards->>DeveloperAgent: Assign a leaf Task
DeveloperAgent->>AzurePipelines: Trigger or update CI/CD
AzurePipelines-->>AzureBoards: Post build, quality, and artifact status
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 SkillSpector (2.5.1)skills/sdlc-agentic-pipeline/SKILL.mdSkillSpector batch scan did not return output for this target skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.mdSkillSpector batch scan did not return output for this target Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Note
Due to the large number of review comments, Critical severity comments were prioritized as inline comments.
🟠 Major comments (29)
skills/skill-installer/scripts/targets/azure-devops-cli.js-169-174 (1)
169-174: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDelete only manifest-tracked files.
The fallback calls
rmDir()for the complete skill directory. If users add files under that directory, this path deletes them. Read the manifest and remove only its tracked files, then prune empty directories.As per coding guidelines, “Installer deletion must remove only files tracked by the installer manifest and must not delete user-created files.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/skill-installer/scripts/targets/azure-devops-cli.js` around lines 169 - 174, Update the catch fallback around run in the skill removal flow to read the installer manifest and delete only its tracked files, rather than calling rmDir on the complete skill directory. After removing tracked files, prune only directories that are empty, preserving any user-created files and directories.Source: Coding guidelines
skills/skill-installer/scripts/targets/azure-devops-cli.js-65-74 (1)
65-74: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftRemove the runtime
npxdependency.These installer paths invoke
npx -y skills add ...andnpx -y skills remove ..., which resolves theskillspackage from npm at install or delete time. This violates the zero npm dependency rule and allows changed npm code to run. Use Node.js built-ins and controlled skill artifacts, or a fully resolved local copy of the installer commands.Also applies to: 162-170
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/skill-installer/scripts/targets/azure-devops-cli.js` around lines 65 - 74, Update the installer command construction around the visible `cmd` array and the corresponding remove path to eliminate runtime `npx` invocation. Use only Node.js built-ins with controlled skill artifacts, or invoke a fully resolved local copy of the installer commands, while preserving the existing project-scope `cwd`, skill name, source, and global flag behavior.Source: Coding guidelines
skills/sdlc-agentic-pipeline/skills/brainstorming/visual-companion.md-108-108 (1)
108-108: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winThe documented restart procedure breaks the liveness check.
start-server.shbuilds a new session directory on every invocation. Line 114 setsSESSION_ID="$$-$(date +%s)", and Line 117 setsSESSION_DIR="${PROJECT_DIR}/.superpowers/brainstorm/${SESSION_ID}". A restart with the same--project-dirtherefore creates a newSTATE_DIR.Two consequences follow:
- The previously saved
$STATE_DIRkeeps itsserver-stoppedmarker and never gets a newserver-info. The liveness check described here reports "stopped" forever after a restart.screen_diralso changes, so screens written to the oldscreen_dirare no longer served.Instruct the agent to re-read
screen_dirandstate_dirfrom the restart output, not to reuse the previous values.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/visual-companion.md` at line 108, Update the restart guidance around the server liveness check to state that start-server.sh creates a new session directory on each invocation. After restarting with the same --project-dir, re-read and use the returned screen_dir and state_dir values for subsequent checks and screen pushes instead of reusing the previous STATE_DIR or screen_dir.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.sh-1-1 (1)
1-1: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winNeither lifecycle script sets a bash error-handling mode. Both scripts run with default bash behavior, so a failed command does not stop execution and an unset variable expands to an empty string. Both scripts then continue on corrupt state and emit a misleading JSON status.
skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.sh#L1-L1: addset -uo pipefailafter the shebang, and check the result ofmkdir -pat Line 130 explicitly.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh#L1-L1: addset -uo pipefailafter the shebang, and verify thatSTATE_DIRexists beforemark_stoppedwrites into it.Do not use
set -ein either script. Both rely on non-zero exit codes fromkill -0,grep, andcommand_has_server_idfor control flow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.sh` at line 1, Update skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.sh at lines 1-1 by adding set -uo pipefail after the shebang and explicitly handling failure from mkdir -p near line 130; update skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh at lines 1-1 with the same mode and validate STATE_DIR exists before mark_stopped writes to it. Do not use set -e, preserving intentional non-zero control flow from kill -0, grep, and command_has_server_id.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs-628-633 (1)
628-633: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winThe session token persists in the project working tree with no protection and no lifetime bound.
start-server.shLine 119 pointsBRAINSTORM_TOKEN_FILEat<project>/.superpowers/brainstorm/.last-token. The server writes the raw token there, no code excludes the path from version control, and no code removes the token when the session ends. The token grants full HTTP and WebSocket access to the companion.
skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs#L628-L633: keep the0o600mode, and create<project>/.superpowers/.gitignorecontaining*before the token file is written, so the token cannot be committed.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh#L108-L109: remove the shared.last-tokenfile alongsideserver.pid,server-instance-id, andserver.log, so a stopped session does not leave a reusable token on disk.If token reuse across restarts is required for the same-port reconnect flow described in
visual-companion.mdLine 108, keep the file but bound its lifetime, for example by storing a creation timestamp and rejecting a stored token after a fixed age.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs` around lines 628 - 633, The token persistence flow must prevent committed secrets and remove tokens after shutdown. In skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs:628-633, preserve mode 0o600 and create <project>/.superpowers/.gitignore containing * before writing TOKEN_FILE; in skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh:108-109, remove the shared .last-token alongside server.pid, server-instance-id, and server.log. If restart reuse is required, instead retain the token with a fixed lifetime and reject expired tokens.Source: Coding guidelines
skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh-117-119 (1)
117-119: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winThe
not_runningbranch leaves a staleserver-infofile.If
PID_FILEis absent, the script reportsnot_runningand exits without callingmark_stopped. Aserver-infofile from a crashed server therefore remains inSTATE_DIR.The agent liveness check in
visual-companion.mdLine 108 requiresserver-infoto exist andserver-stoppedto be absent. After this branch runs, that check reports the server as running.Call
mark_stoppedin this branch as well.🔧 Proposed fix
else + mark_stopped "not_running" echo '{"status": "not_running"}' fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh` around lines 117 - 119, Update the not_running branch in stop-server.sh to call mark_stopped before emitting the not_running status, ensuring stale server-info state is cleared while preserving the existing output.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh-111-114 (1)
111-114: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
rm -rfruns on an unvalidated caller-supplied path.
