Skip to content

Commit f35914a

Browse files
theMickstertheMickster
authored
Implement reusable Claude code review and response workflow (#1359)
1 parent 068eed1 commit f35914a

File tree

5 files changed

+205
-0
lines changed

5 files changed

+205
-0
lines changed

‎.claude/CLAUDE.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Bitwarden Secrets Manager SDK
2+
3+
## Crates
4+
5+
The project is structured as a monorepo using cargo workspaces. Some of the more noteworthy crates
6+
are:
7+
8+
- [`bitwarden`](./crates/bitwarden/): Rust-friendly API for interacting with the secrets manager.
9+
- [`bitwarden-c`](./crates/bitwarden-c/): C bindings for FFI interop.
10+
- [`bitwarden-json`](./crates/bitwarden-json/): JSON wrapper around the `bitwarden` crate. Powers
11+
the other language bindings.
12+
- [`bitwarden-napi`](./crates/bitwarden-napi/): Node-API bindings for Node.js/TypeScript.
13+
- [`bitwarden-wasm`](./crates/bitwarden-wasm/): WebAssembly bindings.
14+
- [`bws`](./crates/bws/): CLI for interacting with the [Bitwarden Secrets Manager][secrets-manager].
15+
Review the [CLI documentation][bws-help].
16+
- [`sdk-schemas`](./crates/sdk-schemas/): Generator for the _json schemas_.
17+
- [`fake-server`](./crates/fake-server/): Development/testing server that emulates Bitwarden API
18+
endpoints for local testing without a real server instance.
19+
20+
### Language Bindings
21+
22+
The SDK provides bindings in the `/languages/` directory: C++, C#, Go, Java, JavaScript/TypeScript,
23+
PHP, Python, and Ruby. All bindings share a consistent API for projects and secrets management.
24+
25+
## Schemas
26+
27+
To minimize the amount of work required to support additional bindings the project is structured
28+
around a `json` based API, beginning with every binding only needing to implement one method, namely
29+
a `run_command`. Additional work may be required to implement other functions, like a `free` command
30+
for languages that require manual memory management. Additional language-specific implementation
31+
details will apply based on the language.
32+
33+
To ensure type safety in the API, _json schemas_ are generated from the rust structs in `bitwarden`
34+
using [schemars](https://crates.io/crates/schemars). The _json schemas_ are later used to generate
35+
the API bindings for each language using [QuickType](https://github.com/quicktype/quicktype).
36+
37+
```bash
38+
npm run schemas
39+
```
40+
41+
## Key Concepts
42+
43+
### Architecture
44+
45+
The SDK uses a **layered architecture** to support multiple languages efficiently:
46+
47+
1. **Core Layer**: External Rust dependencies from
48+
[sdk-internal](https://github.com/bitwarden/sdk-internal) repository contain the core business
49+
logic and cryptography. The `Cargo.toml` file **must** be inspected for these dependencies.
50+
2. **Public API Layer**: The public `bitwarden` crate provides the Rust API.
51+
3. **JSON API Layer**: `bitwarden-json` wraps the Rust API with a single `run_command` method.
52+
4. **Language Bindings**: All language bindings call `run_command` with JSON requests/responses.
53+
54+
This architecture means adding a new language or updating the API requires minimal per-language
55+
work, as the heavy lifting is done in Rust and exposed via JSON schemas.
56+
57+
### Authentication
58+
59+
The SDK uses **access tokens** for authentication. All language bindings provide an authentication
60+
method (named according to each language's conventions, such as `login_access_token`,
61+
`accessTokenLogin`, or `LoginAccessToken`) to authenticate with the Secrets Manager API.
62+
63+
### State Files
64+
65+
The SDK supports optional **state files** for caching, improving performance by avoiding
66+
re-authentication. State files can be specified when calling the authentication method or omitted by
67+
passing `None`/`null`.
68+
69+
### Feature Flags
70+
71+
Key feature flags include:
72+
73+
- `secrets` (default): Enables Secrets Manager API
74+
- `no-memory-hardening`: Disables memory security hardening features
75+
- `wasm`: Enables WebAssembly support
76+
77+
## Development Workflows
78+
79+
### Generating Schemas
80+
81+
When you modify the Rust API structs, regenerate the JSON schemas and language bindings:
82+
83+
```bash
84+
npm run schemas
85+
```
86+
87+
This generates JSON schemas from Rust structs and updates all language binding code using QuickType.
88+
89+
### Local Testing with Fake Server
90+
91+
Use the `fake-server` crate to test locally without a real Bitwarden instance:
92+
93+
```bash
94+
cargo run -p fake-server
95+
# Then use bws or other clients against http://localhost:3000 (default port)
96+
```
97+
98+
The fake server provides minimal CRUD operations for secrets and projects.
99+
100+
### Building Language Bindings
101+
102+
- **Python**: Requires Python 3 and `maturin` (`pip install maturin`)
103+
- **Node.js**: Uses `napi-rs` for native addons
104+
- **WebAssembly**: Requires `wasm32-unknown-unknown` target and `wasm-bindgen-cli`
105+
106+
### Code Quality
107+
108+
- **Formatting**: Requires nightly toolchain: `cargo +nightly fmt`
109+
- **Linting**: `cargo clippy --all-features --tests` (workspace lints deny unwrap_used and
110+
unused_async)
111+
- **MSRV**: Minimum Supported Rust Version is 1.85
112+
113+
## References
114+
115+
- [SDK Architecture](https://contributing.bitwarden.com/architecture/sdk/secrets-manager/)
116+
- [Secrets Manager SDK Documentation](https://bitwarden.com/help/secrets-manager-sdk/)
117+
- [Secrets Manager CLI Documentation](https://bitwarden.com/help/secrets-manager-cli/)
118+
- [Secrets Manager Overview](https://bitwarden.com/help/secrets-manager-overview/)
119+
- [Architectural Decision Records (ADRs)](https://contributing.bitwarden.com/architecture/adr/)
120+
- [Contributing Guidelines](https://contributing.bitwarden.com/contributing/)
121+
- [Setup Guide](https://contributing.bitwarden.com/getting-started/sdk/secrets-manager/)
122+
- [Code Style](https://contributing.bitwarden.com/contributing/code-style/)
123+
- [Security Whitepaper](https://bitwarden.com/help/bitwarden-security-white-paper/)
124+
- [Security Definitions](https://contributing.bitwarden.com/architecture/security/definitions)

‎.claude/prompts/review-code.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
Please review this pull request with a focus on:
2+
3+
- Code quality and best practices
4+
- Potential bugs or issues
5+
- Security implications
6+
- Performance considerations
7+
8+
Note: The PR branch is already checked out in the current working directory.
9+
10+
Provide a comprehensive review including:
11+
12+
- Summary of changes since last review
13+
- Critical issues found (be thorough)
14+
- Suggested improvements (be thorough)
15+
- Good practices observed (be concise - list only the most notable items without elaboration)
16+
- Action items for the author
17+
- Leverage collapsible <details> sections where appropriate for lengthy explanations or code
18+
snippets to enhance human readability
19+
20+
When reviewing subsequent commits:
21+
22+
- Track status of previously identified issues (fixed/unfixed/reopened)
23+
- Identify NEW problems introduced since last review
24+
- Note if fixes introduced new issues
25+
26+
IMPORTANT: Be comprehensive about issues and improvements. For good practices, be brief - just note
27+
what was done well without explaining why or praising excessively.

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,8 @@ crates/bws/scripts/install.sh
2424
**/.dockerignore @bitwarden/team-appsec @bitwarden/dept-bre
2525
**/docker-compose.yml @bitwarden/team-appsec @bitwarden/dept-bre
2626
**/entrypoint.sh @bitwarden/team-appsec @bitwarden/dept-bre
27+
28+
# Claude related files
29+
.claude/ @bitwarden/team-ai-sme
30+
.github/workflows/respond.yml @bitwarden/team-ai-sme
31+
.github/workflows/review-code.yml @bitwarden/team-ai-sme

‎.github/workflows/respond.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Respond
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
pull_request_review_comment:
7+
types: [created]
8+
issues:
9+
types: [opened, assigned]
10+
pull_request_review:
11+
types: [submitted]
12+
13+
permissions: {}
14+
15+
jobs:
16+
respond:
17+
name: Respond
18+
uses: bitwarden/gh-actions/.github/workflows/_respond.yml@main
19+
secrets:
20+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
21+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
22+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
23+
permissions:
24+
actions: read
25+
contents: write
26+
id-token: write
27+
issues: write
28+
pull-requests: write

‎.github/workflows/review-code.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Code Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
7+
permissions: {}
8+
9+
jobs:
10+
review:
11+
name: Review
12+
uses: bitwarden/gh-actions/.github/workflows/_review-code.yml@main
13+
secrets:
14+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
15+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
16+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
17+
permissions:
18+
actions: read
19+
contents: read
20+
id-token: write
21+
pull-requests: write

0 commit comments

Comments
 (0)