Conversation
|
Great job! No new security vulnerabilities introduced in this pull request |
|
Hi @michalchecinski 👋🏼 |
|
|
||
| ### Step 3: Fix Detected Errors | ||
|
|
||
| Use the Read tool to examine workflow files with errors, then use the Edit tool to fix them. Fix only errors, not warnings or other findings. |
There was a problem hiding this comment.
🤔 I almost missed "Fix only errors, not warnings or other findings." What do you think about moving this to Step 2? In my head it makes sense to filter non-errors when parsing the output.
🌱 Along those same lines, would there be value in adding a flag to bwwl so it only returns errors? That would reduce the amount of "thinking" Claude must do before starting the real work we want it do.
There was a problem hiding this comment.
Moved the ask to filter the results. Also, I've added the error only option to the workflow linter here.
theMickster
added
the
ai-review-vnext
Bitwarden Claude Code ReviewOverall Assessment: APPROVE This PR adds a new No new findings. The previously identified critical issue (missing |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
theMickster
left a comment
theMickster
left a comment
There was a problem hiding this comment.
Seems like we addressed some of these things in another PR. I'm a little confused though, Is this one supposed to be still opened?
| - **Verification**: Re-runs the linter after fixes to confirm all errors are resolved | ||
| - **Structured Reporting**: Summarizes what was changed and any remaining issues requiring manual attention | ||
|
|
||
| ## Skills |
There was a problem hiding this comment.
README.md because we intend to have the SKILL.md speak for itself. Also, too much detail like the following become overly burdensome to maintain overtime.
|
|
||
| ## Maintainers | ||
|
|
||
| - @team-ai-sme |
There was a problem hiding this comment.
❌ We need to consider changing this to the actual engineering team that will maintain the plugin overtime.
Please consider adding the BRE team as a co-owner to the plugin in the code owners file.
|
|
||
| ## Overview | ||
|
|
||
| This plugin provides a skill that runs Bitwarden's internal workflow linter (`bwwl`) against GitHub Actions workflow files, parses the results, and automatically fixes detected errors. |
There was a problem hiding this comment.
♻️ Please make this more generic to describe the vision for what the plugin will contain over time.
|
|
||
| ## Features | ||
|
|
||
| - **Automated Linting**: Runs `bwwl lint` on `.github/workflows/` and captures all errors |
There was a problem hiding this comment.
⛏️ Let's try to trim this down as well to only 2-bullets. Adding four bullets per skill is going to become a pain to maintain over time.
| "description": "Application security engineering assistant for vulnerability triage, threat modeling, and secure code analysis." | ||
| }, | ||
| { | ||
| "name": "bitwarden-github-workflows", |
There was a problem hiding this comment.
🤔 I don't like that we have introduced the github name here specifically because it ties us into a specific platform plugin (we do have a couple of these, but I am strongly considering removing the atlassian-reader skill altogether now that we have the MCP in place).
We have followed the pattern of either persona plugins or very specific utility plugins.
How about one of these instead?
bitwarden-devops-engineer- a neutral, broad, well-known name
- allows us to group all sorts of skills independent of how we name internal teams
- does not refer to a specific bitwarden team/role per-sey
bitwarden-build-release-engineer- a more targeted name to a bitwarden role
- could set a implied/perceived division that encourages someone to build a
bitwarden-shot-engineerthat has too many cross-applicable skills
My advice and preference is the first. Thoughts?
|
@theMickster @SaintPatrck I'm going to close this PR, as @vgrassia added a refined skill in his PR as a part of broader BRE skills initiative. Let's work on those there. |
3 participants
🎟️ Tracking
📔 Objective
Add the bitwarden-github-workflows plugin, which provides a lint-workflows skill that runs Bitwarden's bwwl linter against GitHub Actions workflow files and automatically fixes detected errors.