SK: 2832 Added Claude Code setup for Java #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude PR Review | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'src/**/*.java' | |
| permissions: | |
| pull-requests: write | |
| contents: read | |
| jobs: | |
| sdk-patterns-review: | |
| name: SDK Patterns & Naming Review | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Claude CLI | |
| run: npm install -g @anthropic-ai/claude-code | |
| - name: Get changed Java files | |
| id: changed-files | |
| run: | | |
| FILES=$(git diff --name-only origin/${{ github.base_ref }}...${{ github.sha }} \ | |
| | grep '\.java$' \ | |
| | grep -v 'generated' \ | |
| | tr '\n' ' ') | |
| echo "files=$FILES" >> $GITHUB_OUTPUT | |
| - name: Run SDK patterns review | |
| if: steps.changed-files.outputs.files != '' | |
| id: review | |
| continue-on-error: true | |
| env: | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| run: | | |
| FILES="${{ steps.changed-files.outputs.files }}" | |
| REVIEW=$(claude --print --model claude-sonnet-4-5 -p " | |
| You are a senior engineer reviewing the Skyflow Java SDK. | |
| Review the following changed Java files for SDK pattern violations: | |
| 1. Request/Response/Options patterns — builders are data holders, validation in Validations.java only | |
| 2. Error handling — all public methods throw SkyflowException, no swallowed exceptions, no bare println/printStackTrace | |
| 3. Naming — acronyms as words (skyflowId not skyflowID, tokenUri not tokenURI); UPPER_SNAKE constants; PascalCase classes | |
| 4. Response normalisation — skyflowId not skyflow_id in response maps; getErrors() present on every response class | |
| 5. Code quality — no magic strings (use Constants), no @SuppressWarnings without comment, deprecation via LogUtil.printWarningLog | |
| Skip src/main/java/com/skyflow/generated/ entirely. | |
| Files to review: $FILES | |
| For each file with findings, produce a markdown table: | |
| | Severity | Line | Finding | | |
| Severities: Critical (data loss/security), Bug (wrong behaviour), Quality (naming/patterns). | |
| Skip Info-level observations. If no findings for a file, omit it. | |
| If no findings at all, write: 'No issues found.' | |
| End with one of: APPROVE / APPROVE WITH FIXES / REQUEST CHANGES | |
| ") | |
| echo "result<<EOF" >> $GITHUB_OUTPUT | |
| echo "$REVIEW" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Post review comment | |
| if: steps.changed-files.outputs.files != '' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const review = `${{ steps.review.outputs.result }}`; | |
| const files = `${{ steps.changed-files.outputs.files }}`; | |
| await github.rest.issues.createComment({ | |
| ...context.repo, | |
| issue_number: context.payload.pull_request.number, | |
| body: `## Claude SDK Patterns Review\n\n${review}\n\n---\n_Files reviewed: \`${files}\`_` | |
| }); | |
| security-review: | |
| name: Security Review (serviceaccount changes) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for serviceaccount changes | |
| id: filter | |
| uses: dorny/paths-filter@v3 | |
| with: | |
| filters: | | |
| serviceaccount: | |
| - 'src/**/serviceaccount/**/*.java' | |
| - name: Install Claude CLI | |
| if: steps.filter.outputs.serviceaccount == 'true' | |
| run: npm install -g @anthropic-ai/claude-code | |
| - name: Get changed serviceaccount files | |
| if: steps.filter.outputs.serviceaccount == 'true' | |
| id: sa-files | |
| run: | | |
| FILES=$(git diff --name-only origin/${{ github.base_ref }}...${{ github.sha }} \ | |
| | grep 'serviceaccount' \ | |
| | grep '\.java$' \ | |
| | tr '\n' ' ') | |
| echo "files=$FILES" >> $GITHUB_OUTPUT | |
| - name: Run security audit | |
| if: steps.filter.outputs.serviceaccount == 'true' && steps.sa-files.outputs.files != '' | |
| id: security | |
| continue-on-error: true | |
| env: | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| run: | | |
| FILES="${{ steps.sa-files.outputs.files }}" | |
| AUDIT=$(claude --print --model claude-sonnet-4-5 -p " | |
| You are a security engineer auditing the Skyflow Java SDK serviceaccount module. | |
| Audit the following files for: | |
| 1. Credential and token exposure — bearer tokens, API keys, private keys must never appear in logs, error messages, or toString() output | |
| 2. Path traversal — file paths passed to new File(path) must not allow ../ | |
| 3. JSON parsing — JsonParser calls must be wrapped in try/catch for JsonSyntaxException | |
| 4. HTTP security — all API calls must be HTTPS; Authorization headers must not be logged at any level | |
| 5. Token lifecycle — bearer token caching must check expiry before reuse; token refresh must be thread-safe | |
| Files: $FILES | |
| For each finding: | |
| **Severity:** Critical / High / Medium / Low | |
| **File:Line:** path:N | |
| **Risk:** one sentence | |
| **Fix:** one concrete sentence | |
| If no findings, write: 'No security issues found.' | |
| End with overall risk rating: LOW / MEDIUM / HIGH / CRITICAL | |
| ") | |
| echo "result<<EOF" >> $GITHUB_OUTPUT | |
| echo "$AUDIT" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Post security comment | |
| if: steps.filter.outputs.serviceaccount == 'true' && steps.sa-files.outputs.files != '' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const audit = `${{ steps.security.outputs.result }}`; | |
| const files = `${{ steps.sa-files.outputs.files }}`; | |
| await github.rest.issues.createComment({ | |
| ...context.repo, | |
| issue_number: context.payload.pull_request.number, | |
| body: `## Claude Security Audit (serviceaccount)\n\n${audit}\n\n---\n_Files audited: \`${files}\`_` | |
| }); |