copilot-setting: Skill for Claude Code

Code Review — Workflow

Structured code review.

Phase 0 — Load canonical rules

MANDATORY pre-load gate — do NOT render a verdict (Phase 5) until you have opened the instruction files for the layers under review. Your training data defaults to modern Java/Spring; these files are the version lock for Java 8 / Spring 3.2 / Hibernate 4.2. Open them first, every time — the negative lists in the agent body are a floor, not the full rules. Read-back receipt: NAME each file you opened and QUOTE its single most load-bearing rule for this change — a generic restatement you could have written from memory means you skipped the file.

Layers under review — open each one the change touches: instructions/java.instructions.md, instructions/spring-hibernate.instructions.md, instructions/sql.instructions.md, instructions/sql-ddl.instructions.md, instructions/security.instructions.md, instructions/jsp.instructions.md, instructions/xml-config.instructions.md, instructions/testing.instructions.md (test-class @Transactional auto-rollback is sanctioned).

Phase 1 — Understand the Change

Read the diff and the files under review; establish the intent (what problem it solves) and whether the approach matches existing patterns.

Phase 2 — Review by Category

Correctness (check each):

• Shared mutable state accessed from multiple threads → synchronized or thread-local?
• JDBC resources (Connection, PreparedStatement, ResultSet, streams) managed via try-with-resources; Hibernate Session from getCurrentSession() is never closed/flushed manually (Spring owns its lifecycle)

Security (check each):

• Every SQL query uses bind parameters (? or :named)
• Every JSP output wrapped in <c:out> or equivalent encoding
• Every endpoint has explicit access control check
• No hardcoded credentials, API keys, or secrets

Performance (check each):

• No SQL inside a loop (N+1)
• No SELECT * — columns listed explicitly
• WHERE/JOIN columns have indexes
• Result sets bounded (LIMIT or pagination)