shopsys

Shopsys-specific AI security audit of a pull request diff. Reviews changed code for real, exploitable security issues against OWASP Top 10 / CWE, grounded in how this repo implements each control. Runs the built-in /security-review as a high-confidence baseline, then layers Shopsys-specific checks, and posts findings as inline PR comments plus one summary comment. Use in CI on pull requests, or locally to audit branch changes.

Generates a Czech sprint summary article from Jira sprint data, preferably via Jira MCP with CSV as a fallback, and can optionally prepare Playwright screenshots/videos as side attachments for relevant UX tasks.

Reviews storefront pull requests with risk-based static analysis, Jira context, project conventions, call-site tracing, test coverage audit, and Playwright runtime verification when available. Use when the user asks for a frontend/storefront/Next.js PR code review, especially with a GitHub PR URL, Jira issue URL/key, or review environment URL.

Drives `php bin/console monorepo:release` end-to-end. Runs pre-flight checks, starts the releaser, watches for confirm prompts, auto-presses Enter on prompts that are safe (waitFor already verified readiness, or ceremonial), and surfaces judgement calls to the operator via AskUserQuestion. Use when the user invokes /release.

Calls the GitHub REST API via `gh` to generate release notes for the given tag (the same content the "Generate release notes" button produces on the web UI) and inserts the result into the matching CHANGELOG-X.Y.md file. Used standalone or by the /release orchestrator when UpdateChangelogReleaseWorker is up next.

Create a Shopsys-style enum (a class extending AbstractEnum with public typed constants, NOT a native PHP enum). Use when you need to define a fixed set of values that downstream projects (like project-base) might extend or restrict.

Generates structured upgrade notes for a pull request based on diff analysis.

Analyzes PR diffs to identify breaking changes, feature movements, and scope

Use PROACTIVELY when you investigate, analyze, debug, or review performance issues using Blackfire.io profiles. Triggers on: 'blackfire profile', 'performance analysis', 'investigate slow', 'profile URL', app.blackfire.io URLs, slow requests, high CPU/IO, N+1 detection, or query optimization. Covers: header triage, callgraph analysis, SQL/HTTP views, timeline inspection, drill-down debugging, and interpreting recommendations.

Use PROACTIVELY when you implement, review, audit, debug, or optimize bulk operations (imports, mass edits, variant creation, batch updates) in Doctrine/Shopsys codebases. Triggers on: slow batch operations, 'Doctrine CPU spiral', N+1 queries in loops, creating/updating 100+ entities, flush discipline issues, or side effect problems. Covers: creating bulk handlers, reviewing performance issues, auditing existing code for anti-patterns, and refactoring single-item loops to bulk paths.