Add Bitwarden Code Review plugin with agent-based architecture#9
Conversation
Introduces comprehensive code review plugin following Bitwarden engineering standards: - Autonomous bitwarden-code-reviewer agent with structured review protocols - Support for repository-specific guidelines via .claude/prompts/review-code.md - 5-tier finding classification system (CRITICAL, IMPORTANT, DEBT, SUGGESTED, QUESTION) - Mandatory comment format with collapsible details sections - False positive prevention through pattern recognition Plugin structure: - Comprehensive README with usage examples and GitHub Actions integration - CONTRIBUTING.md with update process and quality checks - Agent definition with security-first review approach Configuration updates: - Added plugin entry to marketplace.json - Added "anthropics" to .cspell.json for GitHub Actions examples 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
ca2da2f to
8688a75
Compare
|
Great job! No new security vulnerabilities introduced in this pull request |
|
Claude finished @SaintPatrck's task —— View job Code Review Complete ✅Tasks
Overall Assessment: APPROVEReviewed the addition of the Bitwarden Code Review plugin across 7 files. This is a clean, well-structured PR that follows repository conventions and plugin standards. Findings: 2 (informational inquiries only)Finding 1: Inconsistent License Field Across PluginsFile: 💭 QUESTION: License field inconsistency across plugins Details and inquiryThe new plugin uses
The repository has a This affects plugin metadata clarity and user expectations about usage rights. Finding 2: Existing Plugins Have Outdated Repository URLsScope: Repository-wide cleanup opportunity (not blocking for this PR) 💭 QUESTION: Repository URL migration not complete for existing plugins Details and contextThis PR correctly uses
However, existing plugins still reference the old repository name
While this doesn't block the current PR (which uses correct URLs), should the existing plugins be updated in a follow-up PR to maintain consistency across the marketplace? SummaryThe PR demonstrates excellent documentation quality, proper plugin structure, and adherence to repository patterns. The plugin introduces a comprehensive code review agent with thorough documentation, clear usage examples, and proper marketplace integration. Key Observations:
The two questions raised are informational inquiries about repository-wide consistency rather than issues with this specific PR. |
Fixes issue where agent posted all findings in a single PR comment instead of distributing them as inline review comments on specific lines. Changes to AGENT.md: - Add "GitHub Comment Posting Protocol" section (111 lines) - Document distinction between review comments vs issue comments - Provide exact gh CLI syntax for posting inline comments with --file and --line - Add workflow sequence: analyze → post inline comments → post summary - Include concrete examples of proper gh pr review and gh pr comment usage - Mandate use of review comments for code-specific findings Changes to CONTRIBUTING.md: - Remove specific token budget threshold (<20,000) - Keep general requirement for token usage measurement The agent now has explicit instructions for using: - `gh pr review --comment` for inline comments on specific lines - `gh pr comment` for final summary comment only This ensures findings appear in the Files Changed view attached to relevant code, not consolidated in the PR timeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
|
|
||
| If deficient, create a finding (💭) with rewrite suggestions in a collapsible `<details>` section. | ||
|
|
||
| ### Step 4: Load Repository-Specific Guidelines |
There was a problem hiding this comment.
Added this step to ensure repo-specific rules are considered.
There was a problem hiding this comment.
do we need to be more direct here? "If deficient, you must create a finding..."
You don't have to make that change now, but i find that stronger language like that reduces the chance that Claude will just 'forget' or ignore a directive.
There was a problem hiding this comment.
Agreed. If that starts happening we certainly be more direct in our phrasing, or leverage other tooling to make sure local context is properly injected.
Corrects repository references to match actual GitHub repository name. Changes: - plugin.json: Update homepage and repository URLs to ai-plugins - README.md: Update marketplace URL in GitHub Actions example to ai-plugins Addresses finding from code review about repository URL inconsistency. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| @@ -0,0 +1,23 @@ | |||
| { | |||
| "name": "bitwarden-code-review", | |||
| "version": "0.1.0", | |||
There was a problem hiding this comment.
❌ CRITICAL: Version mismatch between marketplace and plugin manifest
Details and fix
The marketplace.json declares version "1.0.0":
{
"name": "bitwarden-code-review",
"source": "./plugins/bitwarden-code-review",
"version": "1.0.0",
"description": "Comprehensive code review system with organization-wide standards and repository-specific patterns."
}But the plugin manifest declares version "0.1.0":
{
"name": "bitwarden-code-review",
"version": "0.1.0",
"description": "Comprehensive code review system..."
