fix: use managed login branding provider identifier #627
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code Review | |
| on: | |
| # Comment-based triggers (like Cursor's Bugbot) | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| jobs: | |
| # Add eyes reaction to show codebot is working | |
| eyes-reaction: | |
| if: | | |
| (github.event_name == 'issue_comment' && (contains(github.event.comment.body, 'codebot') || contains(github.event.comment.body, '@codebot'))) || | |
| (github.event_name == 'pull_request_review_comment' && (contains(github.event.comment.body, 'codebot') || contains(github.event.comment.body, '@codebot'))) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| permissions: | |
| contents: read | |
| pull-requests: write # needed for reactions on PR comments | |
| issues: write # needed for reactions on issue comments | |
| steps: | |
| - name: Add eyes reaction | |
| timeout-minutes: 1 | |
| run: | | |
| set -euo pipefail | |
| # Add eyes emoji reaction to indicate codebot is processing | |
| if [ "${{ github.event_name }}" = "issue_comment" ]; then | |
| COMMENT_ID="${{ github.event.comment.id }}" | |
| elif [ "${{ github.event_name }}" = "pull_request_review_comment" ]; then | |
| COMMENT_ID="${{ github.event.comment.id }}" | |
| else | |
| echo "No comment to react to for event type: ${{ github.event_name }}" | |
| exit 0 | |
| fi | |
| echo "Adding 👀 reaction to comment ID: $COMMENT_ID" | |
| gh api repos/${{ github.repository }}/issues/comments/$COMMENT_ID/reactions \ | |
| --method POST \ | |
| --field content='eyes' || { | |
| echo "Failed to add reaction - this might be expected for some comment types" | |
| exit 0 | |
| } | |
| echo "✅ Eyes reaction added successfully" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Claude Code Action (using proven claude.yml pattern) | |
| claude: | |
| if: | | |
| (github.event_name == 'issue_comment' && (contains(github.event.comment.body, 'codebot') || contains(github.event.comment.body, '@codebot'))) || | |
| (github.event_name == 'pull_request_review_comment' && (contains(github.event.comment.body, 'codebot') || contains(github.event.comment.body, '@codebot'))) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write # Required for Claude to post analysis comments | |
| issues: write # Required for Claude to post analysis comments | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| # Pin to specific SHA for supply chain security | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| fetch-depth: 1 | |
| - name: Parse codebot command | |
| id: parse-command | |
| run: | | |
| set -euo pipefail | |
| # Get comment body safely | |
| COMMENT_BODY="${{ github.event.comment.body }}" | |
| SAFE_COMMENT=$(echo "$COMMENT_BODY" | tr -d '`$(){}[]|;&<>' | head -c 500) | |
| echo "Parsing comment: $SAFE_COMMENT" | |
| # Default values | |
| MODE="hunt" | |
| FULL_ANALYSIS="false" | |
| FOCUS="bugs,security,performance" | |
| VERBOSE="false" | |
| # Extract mode from comment (support both @codebot and codebot) | |
| if echo "$SAFE_COMMENT" | grep -qiE "(^|\s)@?codebot\s+analyze"; then | |
| MODE="analyze" | |
| FOCUS="architecture,patterns,complexity" | |
| VERBOSE="true" | |
| elif echo "$SAFE_COMMENT" | grep -qiE "(^|\s)@?codebot\s+security"; then | |
| MODE="security" | |
| FOCUS="security,vulnerabilities,compliance" | |
| VERBOSE="true" | |
| elif echo "$SAFE_COMMENT" | grep -qiE "(^|\s)@?codebot\s+performance"; then | |
| MODE="performance" | |
| FOCUS="performance,optimization,bottlenecks" | |
| VERBOSE="true" | |
| elif echo "$SAFE_COMMENT" | grep -qiE "(^|\s)@?codebot\s+review"; then | |
| MODE="review" | |
| FOCUS="code-quality,security,performance" | |
| VERBOSE="true" | |
| elif echo "$SAFE_COMMENT" | grep -qiE "(^|\s)@?codebot\s+hunt"; then | |
| MODE="hunt" | |
| FOCUS="bugs,security,performance" | |
| VERBOSE="false" | |
| fi | |
| # Check for --full flag | |
| if echo "$SAFE_COMMENT" | grep -qiE -- "--full"; then | |
| FULL_ANALYSIS="true" | |
| fi | |
| echo "Parsed mode: $MODE" | |
