Skip to content

[BRE-1830] feat(bitwarden-devops-engineer): Add naming conventions - #192

Merged
fntyler merged 8 commits into
mainfrom
bre-1830/skill-workflow-naming-conventions
Aug 14, 2026
Merged

[BRE-1830] feat(bitwarden-devops-engineer): Add naming conventions#192
fntyler merged 8 commits into
mainfrom
bre-1830/skill-workflow-naming-conventions

Conversation

@fntyler

@fntyler fntyler commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

🎟️ Tracking

BRE-1830

📔 Objective

Add a workflow-naming-conventions auditing-workflow-conventions reference skill covering the GitHub Actions naming standards that bwwl does not enforce, so audits stop relying on undocumented convention.

The skill defers to bitwarden-workflow-linter-rules for every linted rule to avoid double-reporting, and treats job ID and file renames as report-only because both are addressable identifiers.

  • Document job IDs (kebab-case), step names (Sentence case with a leading imperative verb), and workflow file names (kebab-case.yml, _ prefix when exclusively reusable)
  • Add reference-sweep procedures for job ID and filename renames, plus an advisory canonical step-name glossary
  • Bump plugin to 0.2.0 with changelog entry and README listing
  • Add greppable to the cspell dictionary

Add a `workflow-naming-conventions` reference skill covering the
GitHub Actions naming standards that `bwwl` does not enforce, so
audits stop relying on undocumented convention.

The skill defers to `bitwarden-workflow-linter-rules` for every
linted rule to avoid double-reporting, and treats job ID and file
renames as report-only because both are addressable identifiers.

* Document job IDs (kebab-case), step names (Sentence case with a
  leading imperative verb), and workflow file names
  (kebab-case.yml, `_` prefix when exclusively reusable)
* Add reference-sweep procedures for job ID and filename renames,
  plus an advisory canonical step-name glossary
* Bump plugin to 0.2.0 with changelog entry and README listing
* Add `greppable` to the cspell dictionary
@fntyler
fntyler requested a review from a team as a code owner August 10, 2026 21:15
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

Claude Configuration Validation

PR: #192 · Plugin: bitwarden-devops-engineer 0.1.5 → 0.2.0

Result: PASS — no errors. 2 warnings worth fixing before merge, 6 minor/advisory items. Manifest, version consistency across all required files, changelog format, skill rename completeness, and credential scanning all validate clean.

Section Status
1. Plugin validation Pass — 0 errors
2. Skill review Pass with warnings — 0 errors, 2 major, 5 minor
3. Config & security (CLAUDE.md, .claude/) Not applicable — no root config changed by this PR

1. Plugin Validation — plugins/bitwarden-devops-engineer

Run via the plugin-validator agent. No errors.

Verified clean:

  • Version consistency at 0.2.0 across all three applicable locations: plugins/bitwarden-devops-engineer/.claude-plugin/plugin.json:3, .claude-plugin/marketplace.json:63, and the root README.md:17 catalog row. The plugin has no agents/, so the fourth bump target in .claude/CLAUDE.md does not apply.
  • Semver correct — MINOR bump for a backward-compatible new skill. The mid-PR rename correctly did not trigger a second bump, since 0.2.0 is unreleased (main is at 0.1.5).
  • ChangelogCHANGELOG.md:8 ## [0.2.0] - 2026-08-10 in Keep a Changelog format under ### Added, updated to the new skill name.
  • Rename is complete. Git recorded a true rename (R099 skills/workflow-naming-conventions/ → skills/auditing-workflow-conventions/). A repo-wide grep for naming-conventions returns zero matches — no stale directory, orphaned files, or broken paths.
  • Cross-skill references resolve. Skill(bitwarden-devops-engineer:bitwarden-workflow-linter-rules) (SKILL.md:17) and the three ${CLAUDE_PLUGIN_ROOT}/skills/bitwarden-workflow-linter-rules/SKILL.md paths in action-audit all point at a skill that exists. Every linter rule named in the new skill (name_capitalized, name_exists, underscore_outputs, job_environment_prefix) exists in the linter-rules skill. No references/ or examples/ links to dangle.
  • Manifest — valid JSON, kebab-case name, valid semver, field set matches the other skill-only plugins in the marketplace.
  • No hardcoded credentials. The only secret-shaped hit is the benign glossary row "Retrieve secrets from AKV" at SKILL.md:101.
  • Lint — prettier and cspell pass over the plugin, marketplace.json, and the root README (9 files, 0 issues). bwwl and greppable are already in .cspell.json.
  • File organization — README present with Overview / Skills / Installation / Usage / References; no stray files, no empty directories.
  • N/A components — no commands, agents, hooks, or MCP servers in this plugin.

2. Skill Review — skills/auditing-workflow-conventions/SKILL.md

Run via the skill-reviewer agent. No errors. 1,439 words (target 1,000–3,000); valid YAML frontmatter; name matches the directory; single-file layout is appropriate at this size.

