Orchestrate Comprehensive Code Reviews

This skill orchestrates comprehensive, multi-dimensional code review by running multiple specialized review agents in sequential, context-passing phases, consolidating their findings into a single prioritized report. Configuration options let a caller emphasize security (--security-focus), performance (--performance-critical), TDD compliance (--tdd-review), AI-assisted tools like Copilot/Codium/Bito (--ai-assisted), fail-fast behavior (--strict-mode), a metrics dashboard (--metrics-report), or a specific framework's conventions (--framework). Phase 1 runs code-quality and architecture agents in parallel: a code-reviewer agent analyzes complexity, maintainability, technical debt, duplication, and SOLID violations using SonarQube/CodeQL/Semgrep, while an architect-review agent evaluates microservice boundaries, API design, database schema, Domain-Driven Design adherence, and circular dependencies. Phase 2 runs security and performance agents that incorporate Phase 1's architectural findings: a security-auditor performs an OWASP Top 10 audit with Snyk/Trivy dependency scanning and GitLeaks secrets detection, checking for SQL injection, XSS, CSRF, and insecure deserialization, while a performance-engineer profiles CPU/memory hotspots, database query performance, caching, N+1 problems, and connection pooling. Phase 3 covers testing and documentation, cross-referencing prior phases: a test-automator agent evaluates unit/integration/e2e coverage, test pyramid adherence, assertion density, and flakiness (verifying TDD practice under --tdd-review), while a docs-architect agent reviews inline docs, OpenAPI/Swagger specs, ADRs, README completeness, and deployment runbooks against the actual implementation. Phase 4 synthesizes everything into framework and DevOps compliance: a legacy-modernizer agent checks modern JS/TypeScript, React hooks, Python PEP, Java, or Go idioms plus package/build/deployment practices, while a deployment-engineer agent reviews CI/CD pipeline security, blue-green/canary deployment strategy, infrastructure as code, and rollback capability. The consolidated report sorts every finding into four priority tiers: P0 critical (CVSS > 7.0 vulnerabilities, data-loss risk, auth bypasses, compliance violations like GDPR/PCI DSS/SOC2), P1 high (performance bottlenecks, missing critical test coverage, architectural anti-patterns, vulnerable dependencies), P2 medium (non-critical optimizations, documentation gaps, refactoring opportunities), and P3 low (style violations, minor smells, cosmetic items). Success criteria require every critical vulnerability documented, performance bottlenecks profiled with remediation paths, test-coverage gaps mapped by priority, architecture risks assessed, documentation verified against actual implementation, framework best practices confirmed, a deployment-safe CI/CD pipeline, and a clear prioritized team action plan.

Use this skill when running an exhaustive, multi-dimensional review of a codebase or change that needs coordinated coverage of quality, architecture, security, performance, testing, documentation, and DevOps practices in one consolidated report. Do not use it for a quick, single-dimension check - the phased multi-agent orchestration is built for thorough coverage over a broader scope, not a fast turnaround on a narrow diff. Each phase's prompt explicitly threads forward placeholders like {phase1_architecture_context} so later agents see earlier findings.

Input is a codebase or change target ($ARGUMENTS) plus optional configuration flags controlling focus area and strictness. Output is a consolidated, four-tier prioritized report (P0-P3) covering code quality, architecture, security, performance, testing, documentation, and CI/CD findings, each phase's context carried forward into the next.

Teams needing a coordinated, multi-agent comprehensive review - spanning code quality, security, performance, testing, documentation, and DevOps practices - consolidated into one prioritized remediation report, whose Phase 4B stage is explicitly framed as operationalizing fixes for all issues identified in earlier phases.