feat(aem-cloud-service): add vault-package-dependencies analyzer detector + expert skill - #330
Open
bharat941 wants to merge 6 commits into
Open
feat(aem-cloud-service): add vault-package-dependencies analyzer detector + expert skill#330bharat941 wants to merge 6 commits into
bharat941 wants to merge 6 commits into
Conversation
…nt pattern - Add VaultPackageDependencies detector (pom-only, mechanical fix) - Add expert skill SKILL.md + recipe.md under code-assessment/ - Register detector in Registry.java - Add routing hint to code-assessment/SKILL.md - Add catalog row (high severity, ready, analyzer, mechanical) to patterns.md - Add vault deploy blocker entry to migration/SKILL.md - Add positive + negative test fixtures - Add test cases to run-tests.sh - Remove duplicate standalone skills/vault-package-dependencies/ skill
bharat941
requested review from
Himanich,
abhishekgarg18,
akankshajain18,
pkumargaddam and
rombert
as code owners
September 4, 2026 05:50
Contributor
Tessl Plugin Lint
|
…core Address tessl-review content-judge feedback (was 3/5, target 3.5+): - Inline analyze.sh invocations under Findings sources for actionability. - Add a 5-step inline checkpoint loop (detect/plan/apply/validate/retry) to the Routing section for workflow clarity. - Remove the third restatement of the remove-deprecated-api / Maven-Central exception in Critical rules — cross-reference the first bullet instead of restating the preflight detail. No semantic change; the runbook still owns the full flow.
…ration "Package install fails on AEMaaCS" is a migration blocker, but the pattern was only reachable via code-assessment directly — migration's analyzer cascade silently dropped its findings because analyzer-runner.js's ANALYZER_TO_CANONICAL allowlist didn't include it (same bucket as inject-in-sling-model/outdated-dependencies, which are correctly excluded since they're not migration-relevant). Unlike every other cascade pattern, there is no BPA subtype for this at all — day/cq60/product Vault install-time dependencies live in pom.xml, which a deployed-artifact BPA scan can never see (confirmed against a real 64k-row BPA report: zero hits). So this is wired as `strategy: 'cascade'` with an empty `bpaSlugs` — the BPA tier is skipped entirely, straight to the analyzer, same model as htlLint being BPA-less but still migration-routed. - Add to ANALYZER_TO_CANONICAL so the migration cascade's analyzer tier stops silently dropping these findings. - Add PATTERN_META entry, Quick start row, Branch B routing bullet, "When to Use This Skill" bullet, and Step 0 runbook table row in migration/SKILL.md. - Verified end-to-end against the real analyzer + real fixture: gatherFindings now correctly sources it via 'analyzer' (not needsLlmScan). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Same reasoning as guava-cache: day/cq60/product Vault install-time dependencies never occur in native AEMaaCS code, only in pom.xml carried over from legacy AEM 6.x — this is a migration-only concern, not a code-assessment pattern, even though the previous commit gave it a full analyzer detector + expert-skill folder there. - Remove the expert skill, Java detector (Registry.java), and fixtures from code-assessment; revert SKILL.md/patterns.md/run-tests.sh hooks. - Add migration/references/vault-package-dependencies.md (merged from the old SKILL.md + recipe.md content). - Replace the analyzer detector with a pure-Node heuristic pom.xml scan (migration/scripts/vault-package-scan-runner.js), mirroring htlLint's html-scan model — no analyzer, no BPA subtype (confirmed against a real 64k-row BPA report: zero hits for day/cq60/vault/content-package-maven-plugin). Verified byte-for-byte identical output to the removed Java detector against both real fixtures (antipattern + clean), plus new edge-case coverage (legacy group under an unrelated plugin correctly not flagged). - Wire PATTERN_META (new 'pom-scan' strategy) + gatherFindings dispatch + migration/SKILL.md (Quick start, Branch B, Step 0 table). Removed the now-redundant "Vault deploy blocker" doc-only stub row that existed before this branch (never wired to any code) in favor of one real, wired entry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adding the vault-package-dependencies mention pushed the frontmatter description to 1033 chars, over skills-ref's 1024 limit. This broke both the `validate` CI check and `tessl-review` (tessl validates the skill before reviewing it, so it errored out rather than scoring it — "tooling failure", not a low score). Trimmed redundant wording to 972 chars; verified locally with `npx skills-ref validate`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Per explicit request: reverts the tessl-review score fix from earlier in this session (Findings-sources rewording, Inline checkpoint loop, remove-deprecated-api sentence tweak). This file had zero vault-package- dependencies content — the revert removes unrelated content from this PR, not anything about the pattern move. Note: this was the fix for tessl-review's below-threshold score (77%, needed 80%+) on this PR. Reverting it will likely reintroduce that failure until it's fixed again, separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the
vault-package-dependenciescode-assessment pattern — surface missing<dependencies>insidefilevault-package-maven-plugin(orcontent-package-maven-plugin) configurations that block AEM as a Cloud Service package deploys. Follows thereferences/adding-a-pattern.mdprocedure; the slugvault-package-dependenciesis wired into all four required places so the[wiring]test stays green.Changes
scripts/analyzer/detectors/VaultPackageDependencies.java, registered inRegistry.all(). Pom-only, mechanical fix; flags vault/content-package plugin configurations without a<dependencies>block.vault-package-dependencies/SKILL.md(control plane) +vault-package-dependencies/recipe.md(mechanical fix: add<dependencies>block with correct group/artifact refs).references/patterns.mdrow (high | ready | analyzer | mechanical) and Manual Pattern Hints row incode-assessment/SKILL.md.migration/SKILL.mdentry pointing at the new pattern.test/code-assessment/fixtures/vault-package-dependencies/(legacy pom missing dependencies) and.../vault-package-dependencies-clean/(correct pom) + a block inrun-tests.sh.skills/vault-package-dependencies/skill superseded by the code-assessment version.Test Plan
run-tests.sh— all blocks PASS (incl.[wiring]and the new[vault-package-dependencies]block). Detector flags vault/content-package plugin configs missing<dependencies>; does not flag the clean fixture. End-to-end on a real legacy AEM project: analyzer detects → recipe transform applied → analyzer re-scan clean →mvn packagebuilds and the resulting content package deploys on AEMaaCS.