| echo "Full analysis: $FULL_ANALYSIS" | |
| echo "Focus areas: $FOCUS" | |
| echo "Verbose: $VERBOSE" | |
| # Set outputs | |
| echo "mode=$MODE" >> $GITHUB_OUTPUT | |
| echo "full_analysis=$FULL_ANALYSIS" >> $GITHUB_OUTPUT | |
| echo "focus=$FOCUS" >> $GITHUB_OUTPUT | |
| echo "verbose=$VERBOSE" >> $GITHUB_OUTPUT | |
| - name: Run Claude Code | |
| id: claude | |
| # Pin to specific version for supply chain security | |
| uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read | |
| # MCP configuration is passed through claude_args for claude-code-action v1.0.74+. | |
| # Required tool permissions for GitHub commenting (v1.0 format). | |
| # Keep Bash tool patterns free of spaces; claude-code-action parses | |
| # claude_args shell-style, so patterns like Bash(gh pr comment:*) are | |
| # split into invalid tool names and prevent codebot from commenting. | |
| # Task: enables subagent invocation | Read/Grep/Glob: enables code examination | |
| # mcp__github_comment__*: enables GitHub comment posting | mcp__github_ci__*: enables CI status checks | |
| claude_args: '--model claude-sonnet-4-6 --mcp-config ${{ github.workspace }}/.github/claude-mcp-config.json --allowedTools Task,Read,Grep,Glob,Bash(gh:*),mcp__github_comment__*,mcp__github_ci__*,mcp__terraform-server__get_provider_details,mcp__terraform-server__search_providers,mcp__terraform-server__search_modules,mcp__terraform-server__get_module_details,mcp__context7__resolve-library-id,mcp__context7__get-library-docs' | |
| # Set trigger phrase for codebot mentions | |
| trigger_phrase: "codebot" | |
| # Dynamic prompt based on parsed mode | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }} | |
| COMMENT: ${{ github.event.comment.body }} | |
| 🤖 **CODEBOT ${{ steps.parse-command.outputs.mode || 'HUNT' }} MODE** - Terraform AWS Cognito User Pool Module | |
| **Review Configuration:** | |
| - **Mode**: ${{ steps.parse-command.outputs.mode || 'hunt' }} | |
| - **Focus Areas**: ${{ steps.parse-command.outputs.focus || 'bugs,security,performance' }} | |
| - **Full Analysis**: ${{ steps.parse-command.outputs.full_analysis || 'false' }} | |
| - **Verbose Output**: ${{ steps.parse-command.outputs.verbose || 'false' }} | |
| --- | |
| ${{ steps.parse-command.outputs.mode == 'hunt' && ' | |
| 🕵️ **BUG HUNT MODE** - Find potential issues quickly: | |
| - Focus on critical bugs, security vulnerabilities, and performance issues | |
| - **IMPORTANT: Use Read tool to examine full file context before making claims** | |
| - **VERIFY findings using MCP documentation tools before marking as CRITICAL** | |
| - **Delegate to appropriate subagents using @mentions for specialized analysis** | |
| - Prioritize high-impact problems over style suggestions | |
| - Be concise and actionable in your feedback | |
| - Look for common Terraform and AWS Cognito pitfalls | |
| - **Include confidence level (High/Medium/Low) for each finding** | |
| **Subagent Routing:** | |
| - Use @terraform-cognito for Cognito User Pool configuration issues | |
| - Use @terraform-security for security vulnerabilities and hardening | |
| - Use @terraform-testing for test-related improvements | |
| ' || '' }} | |
| ${{ steps.parse-command.outputs.mode == 'analyze' && ' | |
| 📊 **ANALYSIS MODE** - Deep technical analysis: | |
| - Analyze architecture, patterns, and design decisions | |
| - Evaluate code complexity and maintainability | |
| - Assess Terraform module structure and best practices | |
| - Consider long-term implications and scalability | |
| - Review variable validation and output design | |
| **Subagent Routing:** | |
| - Use @terraform-cognito for architecture and design decisions | |
| - Use @terraform-testing for test coverage and quality analysis | |
| - Use @module-documentation for documentation improvements | |
| ' || '' }} | |
| ${{ steps.parse-command.outputs.mode == 'security' && ' | |
| 🔒 **SECURITY MODE** - Security-focused review: | |
| - Identify security vulnerabilities and compliance issues | |
| - Review AWS Cognito security configurations (MFA, password policies, etc.) | |
| - Check for proper authentication and authorization patterns | |
| - Validate input sanitization and validation logic | |
| - Assess data protection and privacy concerns | |
| - Review IAM permissions and principle of least privilege | |
| **Subagent Routing:** | |
| - Use @terraform-security for comprehensive security analysis and hardening recommendations | |
| - Use @terraform-cognito for Cognito-specific security features | |
| ' || '' }} | |
| ${{ steps.parse-command.outputs.mode == 'performance' && ' | |
| ⚡ **PERFORMANCE MODE** - Performance optimization review: | |
| - Identify performance bottlenecks and optimization opportunities | |
| - Analyze Terraform resource efficiency and cost implications | |
| - Review AWS Cognito configuration for optimal performance | |
| - Check for unnecessary resource allocations | |
| - Consider scaling patterns and load considerations | |
| - Review caching strategies and connection pooling | |
| **Subagent Routing:** | |
| - Use @terraform-cognito for Cognito performance optimization | |
| - Use @terraform-testing for performance testing recommendations | |
| - Use @terraform-cost-optimizer for cost optimization suggestions | |
| ' || '' }} | |
| ${{ steps.parse-command.outputs.mode == 'review' && ' | |
| 📝 **COMPREHENSIVE REVIEW MODE** - Full code review: | |
| - Code quality and adherence to best practices | |
| - Potential bugs and edge cases | |
| - Performance considerations and optimizations | |
| - Security concerns and vulnerability assessment | |
| - Documentation quality and completeness | |
| - Test coverage and validation | |
| **Focus Areas**: ${{ steps.parse-command.outputs.focus }} | |
| **Subagent Routing:** | |
| - Use @terraform-cognito for Cognito User Pool configurations and features | |
| - Use @terraform-security for security analysis and compliance | |
| - Use @terraform-testing for test development and validation | |
| - Use @module-documentation for documentation and examples | |
| - Use @cognito-migration for upgrade and migration guidance | |
| ' || '' }} | |
| **Analysis Scope:** | |
| ${{ steps.parse-command.outputs.full_analysis == 'true' && ' | |
| 🔍 **FULL CODEBASE ANALYSIS** - Analyzing entire repository for comprehensive review. | |
| ' || ' | |
| 🎯 **PR CHANGES FOCUS** - Analyzing only the files changed in this pull request for targeted review. | |
| ' }} | |
| **Available Subagents:** | |
| - **@terraform-cognito**: Cognito User Pool configurations, MFA, security features, authentication flows | |
| - **@terraform-security**: Security analysis, compliance, vulnerability assessment, hardening | |
| - **@terraform-testing**: Terratest, test development, validation, CI/CD testing | |
| - **@cognito-migration**: Upgrades, version transitions, breaking changes, migration guidance | |
| - **@module-documentation**: Documentation, examples, README updates, user guides | |
| Always leverage the specialized knowledge in these subagents for better, more accurate responses. | |
| --- | |
| **Analysis Guidelines - MUST FOLLOW:** | |
| 1. **Read Before Analyzing**: Always use Read tool to examine full file context, not just diffs | |
| 2. **Verify Claims**: Check AWS/Terraform documentation via MCP tools before declaring issues as CRITICAL | |
| 3. **Use Subagents**: Delegate specialized work to appropriate @subagent (e.g., @terraform-security for security analysis) | |
| 4. **Confidence Levels**: Label each finding as High/Medium/Low confidence based on verification depth | |
| 5. **Distinguish Severity**: Separate definite bugs from potential concerns or style suggestions | |
| 6. **Context Matters**: Understand AWS auto-managed fields vs user-configured values before flagging drift | |
| 7. **Established Patterns**: Check git history for similar accepted patterns before flagging as issues | |
| --- | |
| **CRITICAL FINAL INSTRUCTION**: After completing your analysis, post your complete findings as a comment on this pull request using the GitHub commenting tools available to you. |