Skip to content

llm(bitwarden-code-review): label inline comments with their source #287

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SaintPatrck merged 4 commits into from
Oct 23, 2026
Merged

llm(bitwarden-code-review): label inline comments with their source #287

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54ee06b
llm(bitwarden-code-review): label inline comments with their source
SaintPatrck Oct 22, 2026
7a37d89
Require the source line on every inline comment and expect it in the …
SaintPatrck Oct 22, 2026
6c918b9
Scope the source line to GitHub pull requests
SaintPatrck Oct 23, 2026
99dddfe
Merge remote-tracking branch 'origin/main' into code-review-source-label
SaintPatrck Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .claude-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
{
"name": "bitwarden-code-review",
"source": "./plugins/bitwarden-code-review",
"version": "2.5.0",
"version": "2.6.0",
"description": "Comprehensive code review system with organization-wide standards."
},
{
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable
| [bitwarden-shepherd](plugins/bitwarden-shepherd/) | 1.0.1 | Champion of a technical strategy — shepherds a TSI through evaluation into the funnel, then through to adoption |
| [bitwarden-adr-tools](plugins/bitwarden-adr-tools/) | 1.0.0 | Architecture Decision Record tools: checking designs and plans against the ADR catalog, locating and summarizing ADRs |
| [bitwarden-atlassian-tools](plugins/bitwarden-atlassian-tools/) | 2.7.7 | Atlassian access via MCP server with deep Jira issue research skill and opt-in Jira write tools |
| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.5.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration |
| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.6.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration |
| [bitwarden-delivery-tools](plugins/bitwarden-delivery-tools/) | 3.5.2 | Delivery lifecycle skills: initiative funnel navigation, work transitions, architectural judgment, feature flags, commits, PRs, preflight, labeling, Jira ticket filing |
| [bitwarden-designer](plugins/bitwarden-designer/) | 0.1.0 | Product designer persona: Code of Conduct and 30/60/90 critique, critique facilitation; dispatches into bitwarden-design-tools |
| [bitwarden-design-tools](plugins/bitwarden-design-tools/) | 0.1.0 | Design toolkit: content style guide, Figma Dev Mode MCP, Bitwarden brand application, handoff prep, Design System governance, Product and Design Jira |
Expand Down
2 changes: 1 addition & 1 deletion plugins/bitwarden-code-review/.claude-plugin/plugin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "bitwarden-code-review",
"version": "2.5.0",
"version": "2.6.0",
"description": "Comprehensive code review system with organization-wide standards.",
"author": {
"name": "Bitwarden",
Expand Down
6 changes: 6 additions & 0 deletions plugins/bitwarden-code-review/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ All notable changes to the Bitwarden Code Review Plugin will be documented in th
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [2.6.0] - 2026-10-23

### Changed

- Inline comments and thread replies on a GitHub pull request end with a `code-review` source line. claude-config-validator's `/validate-ai` posts under the same bot account, so without it a reader cannot tell which review raised a finding

## [2.5.0] - 2026-10-23

### Added
Expand Down
2 changes: 1 addition & 1 deletion plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
name: bitwarden-code-reviewer
version: 2.5.0
version: 2.6.0
description: Conducts thorough code reviews following Bitwarden standards. Finds all issues first pass, avoids false positives, respects codebase conventions. Invoke when user mentions "code review", "review code", "review", "PR", or "pull request".
model: opus
skills: avoiding-false-positives, classifying-review-findings, posting-bitwarden-review-comments, posting-review-summary, reviewing-dependency-changes
Expand Down
7 changes: 5 additions & 2 deletions plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Check destinations **in this order** — use the first match:
| Local target, no GitHub destination | The review target is local changes and no caller declared a GitHub destination | Write to `review-inline-comments.md` in working directory |
| GitHub pull request | Neither of the above | Post via `mcp__github_inline_comment__create_inline_comment` |

Under either local destination, format every finding exactly as below and write them all to the one file — do not post, whatever comment tools happen to be available.
Under either local destination, format every finding exactly as below, without the source line, and write them all to the one file — do not post, whatever comment tools happen to be available.

On a GitHub pull request, a finding raised again in an existing thread goes as a reply in that thread, so its history stays in one place. Call `mcp__github_replies__add_reply_to_pull_request_comment` with the `database_id` of the thread's first comment as `commentId`, the owner and repository from the threads data's top-level `repository`, and the pull request number as `pullNumber`, which the tool requires whenever a reply has a body. The reply uses the same finding format as an inline comment. When that tool is unavailable, the thread's first comment has no `database_id`, or the reply call fails, post a new inline comment instead.

Expand Down Expand Up @@ -57,8 +57,9 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a
4. Be brief yet clear
5. Use collapsed sections for comments over 5 lines
6. Include both opening `<details>` AND closing `</details>` tags
Comment thread
SaintPatrck marked this conversation as resolved.
Resolved
7. On a GitHub pull request, end with the source line `<sub>code-review</sub>`, short comments and thread replies included

**Visibility Rule:** Only severity + one-line description visible; everything else inside `<details>` tags.
**Visibility Rule:** Only severity + one-line description and, on a GitHub pull request, the source line visible; everything else inside `<details>` tags.

### Template for long comments

Expand All @@ -74,6 +75,8 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a

Reference: [docs link if applicable]
</details>

<sub>code-review</sub>
Comment thread
SaintPatrck marked this conversation as resolved.
Resolved
```

## Summary Output
Expand Down
18 changes: 9 additions & 9 deletions plugins/bitwarden-code-review/tests/TESTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,15 +41,15 @@ claude -p "What Claude Code skill are available in this plugin?"

#### Invocation Tests

| Test | Command | Expected |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format |
| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" |
| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `<details>` tags |
| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `<details>` needed for short comments |
| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections |
| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments |
| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden |
| Test | Command | Expected |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format, ends with `<sub>code-review</sub>` |
| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" |
| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `<details>` tags, ends with `<sub>code-review</sub>` |
| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `<details>` needed for short comments, ends with `<sub>code-review</sub>` |
| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections |
| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments |
| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden |

#### Anti-Pattern Tests

Expand Down