feat(workflow): add review workflow helper scripts by NTCoding · Pull Request #92 · NTCoding/living-architecture

NTCoding · 2026-01-09T20:55:39Z

User description

Summary

Add 4 utility scripts to streamline code review workflow operations
Refactor agent commands to use these helper scripts for consistency
Remove redundant code in favor of reusable script utilities

Test plan

Verify all scripts are executable and follow shell conventions
Ensure agents can use these scripts during task completion workflow
Confirm code review process runs successfully with new helpers

Generated with Claude Code

PR Type

Enhancement

Description

Add 4 utility scripts for code review workflow operations
Refactor agent commands to use helper scripts for consistency
Remove redundant inline git commands in favor of reusable utilities
Simplify permissions configuration by removing unused script allowlist

Diagram Walkthrough

flowchart LR
  A["Agent Commands"] -->|"refactored to use"| B["Helper Scripts"]
  B --> C["get-changed-files.sh"]
  B --> D["get-issue-number.sh"]
  B --> E["setup-review-dir.sh"]
  B --> F["write-review.sh"]
  C -->|"lists changed files"| G["Code Review Agent"]
  D -->|"extracts issue number"| H["Task Completion"]
  E -->|"creates review directory"| H
  F -->|"writes review content"| H

File Walkthrough

Relevant files

Enhancement

get-changed-files.sh `List changed and untracked files with filtering` scripts/get-changed-files.sh New script that lists all changed and untracked files from git Supports optional `--filter` parameter for regex pattern matching Combines `git diff --name-only HEAD` and `git ls-files --others` `--exclude-standard` Follows bash best practices with `set -euo pipefail`	+30/-0
get-issue-number.sh `Extract issue number from branch name` scripts/get-issue-number.sh New script that extracts issue number from current branch name Searches for `issue-` pattern in branch name Returns only the numeric portion of the issue identifier Returns empty string if no issue number found	+9/-0
setup-review-dir.sh `Create review directory for current branch` scripts/setup-review-dir.sh New script that creates reviews directory structure for current branch Gets current branch name and creates `reviews//` directory Outputs branch name for use in other commands Consolidates directory setup logic into reusable utility	+10/-0
write-review.sh `Write review content to file from stdin` scripts/write-review.sh New script that writes stdin content to a review file Takes relative path as argument and creates parent directories as needed Reads content from stdin and writes to `reviews/` Provides helpful usage examples and error messages	+17/-0
bug-scanner.md `Refactor to use get-changed-files helper script` .claude/agents/bug-scanner.md Replace inline git command with `./scripts/get-changed-files.sh` call Simplifies file listing logic by delegating to helper script Maintains same functionality with cleaner command	+1/-1
code-review.md `Refactor to use filtered get-changed-files script` .claude/agents/code-review.md Replace inline git command with `./scripts/get-changed-files.sh` `--filter` call Add file type filtering for TypeScript and shell files directly in script call Remove redundant documentation about git command components Simplify instructions by delegating filtering to helper script	+2/-7
complete-task.md `Refactor task completion to use helper scripts` .claude/commands/complete-task.md Replace inline branch setup commands with `./scripts/setup-review-dir.sh` call Replace inline issue number extraction with `./scripts/get-issue-number.sh` call Consolidate multiple git commands into single helper script invocations Improve readability and maintainability of task completion workflow	+2/-3

Configuration changes

settings.json `Remove unused script permissions allowlist` .claude/settings.json Remove `allow` permissions array that referenced `submit-pr.sh` script Simplify permissions configuration by removing unused script allowlist Keep `deny` permissions for protected configuration files	+0/-3

Summary by CodeRabbit

Refactor
- Updated configuration files to use dedicated utility scripts instead of inline commands.
Chores
- Added new utility scripts supporting automated file operations, metadata extraction, and workflow management.
- Modified internal permission settings.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Add utility scripts to streamline the code review workflow process. These scripts encapsulate common operations used by agents during task completion. Co-Authored-By: Claude Opus 4.5 <[email protected]>

coderabbitai · 2026-01-09T20:55:49Z

📝 Walkthrough

Walkthrough

This pull request extracts common inline Git and shell commands from agent documentation and complete-task workflows into dedicated utility scripts. Four new scripts are added for retrieving changed files, extracting issue numbers, setting up review directories, and writing review files. A permissions rule is removed from settings.json.

Changes

Cohort / File(s)	Summary
Agent & Command Documentation Updates `.claude/agents/bug-scanner.md`, `.claude/agents/code-review.md`, `.claude/commands/complete-task.md`	Replaces inline `git diff`, `git ls-files`, `git branch`, and `grep` commands with calls to dedicated utility scripts (`get-changed-files.sh`, `get-issue-number.sh`, `setup-review-dir.sh`). Conditional behavior and filtering logic preserved.
Configuration Changes `.claude/settings.json`	Removes the `permissions.allow` rule that previously permitted execution of `./scripts/submit-pr.sh`. Deny rules remain unchanged.
New Utility Scripts `scripts/get-changed-files.sh`, `scripts/get-issue-number.sh`, `scripts/setup-review-dir.sh`, `scripts/write-review.sh`	Introduces four new Bash utility scripts with strict error handling (`set -euo pipefail`). Each encapsulates a specific operation: collecting changed/untracked files with optional filtering, extracting issue numbers from branch names, creating per-branch review directories, and writing stdin to review files.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

feat(complete-task): implement parallel review pipeline with bug-scanner #85 — Directly modifies the same agent docs and complete-task workflow files with script-based replacements.
feat: integrate /code-review command into /complete-task pipeline #29 — Modifies how changed files are discovered and filtered in the code-review and complete-task workflows.
chore: add lint rules and code review patterns from PR feedback #62 — Updates the code-review agent's file-filter logic to include shell scripts (same area affected by this PR's changes).

Suggested labels

refactoring, scripts, automation

Poem

🐰 Hop, hop, scripts align,
Git commands now refine,
Utility scripts in place,
Cleaner workflows embrace! ✨

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main change: adding review workflow helper scripts. It is specific, concise, and directly reflects the core objective.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

qodo-code-review · 2026-01-09T20:56:14Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🔴	Path traversal write Description: The script writes stdin to `reviews/$1` without validating that stays within `reviews/`, enabling path traversal (e.g., `../../.ssh/authorized_keys`) and arbitrary file overwrite when invoked with attacker-controlled input. write-review.sh [14-16] Referred Code REVIEW_PATH="reviews/$1" mkdir -p "$(dirname "$REVIEW_PATH")" cat > "$REVIEW_PATH"
⚪	Unsafe path construction Description: The script uses the current git branch name directly in a filesystem path (`mkdir -p` `"reviews/$BRANCH"`), which could create unexpected directories or potentially write outside intended structure if branch naming constraints are bypassed or if unusual ref names are present. setup-review-dir.sh [8-9] Referred Code BRANCH=$(git branch --show-current) mkdir -p "reviews/$BRANCH"
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
🔴	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Missing arg validation: The `--filter` option blindly reads `$2` and shifts by 2 without checking it exists, which can hard-fail under `set -euo pipefail` and provides no actionable error message. Referred Code while [[ $# -gt 0 ]]; do case $1 in --filter) FILTER="$2" shift 2 ;; *) echo "Unknown option: $1" >&2 exit 1 ;; esac done Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Path traversal risk: The script writes to `reviews/$1` without validating that `<relative-path>` cannot include `../` sequences, enabling writes outside the intended `reviews/` directory. Referred Code if [[ $# -lt 1 ]]; then echo "Usage: $0 <relative-path>" >&2 echo "Example: echo 'content' \| $0 'issue-44/code-review.md'" >&2 exit 1 fi REVIEW_PATH="reviews/$1" mkdir -p "$(dirname "$REVIEW_PATH")" cat > "$REVIEW_PATH" Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

