dhis2-core-code-review

Reviews DHIS2 Core backend pull requests against architecture, security, transaction, and testing conventions.

352|400|Updated Aug 30, 2016
One-click install
npx skills add https://github.com/dhis2/dhis2-core --skill dhis2-core-code-review-dhis2
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: dhis2-core-code-review
Source: https://github.com/dhis2/dhis2-core/tree/main/.github/skills/code-review
Command: npx skills add https://github.com/dhis2/dhis2-core --skill dhis2-core-code-review-dhis2

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing DHIS2 Core pull requests requires deep knowledge of platform-specific conventions (layering, ACL, transactions, Flyway migrations, test goals) that generic code reviews routinely miss, letting critical defects like missing authority checks or non-idempotent migrations slip through. ## Core Features & Use Cases - Mandatory Findings Scan: Checks every diff against 17 high-signal DHIS2 defect patterns, from missing @RequiresAuthority to SQL injection and boolean config misreads, each with a fixed severity. - DHIS2-Specific Checklists: Enforces rules for layering (Controller -> Service -> Store), transaction boundaries, caching via CacheProvider, Flyway migration idempotency, OpenAPI annotations, and banned imports. - Structured Review Report: Produces a standardized output with Strengths, severity-tiered Issues (Critical/Important/Minor), Recommendations, and a merge verdict. - Use Case: A maintainer receives a PR adding a new REST endpoint with a schema change. The skill flags the missing negative (403) auth test, the non-idempotent Flyway migration, and the absent WOW coordination entry before approval. ## Quick Start Review the current DHIS2 Core pull request diff against the platform conventions and produce a severity-tiered review report with a merge verdict.

Frequently Asked Questions about dhis2-core-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a DHIS2 Core pull request?

Read the full diff and linked Jira issue, open each changed file completely, then run the general pass, the DHIS2 checklist pass, the testing pass, and the hygiene pass. Report findings in the structured output format with severity tiers and a merge verdict.

What are the most critical defects in DHIS2 backend code?

Critical defects include endpoints without @RequiresAuthority or ACL checks, SQL built by concatenating request input, writes inside readOnly transactions, non-idempotent Flyway migrations, and exact-string comparison of boolean dhis.conf keys instead of isEnabled().

What testing is required for DHIS2 pull requests?

Every PR needs at least one non-Mockito test, and bugfix PRs must include a regression test proving the fix. New endpoints need a test per request parameter plus a negative 403 test for auth-gated endpoints, using the correct integration test base class.

Which imports are banned in DHIS2 Core?

Banned imports include JUnit 4, org.json, org.jetbrains.annotations, lombok.NonNull, javax.transaction.Transactional, @PreAuthorize, and commons-lang v1. These are build-enforced, so their presence indicates the author never built the change.

What are the rules for Flyway migrations in DHIS2?

Migrations must be idempotent with IF NOT EXISTS/IF EXISTS guards, use lowercase SQL, follow the V2_{major}_{seq}__{description} naming with lowercase underscore words, and include a WOW coordination entry. Released migration files are immutable and must be fixed forward.

When should a DHIS2 pull request not be approved?

Do not approve when Critical findings remain, such as missing auth on endpoints, SQL injection, or non-idempotent migrations, or when a bugfix lacks a regression test. A PR with outstanding request-changes feedback must not be approved even with two approvals.