SESSION_DIRcomes directly from$1. The/tmp/*glob matches on the literal string, not on the resolved path. A value such as/tmp/../home/user/projectmatches the pattern, and Line 113 recursively deletes the resolved target.Resolve the path first, then compare the resolved value.
🔒 Proposed fix
# Only delete ephemeral /tmp directories - if [[ "$SESSION_DIR" == /tmp/* ]]; then - rm -rf "$SESSION_DIR" - fi + resolved_dir="$(cd "$SESSION_DIR" 2>/dev/null && pwd -P || true)" + if [[ -n "$resolved_dir" && "$resolved_dir" == /tmp/brainstorm-* ]]; then + rm -rf "$resolved_dir" + fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.sh` around lines 111 - 114, Update the SESSION_DIR cleanup logic to resolve the caller-supplied path to its canonical filesystem path before validating it. Compare the resolved path against the /tmp directory boundary, and only invoke rm -rf when that resolved path is genuinely within /tmp; preserve the existing behavior for non-temporary paths.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/helper.js-129-141 (1)
129-141: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winOption selection has no keyboard path.
The click listener is the only selection mechanism. The documented option markup in
visual-companion.md(Lines 176-185) uses plaindivelements withonclick, withouttabindexorrole. A keyboard user cannot focus or activate an option, so the user cannot complete a selection without a pointer.Add a
keydownhandler for Enter and Space, and documenttabindex="0"plusrole="button"in the option markup pattern.♿ Proposed fix
// Capture clicks on choice elements document.addEventListener('click', (e) => { const target = e.target.closest('[data-choice]'); if (!target) return; sendEvent({ type: 'click', text: target.textContent.trim(), choice: target.dataset.choice, id: target.id || null }); }); + + // Keyboard equivalent for pointer activation of choice elements. + document.addEventListener('keydown', (e) => { + if (e.key !== 'Enter' && e.key !== ' ') return; + const target = e.target.closest && e.target.closest('[data-choice]'); + if (!target) return; + e.preventDefault(); + target.click(); + });Also update the option markup in
visual-companion.md:<div class="option" data-choice="a" role="button" tabindex="0" onclick="toggleSelect(this)">🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/helper.js` around lines 129 - 141, Add a keydown listener alongside the click listener in the option-tracking code, handling Enter and Space by invoking the same selection/event flow and preventing default behavior. Update the documented option markup in visual-companion.md to include role="button" and tabindex="0" so options are keyboard-focusable and activatable.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/helper.js-146-158 (1)
146-158: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMulti-select deselect is not distinguishable, and
selectedChoicegoes stale.Two problems occur in multi-select mode:
toggleSelectremoves theselectedclass on a second click, but the global click listener at Line 130 emits the same{type:'click', choice}payload for select and deselect. The agent reads$STATE_DIR/eventsand cannot tell which action occurred.- Line 157 assigns
window.selectedChoice = el.dataset.choiceeven when the click deselected the element.Emit the resulting state so the consumer can reconstruct the selection.
🔧 Proposed fix
window.toggleSelect = function(el) { const container = el.closest('.options') || el.closest('.cards'); const multi = container && container.dataset.multiselect !== undefined; if (container && !multi) { container.querySelectorAll('.option, .card').forEach(o => o.classList.remove('selected')); } if (multi) { el.classList.toggle('selected'); } else { el.classList.add('selected'); } - window.selectedChoice = el.dataset.choice; + const isSelected = el.classList.contains('selected'); + window.selectedChoice = isSelected ? el.dataset.choice : null; + sendEvent({ + type: 'selection', + choice: el.dataset.choice, + selected: isSelected, + multiselect: Boolean(multi) + }); };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/helper.js` around lines 146 - 158, Update toggleSelect to determine the element’s resulting selected state after applying the class change, and emit that state through the existing click event payload so consumers can distinguish selection from deselection. Only update window.selectedChoice when the element remains selected; clear or otherwise represent it as unset when deselected, while preserving single-select behavior.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs-585-599 (1)
585-599: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAdd signal handlers and bound the shutdown.
Two problems exist in the shutdown path.
shutdownruns only fromlifecycleCheck. The process installs noSIGTERMorSIGINThandler. Whenstop-server.shsendsSIGTERM, Node terminates immediately and the server never removesserver-infoor writesserver-stopped.stop-server.shcompensates throughmark_stopped, but any other terminating signal leaves a staleserver-info. The agent liveness check invisual-companion.mdLine 108 then reports the server as running.Line 598 calls
server.close(() => process.exit(0)).server.closewaits for idle keep-alive HTTP connections to end. If one remains open, the callback never runs and the process does not exit.🔧 Proposed fix
+ let shuttingDown = false; function shutdown(reason) { + if (shuttingDown) return; + shuttingDown = true; console.log(JSON.stringify({ type: 'server-stopped', reason })); const infoFile = path.join(STATE_DIR, 'server-info'); if (fs.existsSync(infoFile)) fs.unlinkSync(infoFile); fs.writeFileSync( path.join(STATE_DIR, 'server-stopped'), JSON.stringify({ reason, timestamp: Date.now() }) + '\n' ); watcher.close(); clearInterval(lifecycleCheck); for (const socket of clients) { try { socket.destroy(); } catch (e) { /* already gone */ } } + if (typeof server.closeAllConnections === 'function') server.closeAllConnections(); + const forceExit = setTimeout(() => process.exit(0), 2000); + forceExit.unref(); server.close(() => process.exit(0)); } + + process.on('SIGTERM', () => shutdown('SIGTERM')); + process.on('SIGINT', () => shutdown('SIGINT'));🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs` around lines 585 - 599, Update shutdown to be idempotent and bounded: register SIGTERM and SIGINT handlers that invoke shutdown, and ensure cleanup writes server-stopped and removes server-info before forcing process termination if server.close does not complete promptly. Preserve the existing lifecycleCheck-triggered shutdown while preventing repeated signal or check invocations from duplicating cleanup.skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs-516-523 (1)
516-523: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
cp.execbuilds a shell command from operator input.Line 518 concatenates
BRAINSTORM_OPEN_CMDwithJSON.stringify(url)and runs the result through a shell.urlis built bycompanionUrl()fromURL_HOST, whichstart-server.shsets from the--url-hostargument without validation. A--url-hostvalue that contains a double quote and shell metacharacters escapes the JSON quoting and executes arbitrary commands.
JSON.stringifyis not a shell-quoting function. ValidateURL_HOSTand avoid the shell.🔒 Proposed fix
const url = companionUrl(); const cp = require('child_process'); if (process.env.BRAINSTORM_OPEN_CMD) { - try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) { /* best effort */ } + const parts = process.env.BRAINSTORM_OPEN_CMD.split(/\s+/).filter(Boolean); + if (parts.length === 0) return; + try { cp.execFile(parts[0], parts.slice(1).concat([url]), () => {}); } catch (e) { /* best effort */ } return; }Also reject hosts that are not a valid hostname or IP literal:
-const URL_HOST = process.env.BRAINSTORM_URL_HOST || (HOST === '127.0.0.1' ? 'localhost' : HOST); +const RAW_URL_HOST = process.env.BRAINSTORM_URL_HOST || (HOST === '127.0.0.1' ? 'localhost' : HOST); +if (!/^[A-Za-z0-9._:[\]-]+$/.test(RAW_URL_HOST)) { + console.error('Invalid url host'); + process.exit(1); +} +const URL_HOST = RAW_URL_HOST;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjs` around lines 516 - 523, Harden the browser-opening path around BRAINSTORM_OPEN_CMD and companionUrl by validating URL_HOST as a valid hostname or IP literal before constructing the URL, and replace cp.exec with a non-shell invocation that passes the URL as a separate argument. Preserve the existing launcher behavior and best-effort error handling for valid hosts.skills/sdlc-agentic-pipeline/SKILL.md-14-16 (1)
14-16: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake repository and work-item terms platform-conditional.
Azure DevOps selection replaces GitHub Repos and Jira Boards. These instructions still require Jira comments and a GitHub repository. Azure-only runs can route work to unavailable services.
skills/sdlc-agentic-pipeline/SKILL.md#L14-L16: use platform-neutral work-item comments, with Jira and Azure DevOps Boards alternatives.skills/sdlc-agentic-pipeline/SKILL.md#L157-L157: require manual creation of the selected platform repository.skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md#L225-L230: hand off the selected-platform repository and branch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/SKILL.md` around lines 14 - 16, Make repository and work-item references platform-neutral across skills/sdlc-agentic-pipeline/SKILL.md lines 14-16 and 157, and skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md lines 225-230: replace Jira/GitHub-specific requirements with selected-platform terminology, explicitly support Jira or Azure DevOps work-item comments and the corresponding repository, and ensure the Figma design handoff names the selected platform repository and branch.skills/sdlc-agentic-pipeline/references/config-reference.md-68-84 (1)
68-84: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftDo not pass the Figma PAT through persisted command arguments.
The generated MCP configuration must substitute the placeholder with a real PAT. Command-line arguments can be exposed through process inspection, diagnostics, and process-launch logs. Use the host secret store or a protected runtime secret-injection mechanism instead.
skills/sdlc-agentic-pipeline/references/config-reference.md#L68-L84: document the protected secret-injection mechanism instead of a PAT-bearing CLI argument.skills/sdlc-agentic-pipeline/references/templates/env-template.env#L2-L5: align the credential-location guidance with that mechanism.skills/sdlc-agentic-pipeline/references/templates/mcp-settings.json#L69-L73: remove the PAT placeholder fromargs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/config-reference.md` around lines 68 - 84, Replace the Figma PAT-bearing CLI argument with a protected runtime secret-injection mechanism and document that mechanism in skills/sdlc-agentic-pipeline/references/config-reference.md lines 68-84. Align the credential-location guidance in skills/sdlc-agentic-pipeline/references/templates/env-template.env lines 2-5, and remove the PAT placeholder from args in skills/sdlc-agentic-pipeline/references/templates/mcp-settings.json lines 69-73 while preserving Figma MCP configuration behavior.skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md-193-199 (1)
193-199: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDefine a persistent Figma asset handoff.
The Figma agent downloads images but only defines persistence for
figma-extract.md. The frontend agent then requires asset paths and copies assets into the repository. This leaves no shared source directory for the downloaded files.
skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md#L193-L199: save downloaded assets in a defined SDD-local directory, such asspecs/<YYYY-MM-DD-...>/figma-assets/, and record relative paths infigma-extract.md.skills/sdlc-agentic-pipeline/references/agents/frontend-agent.md#L72-L72: copy assets from that defined handoff directory into the target framework’s existing asset convention.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md` around lines 193 - 199, Define a persistent asset handoff: in skills/sdlc-agentic-pipeline/references/agents/figma-design-agent.md lines 193-199, save downloaded Figma assets under the SDD-local package directory (for example, figma-assets/) and record their relative paths in figma-extract.md; in skills/sdlc-agentic-pipeline/references/agents/frontend-agent.md line 72, instruct the frontend agent to copy assets from that handoff directory into the target framework’s existing asset convention.skills/sdlc-agentic-pipeline/SKILL.md-188-192 (1)
188-192: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy liftRemove the cross-skill Azure DevOps runtime dependency.
