review-bfs

Review Built for Shopify

Audit a Shopify app codebase against Built for Shopify (BfS) certification requirements.

Arguments

$ARGUMENTS = optional focus area (e.g., "polaris only", "security and performance"). If empty, run all categories.

Instructions

1. Read the project's CLAUDE.md to discover file paths, conventions, app structure, and any project-specific overrides. Use what you learn to locate admin routes, server files, TOML configs, and billing-related code.

2. Parse $ARGUMENTS. If a specific category is mentioned, run only that category. Otherwise run all 6 categories below.

3. Run all applicable category checks in parallel using Grep and Glob tools (not shell commands). For each violation found, record the file path, line number, what's wrong, and how to fix it.

4. Output the structured report described in the Output Format section.

---

Category 1: Polaris Compliance

Scan admin route files (typically app/routes/app.*.tsx) for:

• Raw HTML elements that should be Polaris components: <button, <input, <table, <select, <textarea, <form (case-insensitive). Ignore test files.
• Inline styles on layout elements: style= attributes or style={{ JSX expressions in admin routes. CSS-in-JS or Tailwind in admin UI violates Polaris guidelines.
• Missing HydrateFallback — every admin route with a loader should export a HydrateFallback component for Remix streaming. Grep for files that export a loader but do not export HydrateFallback.

Category 2: Performance

Scan server-side files (*.server.ts, *.server.tsx, route loaders/actions) for:

• Sequential awaits that could be parallelized: two or more await statements on independent calls in the same function that could use Promise.all() or Promise.allSettled().
• Unretried GraphQL mutations — admin.graphql() mutation calls not wrapped in a retry utility (e.g., withGraphQLRetry). Shopify recommends retry logic for rate-limited mutations.
• Sequential array processing — for...of or for loops containing await that could use Promise.all() with .map().