feat: add support for aws_backup_global_settings #221

Workflow file for this run

.github/workflows/claude-code-review.yml at 14b0df9

	name: Claude Code Review

	on:
	# Comment-based triggers (like Cursor's Bugbot)
	issue_comment:
	types: [created]
	pull_request_review_comment:
	types: [created]
	pull_request:
	types: [opened, synchronize]

	# Manual triggers via GitHub CLI
	workflow_dispatch:
	inputs:
	review_mode:
	description: 'Review mode to use'
	required: false
	default: 'hunt'
	type: choice
	options:
	- hunt
	- analyze
	- security
	- performance
	- review
	focus:
	description: 'Focus areas (comma-separated)'
	required: false
	default: 'bugs,security,performance'
	type: string
	verbose:
	description: 'Enable verbose output'
	required: false
	default: false
	type: boolean

	jobs:
	# Handle workflow_dispatch by creating a comment to trigger Claude
	dispatch-trigger:
	if: github.event_name == 'workflow_dispatch'
	runs-on: ubuntu-latest
	timeout-minutes: 5
	permissions:
	pull-requests: write
	issues: write
	steps:
	- name: Find open PR
	id: find-pr
	timeout-minutes: 3
	run: \|
	set -euo pipefail # Enhanced error handling

	BRANCH_NAME="${{ github.ref_name }}"

	# Validate branch name for security (allow underscores, dots, and forward slashes)
	if ! [[ "$BRANCH_NAME" =~ ^[a-zA-Z0-9/_.-]+$ ]]; then
	echo "Error: Invalid branch name format: $BRANCH_NAME"
	exit 1
	fi

	echo "Searching for open PR for branch: $BRANCH_NAME"

	# Find PR with error handling and validation
	if ! PR_DATA=$(gh pr list --repo "${{ github.repository }}" --state open --head "$BRANCH_NAME" --json number --jq '.[0].number // empty' 2>/dev/null); then
	echo "Error: Failed to query GitHub API for PRs"
	exit 1
	fi

	if [ -z "$PR_DATA" ] \|\| [ "$PR_DATA" = "null" ]; then
	echo "No open PR found for branch $BRANCH_NAME"
	exit 1
	fi

	# Validate PR number is numeric
	if ! [[ "$PR_DATA" =~ ^[0-9]+$ ]]; then
	echo "Error: Invalid PR number returned: $PR_DATA"
	exit 1
	fi

	echo "Found PR #$PR_DATA"
	echo "pr_number=$PR_DATA" >> $GITHUB_OUTPUT
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Create trigger comment
	timeout-minutes: 2
	run: \|
	set -euo pipefail # Enhanced error handling

	PR_NUMBER="${{ steps.find-pr.outputs.pr_number }}"
	REVIEW_MODE="${{ github.event.inputs.review_mode \|\| 'hunt' }}"

	# Validate inputs
	if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
	echo "Error: Invalid PR number: $PR_NUMBER"
	exit 1
	fi

	# Validate review mode against allowed values
	case "$REVIEW_MODE" in
	hunt\|analyze\|security\|performance\|review)
	echo "Using review mode: $REVIEW_MODE"
	;;
	*)
	echo "Error: Invalid review mode: $REVIEW_MODE"
	exit 1
	;;
	esac

	# Build comment body safely
	COMMENT_BODY="codebot $REVIEW_MODE"
	if [ "${{ github.event.inputs.verbose }}" = "true" ]; then
	COMMENT_BODY="$COMMENT_BODY verbose"
	fi

	echo "Creating comment: $COMMENT_BODY"

	# Create comment with error handling
	if ! gh pr comment "$PR_NUMBER" --repo "${{ github.repository }}" --body "$COMMENT_BODY"; then
	echo "Error: Failed to create PR comment"
	exit 1
	fi

	echo "Successfully created trigger comment on PR #$PR_NUMBER"
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	claude:
	# Only run on comment triggers or specific PR conditions
	if: \|
	(github.event_name == 'issue_comment' && contains(github.event.comment.body, 'codebot')) \|\|
	(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, 'codebot')) \|\|
	(github.event_name == 'pull_request' && (
	github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' \|\|
	contains(github.event.pull_request.title, '[auto-review]')
	))

	runs-on: ubuntu-latest
	timeout-minutes: 15 # Prevent runaway executions
	permissions:
	contents: read
	pull-requests: read
	issues: read
	id-token: write

	steps:
	- name: Get PR information for checkout
	id: pr-checkout-info
	if: github.event_name == 'issue_comment'
	timeout-minutes: 2
	run: \|
	set -euo pipefail