The SDLC skill requires a separately installed
azure-devops-cliskill for normal pipeline operations. This breaks the required self-contained skill contract.
skills/sdlc-agentic-pipeline/SKILL.md#L188-L192: reference Azure DevOps capabilities bundled under this skill.skills/sdlc-agentic-pipeline/references/agents/backend-agent.md#L59-L59: replace the external skill requirement with local references.skills/sdlc-agentic-pipeline/references/agents/frontend-agent.md#L55-L55: replace the external skill requirement with local references.skills/sdlc-agentic-pipeline/references/config-reference.md#L86-L89: document local Azure DevOps command references.skills/sdlc-agentic-pipeline/references/skill-registry.json#L225-L250: register local SDLC-owned Azure DevOps resources instead of another skill.As per coding guidelines: “Each skill should keep its scripts, references, and assets self-contained under its own directory, without cross-skill runtime dependencies.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/SKILL.md` around lines 188 - 192, Remove the external azure-devops-cli runtime dependency and make Azure DevOps support self-contained under the SDLC skill. In skills/sdlc-agentic-pipeline/SKILL.md:188-192, describe bundled local Azure DevOps capabilities; update skills/sdlc-agentic-pipeline/references/agents/backend-agent.md:59-59 and references/agents/frontend-agent.md:55-55 to use those local references; document the local command references in references/config-reference.md:86-89; and replace the external skill registration with SDLC-owned Azure DevOps resources in references/skill-registry.json:225-250.Source: Coding guidelines
skills/sdlc-agentic-pipeline/references/skill-registry.json-239-245 (1)
239-245: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse the runtime credential variable name.
The registry requests
AZURE_DEVOPS_PAT, but the Azure DevOps CLI requiresAZURE_DEVOPS_EXT_PATat runtime. If users export the registry name, non-interactiveaz devopscommands will not authenticate. Rename the base Azure DevOps credential toAZURE_DEVOPS_EXT_PAT, or map it explicitly to that variable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/skill-registry.json` around lines 239 - 245, Update the Azure DevOps registry credential entry so its requested credential name matches the CLI runtime variable AZURE_DEVOPS_EXT_PAT. Ensure the credentialsNeeded metadata, credentialName, and prerequisite instructions consistently use that variable, or explicitly map AZURE_DEVOPS_PAT to it before non-interactive az devops commands run.skills/sdlc-agentic-pipeline/references/skill-registry.json-253-330 (1)
253-330: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAdd Azure control-plane authentication for deployment targets.
An Azure DevOps PAT authenticates Azure DevOps APIs, not
az webapp,az containerapp,az vm,az aks get-credentials, or AKSkubectloperations. Document the Azure control-plane identity contract for these targets and updateskill-registry.json,config-reference.md, andenv-template.envaccordingly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/skill-registry.json` around lines 253 - 330, Document Azure control-plane authentication separately from the Azure DevOps PAT for the azure-app-service, azure-container-apps, azure-aks, and azure-vm entries in skills/sdlc-agentic-pipeline/references/skill-registry.json (lines 253-330), including the identity/credential required by az, AKS kubeconfig retrieval, and kubectl. Update skills/sdlc-agentic-pipeline/references/config-reference.md (lines 97-102) and skills/sdlc-agentic-pipeline/references/templates/env-template.env (lines 38-56) to define the corresponding Azure subscription, tenant, client/service-principal or managed-identity authentication contract and required environment variables; do not describe AZURE_DEVOPS_PAT as authenticating Azure resource operations.skills/sdlc-agentic-pipeline/references/agents/devops-agent.md-48-61 (1)
48-61: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy liftRemove the undocumented cross-skill runtime dependency.
These instructions make
sdlc-agentic-pipelinedepend on the separately installedazure-devops-cliskill at runtime. Bundle the required references under this skill, or define a repository-approved dependency contract and block execution when that dependency is unavailable.As per coding guidelines, each skill must keep its scripts, references, and assets self-contained under its own directory without cross-skill runtime dependencies.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/devops-agent.md` around lines 48 - 61, Update the Azure DevOps mode documentation in the devops-agent instructions to remove the runtime dependency on the separately installed azure-devops-cli skill. Bundle the referenced CLI guidance files within this skill, or establish and enforce an approved dependency contract that blocks execution when unavailable; keep scripts, references, and assets self-contained under this skill.Source: Coding guidelines
skills/sdlc-agentic-pipeline/references/sdlc-e2e-diagram.md-1-5 (1)
1-5: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy liftRegenerate the diagram from the platform-conditional pipeline.
The diagram omits Step 0.F from the flow and still presents Jira-only review/sprint actions and JFrog-only CI behavior. It also omits Figma from the MCP table. Users can follow this visual reference and select the wrong workflow. Correct the diagram, including the malformed
# Test#heading.Also applies to: 21-68, 90-103, 147-156
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/sdlc-e2e-diagram.md` around lines 1 - 5, Regenerate the SDLC Agentic Pipeline diagram to match the platform-conditional flow in pipeline.md: fix the malformed “# Test#” heading, include Step 0.F, add Figma to the MCP table, and condition Jira-only review/sprint actions and JFrog-only CI behavior on their respective platforms. Update all affected diagram sections, including the referenced step ranges, so the visual workflow cannot imply unavailable platform integrations.skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md-430-446 (1)
430-446: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winEnforce Figma MCP ownership for onboarding verification.
The owner states that only
figma-design-agentmay call Figma MCP. Update both the probe and smoke test to run only throughfigma-design-agent, and remove the MCP inspector fallback.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md` around lines 430 - 446, Update the “0.11.4 Verify Figma MCP Connection” probe to require execution exclusively through figma-design-agent, removing the MCP inspector fallback and its related wording. Update “0.11.5 Smoke Test” to preserve the same figma-design-agent-only ownership and ensure no direct MCP invocation is described.skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md-147-152 (1)
147-152: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winGrant Azure DevOps access to the Azure DevOps-using agents.