sonarqubecloud · 2026-01-09T20:56:45Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

qodo-code-review · 2026-01-09T20:57:26Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Prevent path traversal security vulnerability Prevent a path traversal vulnerability by resolving the real path of the destination file and verifying it resides within the `reviews/` directory before writing. scripts/write-review.sh [14-17] REVIEW_PATH="reviews/$1" + +# Create parent directory first to allow realpath to resolve it mkdir -p "$(dirname "$REVIEW_PATH")" -cat > "$REVIEW_PATH" -echo "Wrote: $REVIEW_PATH" +# Resolve the absolute path +ABSOLUTE_PATH=$(realpath "$REVIEW_PATH") +REVIEWS_DIR=$(realpath "reviews") + +# Check if the resolved path is within the reviews directory +if [[ "$ABSOLUTE_PATH" != "$REVIEWS_DIR"* ]]; then + echo "Error: Invalid path. Attempted to write outside of reviews/ directory." >&2 + exit 1 +fi + +cat > "$ABSOLUTE_PATH" +echo "Wrote: $ABSOLUTE_PATH" + Apply / Chat Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies and fixes a critical path traversal security vulnerability in the new `write-review.sh` script.	High
Possible issue	Add missing validation for script arguments Add a check to ensure the `--filter` option is provided with an argument, preventing a script crash on incorrect usage. scripts/get-changed-files.sh [10-21] while [[ $# -gt 0 ]]; do case $1 in --filter) + if [[ -z "${2-}" ]]; then + echo "Error: --filter requires an argument" >&2 + exit 1 + fi FILTER="$2" shift 2 ;; ) echo "Unknown option: $1" >&2 exit 1 ;; esac done Apply / Chat* Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies a bug where the script would crash if the `--filter` option is used without an argument, and provides a robust fix.	Medium
Possible issue	Sanitize branch directory names Sanitize branch names by replacing `/` with `_` to prevent unintended nested directory creation. scripts/setup-review-dir.sh [8-10] BRANCH=$(git branch --show-current) -mkdir -p "reviews/$BRANCH" -echo "$BRANCH" +SAFE_BRANCH=${BRANCH//\//_} +mkdir -p "reviews/$SAFE_BRANCH" +echo "$SAFE_BRANCH" Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies that branch names containing `/` will create nested directories, which is likely unintended behavior, and provides a correct fix.	Medium
High-level	Remove the unused helper script The PR adds the `scripts/write-review.sh` script, but it is not utilized in any of the refactored files. It is suggested to remove this unused script to prevent code clutter and future maintenance overhead. Examples: scripts/write-review.sh [1-17] #!/bin/bash # Writes content from stdin to a review file # Usage: echo "content" \| ./scripts/write-review.sh <relative-path> # Example: ./scripts/write-review.sh "issue-44/code-review.md" < content.md set -euo pipefail if [[ $# -lt 1 ]]; then echo "Usage: $0 <relative-path>" >&2 echo "Example: echo 'content' \| $0 'issue-44/code-review.md'" >&2 ... (clipped 7 lines) Solution Walkthrough: Before: // file: scripts/write-review.sh #!/bin/bash # Writes content from stdin to a review file # Usage: echo "content" \| ./scripts/write-review.sh <relative-path> set -euo pipefail if [[ $# -lt 1 ]]; then echo "Usage: $0 <relative-path>" >&2 exit 1 fi REVIEW_PATH="reviews/$1" mkdir -p "$(dirname "$REVIEW_PATH")" cat > "$REVIEW_PATH" After: // file: scripts/write-review.sh (file is deleted) Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that the new script `scripts/write-review.sh` is introduced but not used anywhere in the PR, which adds unnecessary code and maintenance overhead.	Low
General	Use env-based shebang Use `#!/usr/bin/env bash` instead of `#!/bin/bash` for improved script portability. scripts/get-changed-files.sh [1] -#!/bin/bash +#!/usr/bin/env bash Apply / Chat Suggestion importance[1-10]: 3 __ Why: This is a valid best practice for script portability, but it has a minor impact as `#!/bin/bash` is standard on most systems where this project is likely to run.	Low
More