	PR_NUMBER="${{ github.event.issue.number }}"

	# Validate PR number
	if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
	echo "Error: Invalid PR number: $PR_NUMBER"
	exit 1
	fi

	echo "Fetching PR #$PR_NUMBER details for checkout"

	# Get PR head ref with retry logic
	for attempt in {1..3}; do
	if PR_DATA=$(curl -sS --max-time 30 --retry 2 \
	-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
	-H "Accept: application/vnd.github.v3+json" \
	"https://api.github.com/repos/${{ github.repository }}/pulls/$PR_NUMBER"); then

	if echo "$PR_DATA" \| jq empty 2>/dev/null; then
	HEAD_REF=$(echo "$PR_DATA" \| jq -r '.head.ref // empty')
	HEAD_SHA=$(echo "$PR_DATA" \| jq -r '.head.sha // empty')

	if [ -n "$HEAD_REF" ] && [ "$HEAD_REF" != "null" ] && [ -n "$HEAD_SHA" ] && [ "$HEAD_SHA" != "null" ]; then
	echo "pr_head_ref=$HEAD_REF" >> $GITHUB_OUTPUT
	echo "pr_head_sha=$HEAD_SHA" >> $GITHUB_OUTPUT
	echo "Found PR branch: $HEAD_REF ($HEAD_SHA)"
	break
	fi
	fi
	fi

	if [ $attempt -eq 3 ]; then
	echo "Error: Failed to fetch PR data for checkout"
	exit 1
	fi

	echo "Retrying in $((2 ** attempt)) seconds..."
	sleep $((2 ** attempt))
	done

	- name: Checkout repository
	uses: actions/checkout@v5
	with:
	fetch-depth: 0 # Full history for reliable diff comparisons
	token: ${{ secrets.GITHUB_TOKEN }}
	# For issue_comment events, checkout the PR branch
	ref: ${{ github.event_name == 'issue_comment' && steps.pr-checkout-info.outputs.pr_head_ref \|\| github.ref }}

	- name: Refresh git state
	id: git-refresh
	timeout-minutes: 3
	run: \|
	set -euo pipefail

	echo "🔄 Refreshing git state to ensure latest changes are analyzed"

	# Get current branch name
	CURRENT_BRANCH=$(git branch --show-current \|\| echo "")
	CURRENT_SHA=$(git rev-parse HEAD)

	echo "Current branch: $CURRENT_BRANCH"
	echo "Current SHA: $CURRENT_SHA"

	# Fetch all remote references to ensure we have the latest state
	echo "Fetching all remote references..."
	git fetch --all --prune

	# For issue_comment events, ensure we're on the latest commit of the PR branch
	if [ "${{ github.event_name }}" = "issue_comment" ]; then
	EXPECTED_SHA="${{ steps.pr-checkout-info.outputs.pr_head_sha }}"
	echo "Expected SHA from PR: $EXPECTED_SHA"

	# Fetch the specific PR branch to get latest changes
	PR_HEAD_REF="${{ steps.pr-checkout-info.outputs.pr_head_ref }}"
	if [ -n "$PR_HEAD_REF" ]; then
	echo "Fetching latest changes for PR branch: $PR_HEAD_REF"
	git fetch origin "$PR_HEAD_REF:$PR_HEAD_REF" 2>/dev/null \|\| true

	# Reset to the latest commit on the PR branch
	echo "Resetting to latest commit on $PR_HEAD_REF"
	git reset --hard "origin/$PR_HEAD_REF"

	NEW_SHA=$(git rev-parse HEAD)
	echo "Updated to SHA: $NEW_SHA"

	if [ "$NEW_SHA" != "$CURRENT_SHA" ]; then
	echo "⚠️ SHA changed from $CURRENT_SHA to $NEW_SHA - analyzing latest changes"
	else
	echo "✅ SHA unchanged - no new commits since checkout"
	fi
	fi
	else
	# For PR events, ensure we have the latest changes
	if [ -n "$CURRENT_BRANCH" ] && [ "$CURRENT_BRANCH" != "HEAD" ]; then
	echo "Ensuring latest changes for branch: $CURRENT_BRANCH"
	git fetch origin "$CURRENT_BRANCH" 2>/dev/null \|\| true
	git reset --hard "origin/$CURRENT_BRANCH" 2>/dev/null \|\| git reset --hard HEAD

	NEW_SHA=$(git rev-parse HEAD)
	if [ "$NEW_SHA" != "$CURRENT_SHA" ]; then
	echo "⚠️ SHA updated from $CURRENT_SHA to $NEW_SHA"
	fi
	fi
	fi

	# Final verification
	FINAL_SHA=$(git rev-parse HEAD)
	FINAL_BRANCH=$(git branch --show-current \|\| echo "detached")

	echo "✅ Git state refreshed successfully"
	echo "Final branch: $FINAL_BRANCH"
	echo "Final SHA: $FINAL_SHA"

	# Output for use in subsequent steps
	echo "current_sha=$FINAL_SHA" >> $GITHUB_OUTPUT
	echo "current_branch=$FINAL_BRANCH" >> $GITHUB_OUTPUT


	- name: Parse comment command
	id: parse-command
	timeout-minutes: 2
	env:
	COMMENT_BODY: ${{ github.event.comment.body }}
	run: \|
	set -euo pipefail # Enhanced error handling

	# Input validation and sanitization
	if [ ${#COMMENT_BODY} -gt 1000 ]; then
	echo "Error: Comment body too long (max 1000 characters)"
	exit 1
	fi

	# Sanitize comment body - remove potentially dangerous characters
	SAFE_COMMENT=$(echo "$COMMENT_BODY" \| tr -d '`$(){}[]\|;&<>' \| head -c 500)

	# Default values
	echo "mode=review" >> $GITHUB_OUTPUT
	echo "focus=code-quality,security,performance" >> $GITHUB_OUTPUT
	echo "verbose=false" >> $GITHUB_OUTPUT
	echo "include_tests=true" >> $GITHUB_OUTPUT
	echo "full_analysis=false" >> $GITHUB_OUTPUT

	# Parse comment content for commands (using safe variable)
	if [ "${{ github.event_name }}" == "issue_comment" ] \|\| [ "${{ github.event_name }}" == "pull_request_review_comment" ]; then
	# Use grep with fixed strings where possible for security
	if echo "$SAFE_COMMENT" \| grep -qiF "codebot hunt"; then
	echo "mode=hunt" >> $GITHUB_OUTPUT
	echo "focus=bugs,security,performance" >> $GITHUB_OUTPUT
	echo "verbose=false" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "codebot analyze"; then
	echo "mode=analyze" >> $GITHUB_OUTPUT
	echo "focus=architecture,patterns,complexity" >> $GITHUB_OUTPUT
	echo "verbose=true" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "codebot security"; then
	echo "mode=security" >> $GITHUB_OUTPUT
	echo "focus=security,vulnerabilities,compliance" >> $GITHUB_OUTPUT
	echo "verbose=true" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "codebot performance"; then
	echo "mode=performance" >> $GITHUB_OUTPUT
	echo "focus=performance,optimization,bottlenecks" >> $GITHUB_OUTPUT
	echo "verbose=true" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "codebot review"; then
	echo "mode=review" >> $GITHUB_OUTPUT
	echo "focus=code-quality,security,performance" >> $GITHUB_OUTPUT
	echo "verbose=true" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "codebot"; then
	# Default to hunt mode for simple "codebot" command
	echo "mode=hunt" >> $GITHUB_OUTPUT
	echo "focus=bugs,security,performance" >> $GITHUB_OUTPUT
	echo "verbose=false" >> $GITHUB_OUTPUT
	fi

	# Check for verbose flag (using fixed strings for security)
	if echo "$SAFE_COMMENT" \| grep -qiF "verbose" \|\| echo "$SAFE_COMMENT" \| grep -qiF "detailed"; then
	echo "verbose=true" >> $GITHUB_OUTPUT
	fi