}Fix: Align versions. Since this is the initial release, use either "1.0.0" in both places or "0.1.0" in both places. Based on the other plugins in the marketplace using "1.0.0", recommend changing line 3 of plugin.json from "0.1.0" to "1.0.0".
Version mismatches can cause confusion during plugin installation and updates, and may lead to the wrong version being installed.
There was a problem hiding this comment.
The marketplace and plugins are intentionally different as they represent different things.
There was a problem hiding this comment.
At least t was an inline comment 🤭
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Run Code Review | ||
| uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
💭 QUESTION: Is claude-code-action@v1 publicly available?
Context and clarification needed
The GitHub Actions example references:
- name: Run Code Review
uses: anthropics/claude-code-action@v1This action doesn't appear to be publicly available in the Anthropic GitHub organization.
Questions:
- Is this a planned release that will be available before this plugin ships?
- Should this be marked as a future example with a note that the action is coming soon?
- Is there an alternative action that should be referenced instead?
If this action isn't yet available, users attempting to follow the documentation will encounter errors when trying to set up GitHub Actions integration.
There was a problem hiding this comment.
https://github.com/anthropics/claude-code-action does exist. v1 is used as an example placeholder for the correct version.
| **Attempt to read repository-specific guidelines:** | ||
|
|
||
| First, check if the file exists: | ||
|
|
There was a problem hiding this comment.
🎨 SUGGESTED: Improve bash command example readability
Enhancement details
The bash code block has formatting that doesn't render correctly:
First, check if the file exists:
```bash
test -f .claude/prompts/review-code.md && echo "EXISTS" || echo "NOT_FOUND"
This creates ambiguous formatting where the triple backticks appear inside what looks like a markdown code block.
**Suggested improvement** - Use clearer formatting:
```markdown
First, check if the file exists:
test -f .claude/prompts/review-code.md && echo "EXISTS" || echo "NOT_FOUND"
Or remove the explicit bash fence since it's already described as a bash command in the context.
This improves documentation clarity and ensures proper rendering across different markdown processors.
| **If EXISTS**: Read the file using the Read tool: | ||
|
|
||
| ``` | ||
| .claude/prompts/review-code.md |
There was a problem hiding this comment.
🎨 SUGGESTED: Clarify Read tool syntax in instructions
Enhancement details
The instruction says:
**If EXISTS**: Read the file using the Read tool:
.claude/prompts/review-code.md
This formatting is unclear - it appears to show a file path in a code block, but doesn't explicitly indicate this is meant to be used with the Read tool.
Suggested improvement:
**If EXISTS**: Read the file using the Read tool with the path:
.claude/prompts/review-code.mdOr more explicitly:
**If EXISTS**: Use the Read tool to read `.claude/prompts/review-code.md`This makes it clearer that this is an instruction for tool usage, not example output or a code snippet to execute.
theMickster
left a comment
theMickster
left a comment
There was a problem hiding this comment.
Minor 💭 LGTM otherwise!
|
|
||
| - name: Run Code Review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: |
There was a problem hiding this comment.
💭Are all of these inputs valid? Or did Claude stretch on what is possible? Asking because I checked the inputs from the repo...
export function collectActionInputsPresence(): void {
const inputDefaults: Record<string, string> = {
trigger_phrase: "@claude",
assignee_trigger: "",
label_trigger: "claude",
base_branch: "",
branch_prefix: "claude/",
allowed_bots: "",
mode: "tag",
model: "",
anthropic_model: "",
fallback_model: "",
allowed_tools: "",
disallowed_tools: "",
custom_instructions: "",
direct_prompt: "",
override_prompt: "",
additional_permissions: "",
claude_env: "",
settings: "",
anthropic_api_key: "",
claude_code_oauth_token: "",
github_token: "",
max_turns: "",
use_sticky_comment: "false",
use_commit_signing: "false",
experimental_allowed_domains: "",
};
There was a problem hiding this comment.
Interesting. That sorta makes sense because I had to tell Claude about them. I got them from the usage docs.
I'll open a PR in gh-actions to test it.
There was a problem hiding this comment.
I think you're correct but maybe they are being added somewhere's else... They appear to be noted in the YML, too. So what the heck, let's give them a try!
withinfocus
left a comment
withinfocus
left a comment
There was a problem hiding this comment.
Let's just roll with it at this point and see how it does.
4 participants
🎟️ Tracking
N/A
📔 Objective
Introduces comprehensive code review plugin following Bitwarden engineering standards:
Plugin structure:
Configuration updates:
⏰ Reminders before review
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes