Kan/fvm claude reviewer#8614
Conversation
Dependency ReviewThe following issues were found:
License Issues.github/workflows/claude-review-fvm.yml
OpenSSF Scorecard
Scanned Files
|
📝 WalkthroughWalkthroughChangesFVM Claude review automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant ClaudeCode
participant PullRequestComment
PullRequest->>GitHubActions: FVM pull-request event
GitHubActions->>ClaudeCode: run configured review with repository context
ClaudeCode->>PullRequestComment: submit one formatted review comment
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-review-fvm.yml:
- Around line 45-47: Update the actions/checkout step to disable credential
persistence by setting persist-credentials to false alongside fetch-depth,
ensuring the GitHub token is not stored in local Git configuration.
- Around line 51-54: Move the Workload Identity Federation settings from the
action inputs into the workflow step’s env block using the required uppercase
variable names, and add GH_TOKEN there sourced from the GitHub token. Remove the
corresponding lowercase action inputs while preserving the existing Claude
action configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8db275f2-07da-46b9-ad0e-db5e1e9cd1e8
📒 Files selected for processing (1)
.github/workflows/claude-review-fvm.yml
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Prevent credential persistence in checkout.
To reduce the risk of credential leakage (especially when running automated AI tools that execute shell commands), explicitly disable credential persistence in the checkout action. This ensures the GitHub token is not left in the local git configuration.
🛡️ Proposed fix
- uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 45-47: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-review-fvm.yml around lines 45 - 47, Update the
actions/checkout step to disable credential persistence by setting
persist-credentials to false alongside fetch-depth, ensuring the GitHub token is
not stored in local Git configuration.
Source: Linters/SAST tools
| # Workload Identity Federation — no static credentials. | ||
| anthropic_federation_rule_id: fdrl_01UXEriP26j1qgPvpAvVyYoE | ||
| anthropic_service_account_id: svac_01RutNzF7FBxds8FhTHZ2BTY | ||
| anthropic_organization_id: 23ff619e-5bf0-4e8d-936b-87274460531a |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Move Workload Identity Federation variables to the env block and provide a GitHub token.
The anthropics/claude-code-action@v1 action does not accept WIF variables as inputs, meaning they will be ignored and authentication will fail. They must be exported as uppercase environment variables for the CLI to pick them up.
Additionally, since Claude is instructed to execute gh pr commands via allowed tools, the gh CLI requires a GH_TOKEN to authenticate.
🐛 Proposed fix
- # Workload Identity Federation — no static credentials.
- anthropic_federation_rule_id: fdrl_01UXEriP26j1qgPvpAvVyYoE
- anthropic_service_account_id: svac_01RutNzF7FBxds8FhTHZ2BTY
- anthropic_organization_id: 23ff619e-5bf0-4e8d-936b-87274460531a
+ github_token: ${{ github.token }}
+ env:
+ # Workload Identity Federation — no static credentials.
+ ANTHROPIC_FEDERATION_RULE_ID: fdrl_01UXEriP26j1qgPvpAvVyYoE
+ ANTHROPIC_SERVICE_ACCOUNT_ID: svac_01RutNzF7FBxds8FhTHZ2BTY
+ ANTHROPIC_ORGANIZATION_ID: 23ff619e-5bf0-4e8d-936b-87274460531a
+ GH_TOKEN: ${{ github.token }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Workload Identity Federation — no static credentials. | |
| anthropic_federation_rule_id: fdrl_01UXEriP26j1qgPvpAvVyYoE | |
| anthropic_service_account_id: svac_01RutNzF7FBxds8FhTHZ2BTY | |
| anthropic_organization_id: 23ff619e-5bf0-4e8d-936b-87274460531a | |
| github_token: ${{ github.token }} | |
| env: | |
| # Workload Identity Federation — no static credentials. | |
| ANTHROPIC_FEDERATION_RULE_ID: fdrl_01UXEriP26j1qgPvpAvVyYoE | |
| ANTHROPIC_SERVICE_ACCOUNT_ID: svac_01RutNzF7FBxds8FhTHZ2BTY | |
| ANTHROPIC_ORGANIZATION_ID: 23ff619e-5bf0-4e8d-936b-87274460531a | |
| GH_TOKEN: ${{ github.token }} |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 52-52: input "anthropic_federation_rule_id" is not defined in action "anthropics/claude-code-action@v1". available inputs are "additional_permissions", "allowed_bots", "allowed_non_write_users", "anthropic_api_key", "assignee_trigger", "base_branch", "bot_id", "bot_name", "branch_name_template", "branch_prefix", "classify_inline_comments", "claude_args", "claude_code_oauth_token", "display_report", "exclude_comments_by_actor", "github_token", "include_comments_by_actor", "include_fix_links", "label_trigger", "path_to_bun_executable", "path_to_claude_code_executable", "plugin_marketplaces", "plugins", "prompt", "settings", "show_full_output", "ssh_signing_key", "track_progress", "trigger_phrase", "use_bedrock", "use_commit_signing", "use_foundry", "use_sticky_comment", "use_vertex"
(action)
[error] 53-53: input "anthropic_service_account_id" is not defined in action "anthropics/claude-code-action@v1". available inputs are "additional_permissions", "allowed_bots", "allowed_non_write_users", "anthropic_api_key", "assignee_trigger", "base_branch", "bot_id", "bot_name", "branch_name_template", "branch_prefix", "classify_inline_comments", "claude_args", "claude_code_oauth_token", "display_report", "exclude_comments_by_actor", "github_token", "include_comments_by_actor", "include_fix_links", "label_trigger", "path_to_bun_executable", "path_to_claude_code_executable", "plugin_marketplaces", "plugins", "prompt", "settings", "show_full_output", "ssh_signing_key", "track_progress", "trigger_phrase", "use_bedrock", "use_commit_signing", "use_foundry", "use_sticky_comment", "use_vertex"
(action)
[error] 54-54: input "anthropic_organization_id" is not defined in action "anthropics/claude-code-action@v1". available inputs are "additional_permissions", "allowed_bots", "allowed_non_write_users", "anthropic_api_key", "assignee_trigger", "base_branch", "bot_id", "bot_name", "branch_name_template", "branch_prefix", "classify_inline_comments", "claude_args", "claude_code_oauth_token", "display_report", "exclude_comments_by_actor", "github_token", "include_comments_by_actor", "include_fix_links", "label_trigger", "path_to_bun_executable", "path_to_claude_code_executable", "plugin_marketplaces", "plugins", "prompt", "settings", "show_full_output", "ssh_signing_key", "track_progress", "trigger_phrase", "use_bedrock", "use_commit_signing", "use_foundry", "use_sticky_comment", "use_vertex"
(action)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-review-fvm.yml around lines 51 - 54, Move the
Workload Identity Federation settings from the action inputs into the workflow
step’s env block using the required uppercase variable names, and add GH_TOKEN
there sourced from the GitHub token. Remove the corresponding lowercase action
inputs while preserving the existing Claude action configuration.
Source: Linters/SAST tools
|
Should the review prompt not just be a skill. the github workflow would just invoke that skill, but we could also use it locally. |
4 participants
Adds a workflow that runs Claude Code on every PR touching
fvm/**and posts its findings as a PR comment. Companion to the branch-protection ruleset PR — that one makes room for an AI reviewer to eventually count as one of the tworequired approvals on FVM-only changes; this one is the reviewer.
It starts in trial mode, deliberately. Claude posts a single findings comment per run (grouped by severity, file:line citations, capped nits) and cannot approve or request changes — not just by prompt, but structurally: the tool
allowlist doesn't include
gh pr review, so an approval is impossible regardless of what the model decides. Once we've watched it on enough real FVM PRs to trust the signal, promoting it is a two-line change (addBash(gh pr review:*)tothe allowlist, swap the submission stanza of the prompt) — documented in a comment at the top of the workflow.
The review prompt is specialized for this codebase rather than generic. It points Claude at
AGENTS.md,fvm/README.md, and thefvm/errorstaxonomy (CodedError vs CodedFailure — fvm does not use the sentinel model the rest of therepo does), and names the bug classes that have actually bitten us: execution-result determinism and HCU discipline, warm/cold cache-state independence in derived-data metering,
RunWithMeteringDisabledboundary semantics andnested-transaction merge/unwind pairing, error-code stability, transaction pipeline phase invariants, service-account exemptions, and SPoCK sensitivity. It diffs against the PR's base ref rather than master, since FVM PRs are frequently
stacked. Style and formatting are explicitly out of scope — CI and CodeRabbit already cover those.
Authentication uses Workload Identity Federation: the workflow exchanges its GitHub OIDC token for a short-lived Anthropic token at runtime, so there is no
ANTHROPIC_API_KEYsecret to store or rotate. The IDs in the workflow file areidentifiers, not credentials. The federation rule (scoped to
repo:onflow/flow-go:) and the Claude GitHub App installation are already in place, so this should work on the first FVM PR after merge.Cost controls: runs are capped at 30 minutes and 30 turns, a new push cancels the in-flight review for that PR, and draft PRs are skipped until marked ready.
Summary by CodeRabbit