	# Check for specific focus areas
	if echo "$SAFE_COMMENT" \| grep -qiF "security"; then
	echo "focus=security,vulnerabilities,compliance" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "performance"; then
	echo "focus=performance,optimization,bottlenecks" >> $GITHUB_OUTPUT
	elif echo "$SAFE_COMMENT" \| grep -qiF "tests"; then
	echo "focus=test-coverage,test-quality" >> $GITHUB_OUTPUT
	fi

	# Check for --full flag (analyze entire codebase)
	if echo "$SAFE_COMMENT" \| grep -qiF -- "--full"; then
	echo "full_analysis=true" >> $GITHUB_OUTPUT
	else
	echo "full_analysis=false" >> $GITHUB_OUTPUT
	fi
	fi

	echo "Security: Input validation and sanitization completed"

	- name: Get PR information
	id: pr-info
	timeout-minutes: 3
	run: \|
	set -euo pipefail # Enhanced error handling

	# Initialize variables
	PR_NUMBER=""
	BASE_REF=""

	# Handle different trigger types with validation
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	PR_NUMBER="${{ github.event.pull_request.number }}"
	BASE_REF="${{ github.event.pull_request.base.ref }}"
	elif [ "${{ github.event_name }}" = "issue_comment" ]; then
	PR_NUMBER="${{ github.event.issue.number }}"

	# Validate PR number is numeric
	if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
	echo "Error: Invalid PR number: $PR_NUMBER"
	exit 1
	fi

	# Fetch PR data with retry logic and timeout
	for attempt in {1..3}; do
	echo "Attempt $attempt: Fetching PR data for PR #$PR_NUMBER"
	if PR_DATA=$(curl -sS --max-time 30 --retry 2 \
	-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
	-H "Accept: application/vnd.github.v3+json" \
	"https://api.github.com/repos/${{ github.repository }}/pulls/$PR_NUMBER"); then

	# Validate JSON response
	if echo "$PR_DATA" \| jq empty 2>/dev/null; then
	BASE_REF=$(echo "$PR_DATA" \| jq -r '.base.ref // empty')
	if [ -n "$BASE_REF" ] && [ "$BASE_REF" != "null" ]; then
	echo "Successfully retrieved base ref: $BASE_REF"
	break
	fi
	fi
	fi

	if [ $attempt -eq 3 ]; then
	echo "Error: Failed to fetch PR data after 3 attempts"
	exit 1
	fi

	echo "Retrying in $((2 ** attempt)) seconds..."
	sleep $((2 ** attempt))
	done

	elif [ "${{ github.event_name }}" = "pull_request_review_comment" ]; then
	PR_NUMBER="${{ github.event.pull_request.number }}"
	BASE_REF="${{ github.event.pull_request.base.ref }}"
	else
	echo "Error: Unsupported event type: ${{ github.event_name }}"
	exit 1
	fi

	# Validate required variables
	if [ -z "$PR_NUMBER" ] \|\| [ -z "$BASE_REF" ]; then
	echo "Error: Missing required PR information"
	echo "PR_NUMBER: $PR_NUMBER, BASE_REF: $BASE_REF"
	exit 1
	fi

	# Sanitize branch name for security (allow underscores, dots, and forward slashes)
	if ! [[ "$BASE_REF" =~ ^[a-zA-Z0-9/_.-]+$ ]]; then
	echo "Error: Invalid base ref format: $BASE_REF"
	exit 1
	fi

	echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
	echo "base_ref=$BASE_REF" >> $GITHUB_OUTPUT
	echo "Security: PR information validated and sanitized"

	- name: Get changed files
	id: changes
	if: steps.parse-command.outputs.full_analysis == 'false'
	run: \|

	set -euo pipefail

	BASE_REF="${{ steps.pr-info.outputs.base_ref }}"
	CURRENT_SHA="${{ steps.git-refresh.outputs.current_sha }}"
	CURRENT_BRANCH="${{ steps.git-refresh.outputs.current_branch }}"

	echo "🔍 Detecting changed files for analysis"
	echo "Base branch: $BASE_REF"
	echo "Current SHA: $CURRENT_SHA"
	echo "Current branch: $CURRENT_BRANCH"

	# Ensure we have the base branch reference
	echo "Fetching base branch: $BASE_REF"
	git fetch origin "$BASE_REF" 2>/dev/null \|\| {
	echo "⚠️ Failed to fetch $BASE_REF, trying fallback methods"
	git fetch origin 2>/dev/null \|\| true
	}

	# Multiple fallback strategies for getting changed files
	CHANGED_FILES=""
	DIFF_SUCCESS=false

	# Strategy 1: Standard three-dot diff (preferred)
	if [ "$DIFF_SUCCESS" = false ]; then
	echo "Trying three-dot diff: origin/$BASE_REF...HEAD"
	if CHANGED_FILES=$(git diff --name-only "origin/$BASE_REF...HEAD" 2>/dev/null); then
	echo "✅ Three-dot diff successful"
	DIFF_SUCCESS=true
	else
	echo "❌ Three-dot diff failed"
	fi
	fi

	# Strategy 2: Two-dot diff fallback
	if [ "$DIFF_SUCCESS" = false ]; then
	echo "Trying two-dot diff: origin/$BASE_REF..HEAD"
	if CHANGED_FILES=$(git diff --name-only "origin/$BASE_REF..HEAD" 2>/dev/null); then
	echo "✅ Two-dot diff successful"
	DIFF_SUCCESS=true
	else
	echo "❌ Two-dot diff failed"
	fi
	fi

	# Strategy 3: Direct branch comparison
	if [ "$DIFF_SUCCESS" = false ]; then
	echo "Trying direct comparison: origin/$BASE_REF HEAD"
	if CHANGED_FILES=$(git diff --name-only "origin/$BASE_REF" HEAD 2>/dev/null); then
	echo "✅ Direct comparison successful"
	DIFF_SUCCESS=true
	else
	echo "❌ Direct comparison failed"
	fi
	fi

	# Strategy 4: Last resort - use merge-base
	if [ "$DIFF_SUCCESS" = false ]; then
	echo "Trying merge-base approach"
	if MERGE_BASE=$(git merge-base "origin/$BASE_REF" HEAD 2>/dev/null); then
	if CHANGED_FILES=$(git diff --name-only "$MERGE_BASE" HEAD 2>/dev/null); then
	echo "✅ Merge-base diff successful"
	DIFF_SUCCESS=true
	fi
	fi
	fi

	# Validate and process results
	if [ "$DIFF_SUCCESS" = false ]; then
	echo "❌ All diff strategies failed - will analyze full codebase"
	CHANGED_FILES=""
	CHANGED_COUNT=0
	CHANGED_FILES_STR="Unable to determine changed files - will analyze full codebase"
	else
	# Filter out empty lines and count
	CHANGED_FILES=$(echo "$CHANGED_FILES" \| grep -v '^$' \|\| echo "")
	CHANGED_COUNT=$(echo "$CHANGED_FILES" \| grep -c . 2>/dev/null \|\| echo "0")

	if [ "$CHANGED_COUNT" -eq 0 ]; then
	CHANGED_FILES_STR="No files changed"
	echo "⚠️ No changed files detected - this might indicate an issue"
	else
	CHANGED_FILES_STR=$(echo "$CHANGED_FILES" \| tr '\n' ' ' \| sed 's/[[:space:]]*$//')
	echo "✅ Found $CHANGED_COUNT changed files"
	fi
	fi

	# Debug output
	echo "📋 Changed files summary:"
	echo " Count: $CHANGED_COUNT"
	echo " Files: $CHANGED_FILES_STR"


	if [ "$CHANGED_COUNT" -gt 0 ]; then
	echo "📄 Individual files:"
	echo "$CHANGED_FILES" \| while IFS= read -r file; do
	[ -n "$file" ] && echo " - $file"
	done
	fi

	# Output for next steps
	echo "changed_files=$CHANGED_FILES_STR" >> $GITHUB_OUTPUT
	echo "changed_count=$CHANGED_COUNT" >> $GITHUB_OUTPUT
	echo "diff_successful=$DIFF_SUCCESS" >> $GITHUB_OUTPUT

	- name: Verify commit SHA and git state
	id: verify-state
	timeout-minutes: 2
	run: \|
	set -euo pipefail

	echo "🔍 Verifying git state before analysis"

	CURRENT_SHA="${{ steps.git-refresh.outputs.current_sha }}"
	ACTUAL_SHA=$(git rev-parse HEAD)
	CURRENT_BRANCH="${{ steps.git-refresh.outputs.current_branch }}"

	# Verify SHA consistency
	if [ "$CURRENT_SHA" != "$ACTUAL_SHA" ]; then
	echo "⚠️ SHA mismatch detected!"
	echo " Expected: $CURRENT_SHA"
	echo " Actual: $ACTUAL_SHA"
	echo " This indicates a git state issue - attempting to resolve..."

	# Update the SHA for consistency
	CURRENT_SHA="$ACTUAL_SHA"
	echo "current_sha=$ACTUAL_SHA" >> $GITHUB_OUTPUT
	else
	echo "✅ SHA verification passed: $CURRENT_SHA"
	echo "current_sha=$CURRENT_SHA" >> $GITHUB_OUTPUT
	fi

	# Get additional context for debugging
	echo "📊 Git state summary:"
	echo " Commit SHA: $CURRENT_SHA"
	echo " Branch: $CURRENT_BRANCH"
	echo " Repository: ${{ github.repository }}"
	echo " Event: ${{ github.event_name }}"

	# Get commit info for better context
	COMMIT_MSG=$(git log -1 --pretty=format:"%s" 2>/dev/null \|\| echo "Unable to get commit message")
	COMMIT_AUTHOR=$(git log -1 --pretty=format:"%an" 2>/dev/null \|\| echo "Unknown")
	COMMIT_DATE=$(git log -1 --pretty=format:"%ci" 2>/dev/null \|\| echo "Unknown")

	echo " Commit message: $COMMIT_MSG"
	echo " Author: $COMMIT_AUTHOR"
	echo " Date: $COMMIT_DATE"

	# Create unique identifier for cache invalidation
	REVIEW_ID="${CURRENT_SHA:0:8}-${{ github.event_name }}-$(date +%s)"
	echo " Review ID: $REVIEW_ID"

	# Output additional context
	echo "commit_message=$COMMIT_MSG" >> $GITHUB_OUTPUT
	echo "commit_author=$COMMIT_AUTHOR" >> $GITHUB_OUTPUT
	echo "commit_date=$COMMIT_DATE" >> $GITHUB_OUTPUT
	echo "review_id=$REVIEW_ID" >> $GITHUB_OUTPUT

	- name: Run Claude Code Review
	id: claude
	timeout-minutes: 10
	uses: anthropics/claude-code-action@beta
	with:
	claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

	# Allow Bash permissions for pre-commit hooks and documentation updates
	allowed_tools: "Bash(pre-commit run --files),Bash(terraform fmt),Bash(terraform validate),Bash(terraform-docs)"

	# Dynamic prompt based on review mode
	direct_prompt: \|
	🔄 COMMIT ANALYSIS CONTEXT
	- Commit SHA: `${{ steps.verify-state.outputs.current_sha }}`
	- Review ID: `${{ steps.verify-state.outputs.review_id }}`
	- Branch: `${{ steps.git-refresh.outputs.current_branch }}`
	- Last Commit: "${{ steps.verify-state.outputs.commit_message }}" by ${{ steps.verify-state.outputs.commit_author }}
	- Date: ${{ steps.verify-state.outputs.commit_date }}

	---

	${{ steps.parse-command.outputs.full_analysis == 'false' && format('
	IMPORTANT: Focus ONLY on the following changed files in this pull request:
	Files changed: {0}
	Total files changed: {1}
	Diff detection: {2}

	DO NOT review or comment on files outside this list unless they are directly impacted by changes in these files.
	', steps.changes.outputs.changed_files \|\| 'Unable to determine changed files', steps.changes.outputs.changed_count \|\| '0', steps.changes.outputs.diff_successful == 'true' && 'Successful' \|\| 'Failed - analyzing full codebase') \|\| '' }}

	${{ steps.parse-command.outputs.mode == 'hunt' && format('
	🕵️ BUG HUNT MODE - Find potential issues quickly:
	- Focus on critical bugs, security vulnerabilities, and performance issues
	- Prioritize high-impact problems over style suggestions
	- Be concise and actionable
	- Provide clear, actionable feedback
	') \|\| '' }}

	${{ steps.parse-command.outputs.mode == 'analyze' && format('
	📊 ANALYSIS MODE - Deep technical analysis:
	- Analyze architecture, patterns, and design decisions
	- Evaluate code complexity and maintainability
	- Assess test coverage and quality
	- Provide strategic recommendations
	- Consider long-term implications and scalability
	') \|\| '' }}

	${{ steps.parse-command.outputs.mode == 'security' && format('
	🔒 SECURITY MODE - Security-focused review:
	- Identify security vulnerabilities and compliance issues
	- Check for proper authentication and authorization
	- Validate input sanitization and output encoding
	- Review encryption and key management
	- Assess data protection and privacy concerns
	') \|\| '' }}

	${{ steps.parse-command.outputs.mode == 'performance' && format('
	⚡ PERFORMANCE MODE - Performance optimization review:
	- Identify performance bottlenecks and optimization opportunities
	- Analyze resource usage and efficiency
	- Check for memory leaks and scalability issues
	- Review caching strategies and database queries
	- Consider load testing and monitoring needs
	') \|\| '' }}

	${{ steps.parse-command.outputs.mode == 'review' && format('
	📝 STANDARD REVIEW MODE - Comprehensive code review:
	- Code quality and best practices
	- Potential bugs or issues
	- Performance considerations
	- Security concerns
	- Test coverage and quality

	Focus areas: {0}
	Verbose output: {1}

	Be constructive and helpful.
	', steps.parse-command.outputs.focus, steps.parse-command.outputs.verbose) \|\| '' }}

	# Use sticky comments with commit-specific cache invalidation
	use_sticky_comment: true
	# Note: The commit SHA and review ID in the prompt help ensure fresh analysis

	- name: Workflow Summary
	if: always()
	timeout-minutes: 2
	run: \|
	set -euo pipefail # Enhanced error handling

	echo "## 🤖 Claude Code Review Summary" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Security Status
	echo "### 🔐 Security Status" >> $GITHUB_STEP_SUMMARY
	echo "- ✅ Input validation and sanitization enabled" >> $GITHUB_STEP_SUMMARY
	echo "- ✅ Command injection protection active" >> $GITHUB_STEP_SUMMARY
	echo "- ✅ Error handling and retry logic implemented" >> $GITHUB_STEP_SUMMARY
	echo "- ✅ Timeout protection for all operations" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Review Configuration
	echo "### ⚙️ Review Configuration" >> $GITHUB_STEP_SUMMARY
	echo "Review Mode: \`${{ steps.parse-command.outputs.mode }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Focus Areas: \`${{ steps.parse-command.outputs.focus }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Verbose Output: \`${{ steps.parse-command.outputs.verbose }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Full Analysis: \`${{ steps.parse-command.outputs.full_analysis \|\| 'false' }}\`" >> $GITHUB_STEP_SUMMARY
	if [ "${{ steps.parse-command.outputs.full_analysis }}" != "true" ]; then
	echo "Changed Files: \`${{ steps.changes.outputs.changed_count \|\| '0' }}\` files" >> $GITHUB_STEP_SUMMARY
	echo "Diff Detection: \`${{ steps.changes.outputs.diff_successful == 'true' && 'Successful' \|\| 'Failed' }}\`" >> $GITHUB_STEP_SUMMARY
	fi
	echo "PR Number: \`${{ steps.pr-info.outputs.pr_number \|\| 'N/A' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Base Branch: \`${{ steps.pr-info.outputs.base_ref \|\| 'N/A' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Git State Information
	echo "### 📊 Git State Analysis" >> $GITHUB_STEP_SUMMARY
	echo "Commit SHA: \`${{ steps.verify-state.outputs.current_sha \|\| steps.git-refresh.outputs.current_sha \|\| 'Unknown' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Review ID: \`${{ steps.verify-state.outputs.review_id \|\| 'N/A' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Current Branch: \`${{ steps.git-refresh.outputs.current_branch \|\| 'Unknown' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Last Commit: \"${{ steps.verify-state.outputs.commit_message \|\| 'Unknown' }}\"" >> $GITHUB_STEP_SUMMARY
	echo "Author: \`${{ steps.verify-state.outputs.commit_author \|\| 'Unknown' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "Date: \`${{ steps.verify-state.outputs.commit_date \|\| 'Unknown' }}\`" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Analysis Scope Details
	if [ "${{ steps.parse-command.outputs.full_analysis }}" != "true" ] && [ "${{ steps.changes.outputs.changed_count \|\| '0' }}" -gt "0" ]; then
	echo "### 📄 Files Being Analyzed" >> $GITHUB_STEP_SUMMARY
	echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
	echo "${{ steps.changes.outputs.changed_files }}" \| tr ' ' '\n' \| grep -v '^$' \| head -20 >> $GITHUB_STEP_SUMMARY
	if [ "${{ steps.changes.outputs.changed_count }}" -gt "20" ]; then
	echo "... and $((${{ steps.changes.outputs.changed_count }} - 20)) more files" >> $GITHUB_STEP_SUMMARY
	fi
	echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	fi

	# Available Commands
	echo "### 📝 Available Commands" >> $GITHUB_STEP_SUMMARY
	echo "Comment any of these in PRs to trigger specific review types:" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot hunt\` - Quick bug detection (like Bugbot) on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot analyze\` - Deep technical analysis on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot security\` - Security-focused review on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot performance\` - Performance optimization review on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot review\` - Comprehensive review on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "- \`codebot\` - Defaults to hunt mode on PR changes" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Scope Options
	echo "### 🔍 Scope Options" >> $GITHUB_STEP_SUMMARY
	echo "- Add \`--full\` to any command to analyze the entire codebase" >> $GITHUB_STEP_SUMMARY
	echo "- Example: \`codebot hunt --full\` - Hunt for bugs in the entire codebase" >> $GITHUB_STEP_SUMMARY
	echo "- Default behavior (without --full) focuses only on changed files in the PR" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	# Manual Triggers
	echo "### 🚀 Manual Triggers" >> $GITHUB_STEP_SUMMARY
	echo "Run via GitHub CLI:" >> $GITHUB_STEP_SUMMARY
	echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
	echo "gh workflow run claude-code-review.yml -f review_mode=hunt" >> $GITHUB_STEP_SUMMARY
	echo "gh workflow run claude-code-review.yml -f review_mode=security -f verbose=true" >> $GITHUB_STEP_SUMMARY
	echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

	# Performance & Reliability Info
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "### ⚡ Performance & Reliability" >> $GITHUB_STEP_SUMMARY
	echo "- 🚀 Full git history fetch for reliable diff comparisons" >> $GITHUB_STEP_SUMMARY
	echo "- 🔄 Automatic git state refresh and commit SHA verification" >> $GITHUB_STEP_SUMMARY
	echo "- 🎯 Multiple fallback strategies for change detection" >> $GITHUB_STEP_SUMMARY
	echo "- ⏱️ Timeout protection prevents runaway executions" >> $GITHUB_STEP_SUMMARY
	echo "- 🛡️ Comprehensive error handling and validation" >> $GITHUB_STEP_SUMMARY
	echo "- 📊 Enhanced logging and debug information" >> $GITHUB_STEP_SUMMARY
	echo "- 🔐 Cache invalidation via commit-specific review IDs" >> $GITHUB_STEP_SUMMARY

	# Troubleshooting section
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "### 🔧 Troubleshooting" >> $GITHUB_STEP_SUMMARY
	echo "If the review doesn't detect recent changes:" >> $GITHUB_STEP_SUMMARY
	echo "1. Check the commit SHA matches your latest changes" >> $GITHUB_STEP_SUMMARY
	echo "2. Verify the diff detection was successful" >> $GITHUB_STEP_SUMMARY
	echo "3. Review the git state analysis above" >> $GITHUB_STEP_SUMMARY
	echo "4. Try \`codebot hunt --full\` to analyze the entire codebase" >> $GITHUB_STEP_SUMMARY

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add support for aws_backup_global_settings #221

Workflow file

feat: add support for aws_backup_global_settings #221

Uh oh!

Jobs

Run details

Workflow file for this run