Code ReviewerandTesteruseazure-devops-cliunderazure-devops, but this mapping only grants it to PM, Backend, Frontend, and DevOps. AddCode ReviewerandTesterto theazure-devops-cligrant soapply-tool-selectionspopulates their generated frontmatter.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md` around lines 147 - 152, Update the azure-devops-cli mapping for azure-devops in the tool-selection table to include Code Reviewer and Tester alongside the existing PM, Backend, Frontend, and DevOps agents, so apply-tool-selections grants both agents access in generated frontmatter.skills/sdlc-agentic-pipeline/references/agents/devops-agent.md-561-582 (1)
561-582: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winGenerate the post-success comment and report from the selected artifact backend.
The success message currently requires
JFrog verifiedeven whenAzure DevOpsselectedAzure Artifacts,ACR, orNone(lines 559-576, 7.9). Route the comment text and CI/CD report## Artifactsline by artifact backend: useJFrog,Azure Artifacts,ACR, orNo artifact publishing configured/no artifact section forNone; do not hard-codeJFrog / ACR.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/devops-agent.md` around lines 561 - 582, Update the success comment and CI/CD report generation described in the post-success reporting flow to select the Artifacts text from the configured artifact backend. Emit JFrog, Azure Artifacts, ACR, or “No artifact publishing configured” (or omit the artifact section) for None, and remove the hard-coded “JFrog / ACR” requirement while preserving the existing report structure.skills/sdlc-agentic-pipeline/references/agents/devops-agent.md-583-583 (1)
583-583: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAlign the release-step numbering.
This line refers to PM release review as Step 8, while the pipeline defines release review as Step 7 and deployment as Step 8. Use one numbering scheme across the agent instructions and cross-references.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/devops-agent.md` at line 583, Update the release-review transition instruction near the PM handoff to use Step 7 instead of Step 8, matching the pipeline’s numbering; keep deployment references as Step 8 and align any nearby cross-references to the same scheme.skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md-71-79 (1)
71-79: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftMake artifact-backend choices drive all artifact operations.
service-onboarding.mdrecords Azure Artifacts, ACR, JFrog, orNonefor Azure DevOps, but the remaining references either test onlyjfrogor treatjfrog === falseas “use Azure Artifacts/ACR”. Add an explicitartifactBackendselection and consume it at each referenced location so Step 6 idempotency, stage generation, variable creation, image source construction, and deployment prerequisites match the selected backend or skip artifact operations whenNoneis selected.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md` around lines 71 - 79, Make artifactBackend the single source of truth for artifact operations: update artifactBackend selection in service-onboarding.md (lines 262-269), then consume it in multi-tool-selection-plan.md (lines 71-79), pipeline.md (lines 70-78, 229-234, and 264-266), and devops-agent.md (lines 310-323, 561-582, 643-646, and 928-930). Ensure Step 6 idempotency, stage generation, variable creation, image-source construction, and deployment prerequisites select Azure Artifacts, ACR, JFrog, or skip artifact operations for None, rather than inferring behavior from jfrog alone; all listed sites require updates to use the explicit selection.skills/sdlc-agentic-pipeline/references/agents/devops-agent.md-721-786 (1)
721-786: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftConfigure private ACR access for every Azure deployment target.
Azure App Service, Container Apps, and AKS cannot pull a private ACR image from the
az webapp config container set,az containerapp update, andkubectl set imagesteps alone. Add target-specific ACR authentication before or with deployment:
- App Service: managed identity with
acrUseManagedIdentityCredsand ACRAcrPull, or registry credentials.- Container Apps: registry credentials or managed identity before
az containerapp update.- AKS:
az aks update --attach-acror deploy an image-pull secret withkubectl.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/devops-agent.md` around lines 721 - 786, Update the Azure deployment sections for App Service, Container Apps, and AKS to configure authentication for private ACR images before or alongside deployment. In the App Service flow, enable managed-identity ACR pulls with AcrPull permission or configure registry credentials; in Container Apps, configure registry credentials or managed identity; in the AKS flow, attach the registry with az aks update --attach-acr or configure an image-pull secret before kubectl set image. Preserve the existing deploy, verify, and rollback steps.skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md-160-170 (1)
160-170: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftUse Azure DevOps as an independent platform contract.
Update the remaining Azure routing conditions.
multi-tool-selection-plan.md: update Steps 1b, 4, 6, 7, and 9 to route review, cross-reference, CI/CD, merge, and sprint-close/report throughazure-devopsinstead of treating missinggithubas missing integration.pipeline.md: replace the unconditionalgithub_run_secret_scanning,create PR via GitHub MCP,GitHub PR link, and Jira sprint-close commands in the Azure sections withazure-devops-cliwork-item comments/PR operations.code-reviewer-agent.md: make the PR creation and PR review sections platform-aware: local review uses selected platform repo, PR review usesazure-devops-clireview, and secret scanning uses the selected-platform scan instead of hardcoded GitHub MCP calls.branch-strategy.md: add Azure Repos feature PR and release merge paths to satisfy Azure DevOps flows.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md` around lines 160 - 170, Update skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md:160-170 so Steps 1b, 4, 6, 7, and 9 route review, cross-reference, CI/CD, merge, and sprint-close/report through selected platform integrations, including azure-devops, rather than requiring github. Update skills/sdlc-agentic-pipeline/references/pipeline.md:122-129, 236-239, and 278-290 to replace hardcoded GitHub secret scanning, PR creation/linking, and Jira sprint-close operations in Azure flows with azure-devops-cli scanning, work-item comments, and PR operations. Update skills/sdlc-agentic-pipeline/references/agents/code-reviewer-agent.md:48-70 and skills/sdlc-agentic-pipeline/references/agents/shared/developer-agent-base.md:464-466 so PR creation/review and secret scanning are platform-aware, using the selected repository platform and azure-devops-cli for Azure Repos. Add Azure Repos feature-PR and release-merge paths in skills/sdlc-agentic-pipeline/references/branch-strategy.md:92-94, and update Azure DevOps CI/CD and sprint-close/report routing in skills/sdlc-agentic-pipeline/references/agents/devops-agent.md:507-529.skills/sdlc-agentic-pipeline/references/agents/pm-agent.md-112-112 (1)
112-112: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove credential exposure from login commands.
Shell commands that expand credentials into
-p/--passwordarguments can expose secrets in shell history.
skills/sdlc-agentic-pipeline/references/agents/pm-agent.md#L112: don’t pass$AZURE_DEVOPS_EXT_PATtoaz devops login --token; runaz devops configure --listafter relying on the environment variable.skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md#L129-L131and#L342-L346: feed JFrog and ACR passwords throughdocker login --password-stdinand unset any temporary password variable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/pm-agent.md` at line 112, Remove credential exposure from the Azure DevOps login instructions in skills/sdlc-agentic-pipeline/references/agents/pm-agent.md:112 by relying on the environment-provided token without passing $AZURE_DEVOPS_EXT_PAT as a command argument, then retain the az devops configure --list verification. In skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md:129-131 and :342-346, pipe the JFrog and ACR passwords to docker login through --password-stdin and unset each temporary password variable afterward.skills/sdlc-agentic-pipeline/references/branch-strategy.md-146-146 (1)
146-146: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winPreserve existing Azure DevOps tags.
System.Tags=agent:frontendoverwrites the work item tags. If existing tags can contain routing or release markers, read the current value and merge it with the new tag before updating.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/branch-strategy.md` at line 146, Update the Azure DevOps tagging guidance around `System.Tags` to first read the work item’s existing tags, merge `agent:frontend` without removing any current routing or release markers, and then submit the combined value through `az boards work-item update`.skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md-398-409 (1)
398-409: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not persist the Figma personal access token in
mcp_settings.json.The generated config stores
<FIGMA_PERSONAL_ACCESS_TOKEN>insidecommand.argsand copies the same--figma-api-key=<FIGMA_PERSONAL_ACCESS_TOKEN>pattern intotemplates/mcp-settings.json. This materializes the token in a local file and exposes it in process argument inspection. Keep the assertion about runtime-only availability, but replace it with a non-persisted injection pattern; do not list--figma-api-key=<FIGMA_PERSONAL_ACCESS_TOKEN>inmcp_settings.jsonorreferences/templates/mcp-settings.json.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md` around lines 398 - 409, The Figma token must not be persisted in configuration or templates. In skills/sdlc-agentic-pipeline/references/setup/service-onboarding.md lines 398-409, retain the runtime-only security statement but replace the mcp_settings.json example with a non-persisted token injection pattern, removing the --figma-api-key=<FIGMA_PERSONAL_ACCESS_TOKEN> argument; make the corresponding change in skills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.md lines 95-96, and ensure references/templates/mcp-settings.json likewise contains no token-bearing argument.
🟡 Minor comments (7)
skills/skill-installer/scripts/targets/azure-devops-cli.js-9-9 (1)
9-9: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winEnforce the declared Azure CLI minimum version.
AZURE_CLI_MIN_VERSIONis not referenced anywhere. UseparseSemver()on the first line fromensureAzCli(), reject versions below[2, 81, 0]in install/update, and makestatus()report an unhealthy/invalid Azure CLI state when the version is below the baseline.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/skill-installer/scripts/targets/azure-devops-cli.js` at line 9, Use AZURE_CLI_MIN_VERSION in the Azure CLI validation flow: parse the first line returned by ensureAzCli() with parseSemver(), reject versions below the baseline during install and update, and have status() report an unhealthy/invalid state for below-minimum versions.skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.md-150-151 (1)
150-151: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the guide path for the nested skill location.
This file lives at
skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.md. The referenced pathskills/brainstorming/visual-companion.mddoes not resolve from the repository root or from the skill directory. Use a path relative to the skill directory so the reference stays valid when the skill is installed.📝 Proposed fix
If they agree to the companion, read the detailed guide before proceeding: -`skills/brainstorming/visual-companion.md` +`visual-companion.md` (in this skill directory)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.md` around lines 150 - 151, Update the companion guide reference in the brainstorming skill instructions to use the valid path relative to the skill directory, `visual-companion.md`, while preserving the instruction to read it before proceeding.skills/sdlc-agentic-pipeline/skills/brainstorming/visual-companion.md-261-265 (1)
261-265: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the timestamp unit in the event example.
helper.jsLine 121 setsevent.timestamp = Date.now(), which returns milliseconds. The example values here are 10-digit second values. Use millisecond values so the agent parses them correctly.📝 Proposed fix
-{"type":"click","choice":"a","text":"Option A - Simple Layout","timestamp":1706000101} -{"type":"click","choice":"c","text":"Option C - Complex Grid","timestamp":1706000108} -{"type":"click","choice":"b","text":"Option B - Hybrid","timestamp":1706000115} +{"type":"click","choice":"a","text":"Option A - Simple Layout","timestamp":1706000101000} +{"type":"click","choice":"c","text":"Option C - Complex Grid","timestamp":1706000108000} +{"type":"click","choice":"b","text":"Option B - Hybrid","timestamp":1706000115000}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/visual-companion.md` around lines 261 - 265, Update the JSONL click-event examples to use 13-digit millisecond timestamps consistent with Date.now() in helper.js, while preserving the existing event ordering and fields.skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.md-32-32 (1)
32-32: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMake
writing-plansan optional transition step.The repository does not contain a
writing-plansskill orname: writing-plansentry, so this required terminal step creates an unreachable state. Add the missing skill or change these references to conditional phrasing such as “ifwriting-plansis available”.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.md` at line 32, Update the implementation-transition step in the brainstorming skill so invoking `writing-plans` is conditional on that skill being available. Preserve the transition guidance while preventing the workflow from requiring a nonexistent skill or `name: writing-plans` entry.Source: Coding guidelines
skills/sdlc-agentic-pipeline/skills/brainstorming/spec-document-reviewer-prompt.md-9-9 (1)
9-9: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd a language to the fenced code block.
markdownlint reports MD040 for this fence. Add a language identifier.
📝 Proposed fix
-``` +```text Subagent (general-purpose):🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/skills/brainstorming/spec-document-reviewer-prompt.md` at line 9, Add the text language identifier to the fenced code block containing “Subagent (general-purpose):” in the spec-document reviewer prompt, changing the bare fence to a language-qualified fence while preserving its content.Source: Linters/SAST tools
skills/sdlc-agentic-pipeline/SKILL.md-160-162 (1)
160-162: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the Figma onboarding order.
Step 0.0.5 selects Figma during Step 0. Users cannot run Step 0.11 before Step 0. State that Step 0.11 runs after the Figma selection is saved.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/SKILL.md` around lines 160 - 162, Update the workflow sequence in the agentic pipeline instructions so Step 0.11 runs after Step 0 completes and the Figma selection has been saved; remove the instruction to run it first. Keep the optional Step 0.F ordering unchanged.skills/sdlc-agentic-pipeline/references/agents/architect-agent.md-47-75 (1)
47-75: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the output path and instruction spelling.
The path placeholder uses
requriement-name. Agents can copy this invalid directory name. Correct it torequirement-name. Also correctarchieve,wirte,show be, andREALY.Proposed fix
-- Design spec doc is always required as the standard output, which should be stored at ` <project-root>/specs/<YYYY-MM-DD-requriement-name>/design.md` +- Design spec doc is always required as the standard output, which should be stored at `<project-root>/specs/<YYYY-MM-DD-requirement-name>/design.md` ... -- If archieve requirement.md to JIRA is required, use `atlassian-rovo-mcp` to update design info into JIRA ticket +- If archiving requirement.md to Jira is required, use `atlassian-rovo-mcp` to update design info into the Jira ticket ... -- API, database design show be there if are needed +- Include API and database design when needed ... -- 3. DO NOT WRITE PSEUDOCODE EVERYTIME ONLY WHEN IT IS REALY NECESSARY +- 3. DO NOT WRITE PSEUDOCODE UNLESS IT IS REALLY NECESSARY🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/sdlc-agentic-pipeline/references/agents/architect-agent.md` around lines 47 - 75, Correct the spelling in the architect-agent instructions: change the design spec directory placeholder from “requriement-name” to “requirement-name,” and fix the typos “archieve,” “wirte,” “show be,” and “REALY” while preserving the surrounding requirements and prohibitions.Source: Linters/SAST tools
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 815a75ce-389b-4b95-8608-a8af70d8ecc5
📒 Files selected for processing (31)
skills/sdlc-agentic-pipeline/SKILL.mdskills/sdlc-agentic-pipeline/references/agents/architect-agent.mdskills/sdlc-agentic-pipeline/references/agents/backend-agent.mdskills/sdlc-agentic-pipeline/references/agents/code-reviewer-agent.mdskills/sdlc-agentic-pipeline/references/agents/devops-agent.mdskills/sdlc-agentic-pipeline/references/agents/figma-design-agent.mdskills/sdlc-agentic-pipeline/references/agents/frontend-agent.mdskills/sdlc-agentic-pipeline/references/agents/pm-agent.mdskills/sdlc-agentic-pipeline/references/agents/shared/developer-agent-base.mdskills/sdlc-agentic-pipeline/references/agents/tester-agent.mdskills/sdlc-agentic-pipeline/references/branch-strategy.mdskills/sdlc-agentic-pipeline/references/config-reference.mdskills/sdlc-agentic-pipeline/references/pipeline.mdskills/sdlc-agentic-pipeline/references/sdlc-e2e-diagram.mdskills/sdlc-agentic-pipeline/references/setup/multi-tool-selection-plan.mdskills/sdlc-agentic-pipeline/references/setup/service-onboarding.mdskills/sdlc-agentic-pipeline/references/skill-registry.jsonskills/sdlc-agentic-pipeline/references/templates/azure-pipelines.ymlskills/sdlc-agentic-pipeline/references/templates/env-template.envskills/sdlc-agentic-pipeline/references/templates/mcp-settings.jsonskills/sdlc-agentic-pipeline/references/templates/sprint-scripts/README.mdskills/sdlc-agentic-pipeline/skills/brainstorming/SKILL.mdskills/sdlc-agentic-pipeline/skills/brainstorming/scripts/frame-template.htmlskills/sdlc-agentic-pipeline/skills/brainstorming/scripts/helper.jsskills/sdlc-agentic-pipeline/skills/brainstorming/scripts/server.cjsskills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.shskills/sdlc-agentic-pipeline/skills/brainstorming/scripts/stop-server.shskills/sdlc-agentic-pipeline/skills/brainstorming/spec-document-reviewer-prompt.mdskills/sdlc-agentic-pipeline/skills/brainstorming/visual-companion.mdskills/skill-installer/scripts/targets/azure-devops-cli.jsskills/skill-installer/scripts/targets/index.js
| while [[ $# -gt 0 ]]; do | ||
| case "$1" in | ||
| --project-dir) | ||
| PROJECT_DIR="$2" | ||
| shift 2 | ||
| ;; | ||
| --host) | ||
| BIND_HOST="$2" | ||
| shift 2 | ||
| ;; | ||
| --url-host) | ||
| URL_HOST="$2" | ||
| shift 2 | ||
| ;; | ||
| --idle-timeout-minutes) | ||
| IDLE_TIMEOUT_MINUTES="$2" | ||
| shift 2 | ||
| ;; | ||
| --open) | ||
| export BRAINSTORM_OPEN=1 | ||
| shift | ||
| ;; | ||
| --foreground|--no-daemon) | ||
| FOREGROUND="true" | ||
| shift | ||
| ;; | ||
| --background|--daemon) | ||
| FORCE_BACKGROUND="true" | ||
| shift | ||
| ;; | ||
| *) | ||
| echo "{\"error\": \"Unknown argument: $1\"}" | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| done |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
A missing option value causes an infinite loop.
Each value-taking branch runs shift 2. In bash, shift n where n is greater than $# returns a non-zero status and shifts nothing. The script does not set set -e, so execution continues.
Run start-server.sh --project-dir with no value. $# equals 1, shift 2 performs no shift, $1 stays --project-dir, and the while [[ $# -gt 0 ]] loop never terminates. The same applies to --host, --url-host, and --idle-timeout-minutes.
Validate that a value is present before you consume it.
🐛 Proposed fix
+require_value() {
+ if [[ $# -lt 2 || -z "$2" ]]; then
+ echo "{\"error\": \"Missing value for $1\"}"
+ exit 1
+ fi
+}
+
while [[ $# -gt 0 ]]; do
case "$1" in
--project-dir)
+ require_value "$@"
PROJECT_DIR="$2"
shift 2
;;
--host)
+ require_value "$@"
BIND_HOST="$2"
shift 2
;;
--url-host)
+ require_value "$@"
URL_HOST="$2"
shift 2
;;
--idle-timeout-minutes)
+ require_value "$@"
IDLE_TIMEOUT_MINUTES="$2"
shift 2
;;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| while [[ $# -gt 0 ]]; do | |
| case "$1" in | |
| --project-dir) | |
| PROJECT_DIR="$2" | |
| shift 2 | |
| ;; | |
| --host) | |
| BIND_HOST="$2" | |
| shift 2 | |
| ;; | |
| --url-host) | |
| URL_HOST="$2" | |
| shift 2 | |
| ;; | |
| --idle-timeout-minutes) | |
| IDLE_TIMEOUT_MINUTES="$2" | |
| shift 2 | |
| ;; | |
| --open) | |
| export BRAINSTORM_OPEN=1 | |
| shift | |
| ;; | |
| --foreground|--no-daemon) | |
| FOREGROUND="true" | |
| shift | |
| ;; | |
| --background|--daemon) | |
| FORCE_BACKGROUND="true" | |
| shift | |
| ;; | |
| *) | |
| echo "{\"error\": \"Unknown argument: $1\"}" | |
| exit 1 | |
| ;; | |
| esac | |
| done | |
| require_value() { | |
| if [[ $# -lt 2 || -z "$2" ]]; then | |
| echo "{\"error\": \"Missing value for $1\"}" | |
| exit 1 | |
| fi | |
| } | |
| while [[ $# -gt 0 ]]; do | |
| case "$1" in | |
| --project-dir) | |
| require_value "$@" | |
| PROJECT_DIR="$2" | |
| shift 2 | |
| ;; | |
| --host) | |
| require_value "$@" | |
| BIND_HOST="$2" | |
| shift 2 | |
| ;; | |
| --url-host) | |
| require_value "$@" | |
| URL_HOST="$2" | |
| shift 2 | |
| ;; | |
| --idle-timeout-minutes) | |
| require_value "$@" | |
| IDLE_TIMEOUT_MINUTES="$2" | |
| shift 2 | |
| ;; | |
| --open) | |
| export BRAINSTORM_OPEN=1 | |
| shift | |
| ;; | |
| --foreground|--no-daemon) | |
| FOREGROUND="true" | |
| shift | |
| ;; | |
| --background|--daemon) | |
| FORCE_BACKGROUND="true" | |
| shift | |
| ;; | |
| *) | |
| echo "{\"error\": \"Unknown argument: $1\"}" | |
| exit 1 | |
| ;; | |
| esac | |
| done |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/sdlc-agentic-pipeline/skills/brainstorming/scripts/start-server.sh`
around lines 29 - 64, Validate that each value-taking option in the
argument-parsing case within start-server.sh has a following argument before
assigning $2 and running shift 2. Apply this to --project-dir, --host,
--url-host, and --idle-timeout-minutes; when missing, emit the existing JSON
error format and exit instead of continuing the loop.
3 participants
Summary
Major update to sdlc-agentic-pipeline skill adding Azure DevOps as a first-class platform, Figma design-to-code capability, bundled brainstorming skill, and multiple correctness fixes for Azure DevOps work item state transitions and CLI commands.
Changes by topic
Azure DevOps CLI installer target
azure-devops-cli.jsadapter in skill-installeraz boardswork-item, iteration, PR, and pipeline managementFigma design-to-code
figma-design-agent.md— sole consumer of Figma MCP tools (figma.get_figma_data,figma.download_figma_images)figma: falsein frontmatter--figma-api-keyCLI arg (not env/headers)figma-extract.mdfor design tokens, components, asset pathsBrainstorming skill (bundled)
Onboarding & provisioning
shared/developer-agent-base.mdazure-pipelines.ymldeferred from onboarding to Step 6 (DevOps agent)sdlc-e2e-diagram.mdfull pipeline flow diagramazure-pipelines.ymltemplateAzure DevOps state mapping (correctness fix)
Resolvedstate exists ONLY for Bugs — Tasks useNew→Active→Closed(Agile) /To Do→Doing→Done(Basic)Active/Doing, use@agent:comments to mark phaseIn Reviewstate for Azure DevOps Task indevops-agent.mdbranch-strategy.mdstate mapping table and Task Discovery WIQLAzure DevOps CLI command fixes (correctness fix)
az boards iteration project createrequires--name(was missing)az boards iteration team set-default-iterationuses--path(was--iteration)az boards iteration project updatefallback for existing iterationsCode push to Azure Repos
git pushafter initial code creation (§3.3)git pushbefore PR creation (§3.7)git pushafter error throwback fixWork item report-to-comment
Epic → Issue → Task work item hierarchy
agent:*) on Task level onlyVerbose text trimming
Use azure-devops-cli skill (references/...)with directaz boardscommandsFiles changed
Summary by CodeRabbit
New Features
Documentation
Security