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @scripts/setup-review-dir.sh:
- Around line 8-10: The script uses BRANCH=$(git branch --show-current) and then
mkdir -p "reviews/$BRANCH" which will create a wrong directory when BRANCH is
empty (detached HEAD); detect if BRANCH is empty after the git command and exit
with a non-zero status and a clear error message (e.g., "Detached HEAD or no
branch detected: aborting") instead of proceeding to mkdir, ensuring downstream
code never receives an empty BRANCH variable.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d749d63 and 3ad2a7e.

📒 Files selected for processing (8)

.claude/agents/bug-scanner.md
.claude/agents/code-review.md
.claude/commands/complete-task.md
.claude/settings.json
scripts/get-changed-files.sh
scripts/get-issue-number.sh
scripts/setup-review-dir.sh
scripts/write-review.sh

💤 Files with no reviewable changes (1)

.claude/settings.json

🧰 Additional context used

🧠 Learnings (5)

📓 Common learnings

Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-09T18:58:21.008Z
Learning: Always use scripts in `./scripts/` for git and GitHub operations (PRs, issues, tasks). Do not use `gh` or `git` commands directly unless no script exists. If you need functionality that doesn't have a script, propose creating one

📚 Learning: 2026-01-06T18:02:51.422Z

Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/get-pr-feedback.sh:45-55
Timestamp: 2026-01-06T18:02:51.422Z
Learning: In shell scripts that call GraphQL APIs (e.g., scripts/get-pr-feedback.sh and similar), prefer using sed-based interpolation for GraphQL variables instead of gh api graphql's -f/-F flags. Rationale: sed-based interpolation is typically simpler and more robust in Bash contexts, avoids JSON encoding pitfalls, and keeps the script portable. Implement by building the GraphQL query as a string and substituting variables with sed or parameter expansion, ensuring proper escaping. If you must use -f/-F, provide clear justification in a comment.

Applied to files:

scripts/get-changed-files.sh
scripts/get-issue-number.sh
scripts/write-review.sh
scripts/setup-review-dir.sh

📚 Learning: 2026-01-06T18:13:47.289Z

Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:47.289Z
Learning: In shell scripts across the repository (e.g., scripts/reply-to-thread.sh), keep the code simple by not adding explicit preflight tool-availability checks for external commands (like gh or jq) when those tools would fail on first use anyway. Such checks add boilerplate without changing behavior. If you must guard against missing tools, prefer a minimal, early startup check or rely on the script failing naturally at the point of use.

Applied to files:

scripts/get-changed-files.sh
scripts/get-issue-number.sh
scripts/write-review.sh
scripts/setup-review-dir.sh

📚 Learning: 2026-01-09T18:10:15.724Z

Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 85
File: .claude/commands/post-merge-completion.md:35-39
Timestamp: 2026-01-09T18:10:15.724Z
Learning: In .claude/commands/post-merge-completion.md, the review files in `reviews/<branch>/` (code-review.md, bug-scanner.md, task-check.md, doc-suggestions.md) are optional inputs to the reflection process. The post-merge-completion command should work gracefully even if these files are missing or if /complete-task wasn't run before merging.

Applied to files:

.claude/commands/complete-task.md
.claude/agents/bug-scanner.md
.claude/agents/code-review.md

📚 Learning: 2026-01-07T08:54:48.071Z

Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.{ts,tsx,js,jsx} : Review usage of `/* v8 ignore next -- preserve */` coverage skip directives. This is only acceptable for unreachable code needed to satisfy the compiler. Most cases should be solved by extracting code or writing tests to mock behavior.

Applied to files:

.claude/agents/code-review.md

🔇 Additional comments (9)

.claude/agents/bug-scanner.md (1)

15-15: LGTM! Clean refactoring to use centralized script.

This change aligns with the repository pattern of using dedicated scripts for git operations rather than inline commands. Based on learnings, this is the preferred approach for consistency and maintainability.

scripts/write-review.sh (1)

1-17: LGTM! Clean stdin-to-file utility.

The script correctly:

Validates required arguments

Creates intermediate directories

Writes stdin to the target path

Provides user feedback

The implementation is straightforward and follows shell best practices.

scripts/get-changed-files.sh (1)

1-30: LGTM! Solid implementation of file enumeration utility.

The script correctly:

Parses optional --filter parameter

Combines changed (staged/unstaged) and untracked files

Applies regex filtering when requested

Uses || true to handle empty filter results gracefully with set -e

The command substitution on line 24 is appropriate for typical filenames. The implementation aligns with the documented use cases in the agent files.

.claude/agents/code-review.md (1)

21-24: LGTM! Excellent refactoring with improved clarity.

The change:

Replaces inline git commands with the new centralized script

Uses the --filter parameter to restrict to TypeScript and shell files

Simplifies the messaging about the early exit condition

This aligns with the repository learning to always use scripts in ./scripts/ for git operations. The regex filter \.(ts|tsx|sh)$ correctly matches the intended file types.

scripts/get-issue-number.sh (1)

1-9: Executable permissions confirmed for all scripts.

The implementation is clean and handles edge cases correctly (e.g., branches without issue numbers return empty string via || true). All scripts in the PR have proper executable permissions set.

.claude/commands/complete-task.md (2)

63-63: LGTM! Good refactoring to use dedicated script.

This change aligns with the codebase convention to use scripts in ./scripts/ for git operations. The script also handles directory creation, making this a clean improvement.

Based on learnings, this follows the preferred pattern of using repository scripts instead of direct git commands.

76-76: No action required. The script ./scripts/get-issue-number.sh exists in the repository and has executable permissions. The code is safe to use.

Likely an incorrect or invalid review comment.

scripts/setup-review-dir.sh (2)

6-6: LGTM! Excellent use of strict error handling.

The set -euo pipefail is the correct choice for ensuring the script fails fast on errors, undefined variables, or pipeline failures.

1-1: [rewritten comment]
[classification tag]

feat(workflow): add review workflow helper scripts

3ad2a7e

Add utility scripts to streamline the code review workflow process. These scripts encapsulate common operations used by agents during task completion. Co-Authored-By: Claude Opus 4.5 <[email protected]>

qodo-code-review Bot added the Review effort 2/5 label Jan 9, 2026

coderabbitai Bot requested changes Jan 9, 2026

View reviewed changes

Comment thread scripts/setup-review-dir.sh

coderabbitai Bot approved these changes Jan 9, 2026

View reviewed changes

NTCoding merged commit 14a37e4 into main Jan 9, 2026
18 checks passed

This was referenced Jan 10, 2026

docs(workflow): add task creation documentation to workflow #108

Merged

feat(determine-claude): changes #186

Merged

coderabbitai Bot mentioned this pull request Aug 11, 2026

feat(workflow): extract reusable dev-workflow commands #299

Merged

Navigation Menu

Repository navigation

feat(workflow): add review workflow helper scripts - #92

feat(workflow): add review workflow helper scripts#92
NTCoding merged 1 commit into
mainfrom
add-review-workflow-scripts

NTCoding commented Jan 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jan 9, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

qodo-code-review Bot commented Jan 9, 2026

Uh oh!

sonarqubecloud Bot commented Jan 9, 2026

Uh oh!

qodo-code-review Bot commented Jan 9, 2026

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

NTCoding commented Jan 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Summary

Test plan

PR Type

Description

Diagram Walkthrough

File Walkthrough

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

qodo-code-review Bot commented Jan 9, 2026

PR Compliance Guide 🔍

Uh oh!

sonarqubecloud Bot commented Jan 9, 2026

Quality Gate passed

Uh oh!

qodo-code-review Bot commented Jan 9, 2026

PR Code Suggestions ✨

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

NTCoding commented Jan 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jan 9, 2026 •

edited

Loading