vm-pre-pr-checklist

# Pre-PR Checklist (Brownfield)

Run this skill before opening a pull request to catch issues early. It performs a structured self-review of changed files against the codebase's established patterns.

## Brownfield Context

This skill operates against a baseline established by the Reverse Engineering Agent. If `docs/codebase-analysis/` exists in the repository being reviewed, load architecture, conventions, and technology inventory from that output before scanning. If that output does not exist, infer conventions from the surrounding codebase files.

## What This Reviews

| Check | Rules Applied |
|---|---|
| Codebase pattern consistency | Changed code follows the same conventions as surrounding existing code |
| Security basics | No hardcoded credentials, secrets, or API keys; no unsafe execution patterns |
| Test coverage | Tests exist and are updated for new or changed functionality |
| Architectural alignment | Layer boundaries respected; no inappropriate cross-layer dependencies |
| SOLID basics | No obvious SRP or DIP violations introduced by this change |
| Error handling | Errors handled consistently with the surrounding codebase |
| Code hygiene | No debug logging in success paths; no dead code introduced; files appropriately sized |
| Dependency hygiene | No unapproved new dependencies introduced without justification |

---

## How to Run

1. Invoke via the Code Review Agent or directly in Copilot Chat
2. Identify all changed files: `git diff --name-only origin/{BASE_BRANCH}...HEAD`
3. Scan each changed file against the checks below
4. Output findings report (do not commit this report file to source control)

---

## Review Process

### Step 1 — Get Changed Files

```bash
git diff --name-only origin/{BASE_BRANCH}...HEAD
```

### Step 2 — Load Codebase Baseline

If `docs/codebase-analysis/` exists:
- Read `docs/codebase-analysis/conventions.md` for established patterns and naming conventions
- Read `docs/codebase-analysis/architecture.md` for layer structure and boundaries
- Read `docs/codebase-analysis/technology-inventory.md` for approved dependencies and versions

If RE Agent output does not exist, examine the surrounding codebase files (10-20 representative files) to infer conventions before scanning.

### Step 3 — Scan Each Changed File

For each changed file, check the following:

**Blocking — MUST FIX before merge:**
- [ ] No hardcoded credentials, API keys, tokens, passwords, or connection strings
- [ ] No secrets committed to source (use environment variables or a secrets manager)
- [ ] No new unsafe execution patterns (eval, exec, shell injection, raw SQL string concatenation, dynamic code execution)
- [ ] New dependencies are justified and present in the approved technology stack
- [ ] No broken imports or unresolved references introduced
- [ ] Error handling follows the codebase's established pattern (not silently swallowed)
- [ ] Authentication and authorization checks not bypassed or weakened

**Should Fix in this PR:**