feat!: rename sw-cli tool to builtin

[Malte Janz (MalteJanz)]

What changed?

• Rename the built-in verifier tool from sw-cli to builtin.
• Keep sw-cli accepted as a backwards-compatible alias for --only and --exclude.
• Emit a deprecation warning when sw-cli is used as input:

  The tool name "sw-cli" is deprecated as input; use "builtin" instead

• Use builtin consistently in reports, statuses, errors, help text, and documentation.

Why?

Built on top of #1618 , addressing the comment there:
#1618 (comment)

The name sw-cli describes the binary rather than the purpose of the verifier. builtin makes it clear that this tool contains the checks built into Shopware CLI.

Existing CI configurations and scripts using --only sw-cli continue to work, while the warning guides users toward the new canonical name.

How was this tested?

• Focused extension validation selection tests
• Verified legacy sw-cli input handling for --only and --exclude
• Verified the deprecation warning is emitted once

Backwards compatibility

The following remains supported:

shopware-cli extension validate . --only sw-cli
shopware-cli extension validate . --exclude sw-cli

New usage should prefer:

shopware-cli extension validate . --only builtin
shopware-cli extension validate . --exclude builtin

Summary by CodeRabbit

• Updates
  • The built-in extension checker is now identified as builtin in validation commands and reports.
  • The legacy name sw-cli remains accepted when selecting or excluding the checker, but now triggers a deprecation warning.
  • Deprecated-name warnings also appear when using extension fix, format, and project validation commands.
  • Updated guidance reflects the new checker name and explains that sw-cli remains a legacy alias.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b9f9ab3e-4dcc-4847-a7a3-eca52889fce9

📥 Commits

Reviewing files that changed from the base of the PR and between 01af12f and 4d5b34a.

📒 Files selected for processing (1)

• skills/shopware-cli-extension-store/SKILL.md

 _____________________________________________________________
< Your naming scheme is vibes-based. I can tell by the smoke. >
 -------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b833de3b-ae66-4300-bcd0-fe376475fcd0

📥 Commits

Reviewing files that changed from the base of the PR and between 998e05b and 01af12f.

📒 Files selected for processing (4)

• AGENTS.md
• architecture.md
• cmd/project/project_validate.go
• internal/verifier/tool_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• AGENTS.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The built-in verifier is now named builtin. Tool selection and exclusion accept sw-cli as an alias, and commands warn when they receive it. Validation commands, tests, workflow configuration, and documentation use the canonical name.

Changes

Built-in checker naming

Layer / File(s)	Summary
Canonical checker name and alias internal/verifier/builtin.go, internal/verifier/tool.go, internal/verifier/*_test.go, internal/validation/reporter_test.go	The verifier is registered as Builtin and reports the name builtin. Tool selection and exclusion map sw-cli to builtin. Tests cover alias handling, warning output, source locations, and reporter tool names.
Command integration and guidance cmd/extension/*, cmd/project/project_validate.go, .github/workflows/smoke-test.yml, AGENTS.md, architecture.md, skills/*/SKILL.md	Extension and project commands warn when --only or --exclude contains sw-cli. Validation guidance and the smoke test use builtin. Documentation identifies sw-cli as a legacy alias.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 01af1

The legacy name remains accepted, and selecting both names runs the built-in checker once. No concrete merge risk remains.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 01af1

The rename preserves selection and exclusion through the legacy name without granting additional authority or bypassing checker-selection controls. Report consumers may need to adopt the new name, but no material security risk was identified in the changed behavior.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Within the inspected command paths, the alias reaches the same registered built-in checker rather than an additional executable, service, or caller-supplied implementation. The naming change does not expand execution authority along those paths.

Trust Boundaries and Controls

• observed — Alias handling preserves registered-tool matching and selected-set exclusion checks. Unknown names remain errors, and the deprecation warning uses fixed text rather than executing or interpolating arbitrary caller input.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 10 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely states the main change: renaming the sw-cli verifier tool to builtin.
Description check	✅ Passed	The description explains what changed, why it changed, how it was tested, and the backward-compatible alias behavior. It does not use the exact Related issue or discussion heading, and it does not rep…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 5.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 10 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 76.47059% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.72%. Comparing base (57b9e41) to head (4d5b34a).

Files with missing lines	Patch %	Lines
cmd/extension/extension_fix.go	0.00%	1 Missing ⚠️
cmd/extension/extension_format.go	0.00%	1 Missing ⚠️
cmd/extension/extension_validate.go	50.00%	1 Missing ⚠️
cmd/project/project_validate.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1627      +/-   ##
==========================================
- Coverage   65.72%   65.72%   -0.01%     
==========================================
  Files         462      462              
  Lines       30928    30940      +12     
==========================================
+ Hits        20327    20334       +7     
- Misses      10601    10606       +5     

Flag	Coverage Δ
go-test	65.72% <76.47%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

This PR renames the built-in extension validation checker from sw-cli to builtin (a user-facing change to --only/--exclude values, tool tables, and error/deprecation text), so I opened a documentation update.

Draft PR in shopware/docs: updates products/tools/cli/validation.md, products/tools/cli/index.md, and products/tools/cli/automatic-refactoring.md to use builtin as the canonical checker name, while noting that sw-cli remains accepted as a deprecated legacy alias.

cc Malte Janz (@MalteJanz) for review.