⚠️ Warning (major) — should fix before merge

W1 · SKILL.md:59, SKILL.md:82 — the body prescribes mutations the skill's own allowed-tools forbids.

Line 82: "If a rename is explicitly requested, establish the known reference set first, then use git mv". Line 59: step-name casing "is the only standard here an agent may apply directly during an edit." But allowed-tools (SKILL.md:12) grants only Read, Glob, Grep, Skill, Bash(gh search code:*) — no Edit, no Bash(git mv:*) — and SKILL.md:110 states "This skill does not edit."

Read as instructions to the active agent, both lines hit a permission wall mid-procedure — the worst outcome for a rename, which SKILL.md:111 itself declares must be all-or-nothing. Read as guidance for a downstream caller they are fine, but the text does not say which.

Remediation: make the handoff explicit. Either reword to sweep-only ("…establish the reference set the owner needs before running git mv") or name the executor — workflow-fix already holds Edit, Bash(git checkout:*), and Bash(gh pr create:*) (skills/workflow-fix/SKILL.md:17).

W2 · SKILL.md:3-11 — description omits <example> blocks and is not in third-person form.

This is the only skill of the six in the plugin without <example> blocks (compare bitwarden-workflow-linter-rules/SKILL.md:11-20, workflow-audit/SKILL.md:9-17, action-audit, action-remediate, workflow-fix). The opening "Use when auditing or authoring workflows…" also deviates from the This skill should be used when… form the plugin-dev guidance requires, and at 713 characters the description runs roughly 40% over the ~500-char guideline for metadata that is permanently in context.

Remediation: add two <example> blocks to match the siblings, and trim the opening while preserving the existing trigger phrases — those are concrete and quotable and should survive any rewrite. Note the third-person form is a plugin-wide deviation (none of the five siblings use it), so fixing only this file trades one inconsistency for another; the <example> gap is the part that is genuinely out of step here.

Minor / advisory

  • SKILL.md:49 — "if you encounter one" is the only second-person usage in the file. Rewrite imperatively: "on encountering one, fix that first and rename second."
  • SKILL.md:59 — "an agent may apply directly" names the actor; prefer "only step-name casing is safe to apply in place." (Resolves alongside W1.)
  • SKILL.md:17 — uses Skill(plugin:skill) while action-audit/SKILL.md:29,64,82 reads the same sibling via a ${CLAUDE_PLUGIN_ROOT} path. Both resolve, and the divergence is forced (action-audit has no Skill in its allowed-tools), but the plugin now carries two conventions for one reference. The Skill() form introduced by commit da050de is the better one; worth standardizing in a follow-up so later skills do not fork further.
  • Skill name vs. its stated role. The name is an activity phrase, but plugins/bitwarden-devops-engineer/README.md:7 and :18, and SKILL.md:110, all describe this as a passive reference skill, and SKILL.md:35-78 does define the conventions. The sibling reference skill uses a noun phrase (bitwarden-workflow-linter-rules). There is also mild trigger overlap: SKILL.md:8 says "Use when auditing or authoring workflows", while workflow-audit is the skill that actually runs bwwl and produces a report. The ownership table (SKILL.md:19-27) mitigates the overlap in practice. Flagging so the choice is deliberate — workflow-naming-standards would match both the sibling and the README wording. Not a blocker.
  • CHANGELOG.md:8 — release date 2026-08-10 predates the branch head (e0c2fcd, 2026-08-13). Update to the merge date.
  • CHANGELOG.md:12 — the entry does not mention the read-only allowed-tools scoping added in 988ae3f, which is the security-relevant part of the skill. Since 0.2.0 is unreleased, amend the existing entry rather than adding a new one.

Pre-existing (not introduced by this PR)

  • CHANGELOG.md:40 — version history jumps [0.1.3][0.1.1]; no 0.1.2 entry.
  • skills/bitwarden-workflow-linter-rules/SKILL.md — the only skill with no allowed-tools key. Harmless for a pure reference skill, but inconsistent with the other five.

Security posture of the new skill

allowed-tools: Read, Glob, Grep, Skill, Bash(gh search code:*) (SKILL.md:12) is valid, minimal, and correctly read-only. The syntax matches the four sibling tool-bearing skills; Bash(gh search code:*) is scoped to exactly the org sweep on SKILL.md:85 and nothing broader; Skill is required for the invocation on line 17; and there is no Edit, Write, or unscoped Bash. This is the right shape for an audit/reference skill — do not "fix" it. The only gap is that the prose does not yet match it (W1).


3. Configuration & Security Review — not applicable

No CLAUDE.md or .claude/ file was changed by this PR, so there was nothing for the reviewing-claude-config skill to review. Verified rather than assumed:

  • .claude-pr/ exists and holds .claude/CLAUDE.md, .claude/settings.json, and .husky/pre-commit.
  • .claude-pr/.claude/CLAUDE.md is byte-identical to the PR head commit, confirming the snapshot is intact.
  • The working-tree copy at .claude/CLAUDE.md differs from it, but in the direction of main having moved ahead: the base-branch copy removes CI-workflow references that the PR-head copy still carries. That is base-branch drift, not a PR edit — consistent with the changed-file list, which contains no config paths.

Informational: this branch is therefore slightly behind main on .claude/CLAUDE.md. Nothing to fix in the PR; a rebase or merge before landing will pick up main's wording.

Security scanning was still applied to what the PR did change (marketplace.json, plugin.json, CHANGELOG.md, both READMEs, SKILL.md): no committed secrets, no hardcoded credentials, no dangerous command auto-approvals, and no overly broad tool or file access. The one permission surface introduced — the skill's allowed-tools — is read-only and narrowly scoped, as detailed above.


Summary of Required Action

Must fix (errors): none. The PR is structurally valid and safe to merge as-is.

Should fix (warnings), in priority order:

  1. Reconcile SKILL.md:59 and :82 with the read-only allowed-tools on line 12 — hand mutations to workflow-fix or reword as sweep-only. (W1)
  2. Add <example> blocks to the description and trim its length. (W2)
  3. Update the CHANGELOG.md:8 date and fold the allowed-tools scoping into the 0.2.0 entry.
  4. Remove the second-person clause on SKILL.md:49.
  5. Confirm the skill name is deliberate given the README and body both call it a reference skill.

@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds a workflow-naming-conventions reference skill to bitwarden-devops-engineer covering job IDs, step name casing, and workflow file naming, plus the 0.2.0 version bump, changelog entry, README listing, and a cspell dictionary addition. The new SKILL.md is 122 lines with valid frontmatter matching the sibling reference skill's format, and every cross-reference to name_capitalized, name_exists, underscore_outputs, and job_environment_prefix matches the definitions in bitwarden-workflow-linter-rules. Version bumps are present in all required files (marketplace.json, plugin.json, root README, changelog); this plugin has no agents, so no AGENT.md updates are needed. The rename-safety guidance (check-run names deriving from name: rather than job ID, step names not being expression-addressable, run history detaching on file rename) is technically accurate.

Code Review Details
  • ❓ : New reference skill has no inbound references from the audit/fix skills, unlike bitwarden-workflow-linter-rules
    • plugins/bitwarden-devops-engineer/README.md:18

Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
Comment thread plugins/bitwarden-devops-engineer/README.md Outdated

@SaintPatrck SaintPatrck left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider having Skill Creator generate evals to provide evidence that all the prose within the new Skill is actually load-bearing, and not overly verbose as Claude likes to do. Without evals, objective review of the Skill content is impossible unless reviewers run and evaluate it manually.

Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
Bring the `workflow-naming-conventions` skill description in line
with the skill spec, which forbids XML tags in `description`.

Trigger phrasings are folded into prose so the skill still matches
the same potential user questions.
Disambiguate this skill's rule IDs from real `bwwl` rule IDs. The
three standards are code-fenced headings styled exactly like linter
rules, and only kebab-vs-snake casing separates them, so a reader of
a generated report could mistake a convention finding for linter
output.
Address the ownership line's source-of-truth pointer with a
resolvable path instead of a bare skill name, matching the form
`action-audit` uses to reach the same skill.
Align the two sentence case headings in `workflow-naming-conventions`
with the Title Case used across the plugin's other skill headings.
Cosmetic only.

* `## Advisory: canonical step names` to `## Advisory: Canonical Step Names`
* `## Applying these standards` to `## Applying These Standards`
@fntyler
fntyler requested a review from SaintPatrck August 11, 2026 17:28
SaintPatrck
SaintPatrck previously approved these changes Aug 13, 2026

@SaintPatrck SaintPatrck left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Content looks good. Couple of minor notes about naming and sibling skill references. Nothing worth blocking on though.

Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
Comment thread plugins/bitwarden-devops-engineer/skills/workflow-naming-conventions/SKILL.md Outdated
…nvocation

Point to the linter rules skill by name instead of a file path so the
reference works regardless of how the skill is loaded.
Add allowed-tools to workflow-naming-conventions, scoping it to
Read, Glob, Grep, Skill, and gh search code. Document in the skill
body that it inspects and flags naming deviations but never edits.
Rename `workflow-naming-conventions` to `auditing-workflow-conventions`
to better reflect that the skill audits rather than defines
conventions. Updates all references in the CHANGELOG, README skill
table, and SKILL.md frontmatter.
@fntyler
fntyler merged commit 5713339 into main Aug 14, 2026
24 checks passed
@fntyler
fntyler deleted the bre-1830/skill-workflow-naming-conventions branch August 14, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants