From 82dd92cfffa06cab0fe3646c9a7cdd97dddb030d Mon Sep 17 00:00:00 2001 From: fntyler <71953103+fntyler@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:13:42 -0400 Subject: [PATCH 1/3] [BRE-1832] refactor(bitwarden-devops-engineer): manual git ops [BRE-1832](https://bitwarden.atlassian.net/browse/BRE-1832) Remove auto-approved git add/commit/push from the action-remediate and workflow-fix skills so these mutating operations are run manually by the user. * Drop `git add`/`git commit`/`git push` from skill `allowed-tools` * Present commands for manual run, then create the draft PR after push * Retarget the diff-confirmation rule to the hand-off step * Bump plugin to 0.1.4 with CHANGELOG and README catalog updates --- .claude-plugin/marketplace.json | 2 +- README.md | 2 +- .../.claude-plugin/plugin.json | 2 +- plugins/bitwarden-devops-engineer/CHANGELOG.md | 6 ++++++ .../skills/action-remediate/SKILL.md | 14 ++++++++++---- .../skills/workflow-fix/SKILL.md | 12 +++++++++--- 6 files changed, 28 insertions(+), 10 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index a2ddbe67..52622477 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -60,7 +60,7 @@ { "name": "bitwarden-devops-engineer", "source": "./plugins/bitwarden-devops-engineer", - "version": "0.1.3", + "version": "0.1.4", "description": "GitHub Actions workflow compliance, action security auditing, and org-wide CI/CD remediation." }, { diff --git a/README.md b/README.md index a30582df..e86fd8ff 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable | [bitwarden-delivery-tools](plugins/bitwarden-delivery-tools/) | 2.0.0 | Delivery lifecycle skills: initiative funnel navigation, work transitions, tech breakdowns and task decomposition, commits, PRs, preflight, labeling | | [bitwarden-designer](plugins/bitwarden-designer/) | 0.1.0 | Product designer persona: Code of Conduct and 30/60/90 critique, critique facilitation; dispatches into bitwarden-design-tools | | [bitwarden-design-tools](plugins/bitwarden-design-tools/) | 0.1.0 | Design toolkit: content style guide, Figma Dev Mode MCP, Bitwarden brand application, handoff prep, Design System governance, Product and Design Jira | -| [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/) | 0.1.3 | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation | +| [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/) | 0.1.4 | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation | | [bitwarden-init](plugins/bitwarden-init/) | 1.2.0 | Initialize and enhance CLAUDE.md files with Bitwarden's standardized template format | | [bitwarden-product-analyst](plugins/bitwarden-product-analyst/) | 0.1.5 | Product analyst agent for creating comprehensive Bitwarden requirements documents from multiple sources | | [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.2.0 | Application security engineering: vulnerability triage, threat modeling, and secure code analysis | diff --git a/plugins/bitwarden-devops-engineer/.claude-plugin/plugin.json b/plugins/bitwarden-devops-engineer/.claude-plugin/plugin.json index 5eeb77dc..dcfe78c2 100644 --- a/plugins/bitwarden-devops-engineer/.claude-plugin/plugin.json +++ b/plugins/bitwarden-devops-engineer/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bitwarden-devops-engineer", - "version": "0.1.3", + "version": "0.1.4", "description": "GitHub Actions workflow compliance, action security auditing, and org-wide CI/CD remediation.", "author": { "name": "Bitwarden", diff --git a/plugins/bitwarden-devops-engineer/CHANGELOG.md b/plugins/bitwarden-devops-engineer/CHANGELOG.md index f1e768e6..f1926dd9 100644 --- a/plugins/bitwarden-devops-engineer/CHANGELOG.md +++ b/plugins/bitwarden-devops-engineer/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the bitwarden-devops-engineer plugin will be documented i The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.1.4] - 2026-06-23 + +### Security + +- Removed the `Bash(git add .github/:*)`, `Bash(git commit:*)`, and `Bash(git push:*)` permissions from the `action-remediate` and `workflow-fix` skills so these mutating git operations are run manually by the user instead of auto-approved. The skills now present the commands and resume to create the draft PR after the user confirms the push. Read-only `git diff`/`git status`, branch setup via `git checkout`, and `gh pr create` are retained. + ## [0.1.3] - 2026-05-08 ### Changed diff --git a/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md b/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md index a35c32b1..396962cd 100644 --- a/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md +++ b/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md @@ -15,7 +15,7 @@ description: > User: Replace tj-actions/changed-files with the safe version across those repos Action: Trigger action-remediate to swap the action and create PRs -allowed-tools: Read, Edit, Glob, Grep, Bash(gh pr create:*), Bash(git checkout:*), Bash(git add .github/:*), Bash(git commit:*), Bash(git push:*), Bash(git diff:*) +allowed-tools: Read, Edit, Glob, Grep, Bash(gh pr create:*), Bash(git checkout:*), Bash(git diff:*) --- ## Rules @@ -23,7 +23,7 @@ allowed-tools: Read, Edit, Glob, Grep, Bash(gh pr create:*), Bash(git checkout:* - **No mutating API calls without confirmation.** `gh api` GET requests are allowed freely. Any call using `-X POST`, `-X PUT`, `-X PATCH`, or `-X DELETE` must be shown to the user and approved before execution. - **Never force-push, delete branches, or delete repositories.** - **Only modify files under `.github/`.** Do not touch application code, scripts, or configuration outside of workflow files. -- **Show a diff and get confirmation before every commit.** +- **Show a diff and get confirmation before handing off for commit.** - **All PRs must be created as drafts.** - **Flag uncertainty.** If a finding is ambiguous or a fix could break a workflow, stop and ask rather than guessing. @@ -59,13 +59,19 @@ For each selected repo: 4. Show a `git diff` of changes in this repo and get confirmation before proceeding. -## Step 3: Create PRs +## Step 3: Commit, Push, and Create PRs -After fixes are confirmed, for each repo: +For each repo, ask the user to stage, commit, and push manually: ```bash git add .github/ git commit -m "Remediate action usage" +git push -u origin fix/action-remediation- +``` + +Once the user confirms the push, create the draft PR: + +```bash gh pr create \ --title "Remediate action usage" \ --body "$(cat <<'EOF' diff --git a/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md b/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md index 75d74f7a..6489e6bc 100644 --- a/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md +++ b/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md @@ -14,7 +14,7 @@ description: > User: Fix the workflow linter issues in server and clients Action: Trigger workflow-fix for those repos -allowed-tools: Read, Edit, Glob, Grep, Skill, Bash(bwwl:*), Bash(gh api --method GET *), Bash(git checkout:*), Bash(git add .github/:*), Bash(git commit:*), Bash(git push:*), Bash(git diff:*), Bash(git status:*), Bash(gh pr create:*) +allowed-tools: Read, Edit, Glob, Grep, Skill, Bash(bwwl:*), Bash(gh api --method GET *), Bash(git checkout:*), Bash(git diff:*), Bash(git status:*), Bash(gh pr create:*) --- ## Rules @@ -22,7 +22,7 @@ allowed-tools: Read, Edit, Glob, Grep, Skill, Bash(bwwl:*), Bash(gh api --method - **No mutating API calls without confirmation.** `gh api` GET requests are allowed freely. Any call using `-X POST`, `-X PUT`, `-X PATCH`, or `-X DELETE` must be shown to the user and approved before execution. - **Never force-push, delete branches, or delete repositories.** - **Only modify files under `.github/`.** Do not touch application code, scripts, or configuration outside of workflow files. -- **Show a diff and get confirmation before every commit.** +- **Show a diff and get confirmation before handing off for commit.** - **All PRs must be created as drafts.** - **Flag uncertainty.** If a finding is ambiguous or a fix could break a workflow, stop and ask rather than guessing. @@ -84,11 +84,17 @@ After all fixes are applied: 1. Show a `git diff` of all changes made. 2. Ask the user to confirm they want to proceed with a PR. -3. If confirmed: +3. Ask the user to stage, commit, and push manually: ```bash git add .github/workflows/ git commit -m "Fix workflow linter findings" +git push -u origin fix/workflow-linter-findings +``` + +4. Once the user confirms the push, create the draft PR: + +```bash gh pr create \ --title "Fix workflow linter findings" \ --body "Automated fixes for findings from the Bitwarden workflow linter (bwwl)." \ From 7fc1b2a2a4a2d85e7dc3b208d55333d710ce0081 Mon Sep 17 00:00:00 2001 From: fntyler <71953103+fntyler@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:31:42 -0400 Subject: [PATCH 2/3] Table cell padding correction --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e86fd8ff..28dc2a1f 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable | [bitwarden-delivery-tools](plugins/bitwarden-delivery-tools/) | 2.0.0 | Delivery lifecycle skills: initiative funnel navigation, work transitions, tech breakdowns and task decomposition, commits, PRs, preflight, labeling | | [bitwarden-designer](plugins/bitwarden-designer/) | 0.1.0 | Product designer persona: Code of Conduct and 30/60/90 critique, critique facilitation; dispatches into bitwarden-design-tools | | [bitwarden-design-tools](plugins/bitwarden-design-tools/) | 0.1.0 | Design toolkit: content style guide, Figma Dev Mode MCP, Bitwarden brand application, handoff prep, Design System governance, Product and Design Jira | -| [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/) | 0.1.4 | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation | +| [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/) | 0.1.4 | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation | | [bitwarden-init](plugins/bitwarden-init/) | 1.2.0 | Initialize and enhance CLAUDE.md files with Bitwarden's standardized template format | | [bitwarden-product-analyst](plugins/bitwarden-product-analyst/) | 0.1.5 | Product analyst agent for creating comprehensive Bitwarden requirements documents from multiple sources | | [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.2.0 | Application security engineering: vulnerability triage, threat modeling, and secure code analysis | From 064b2ee20b1cc37e1e48c421497c0635d5cb1d13 Mon Sep 17 00:00:00 2001 From: fntyler <71953103+fntyler@users.noreply.github.com> Date: Fri, 26 Jun 2026 14:50:11 -0400 Subject: [PATCH 3/3] wording to reduce ambiguity --- .../bitwarden-devops-engineer/skills/action-remediate/SKILL.md | 2 +- plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md b/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md index 396962cd..a9ac0038 100644 --- a/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md +++ b/plugins/bitwarden-devops-engineer/skills/action-remediate/SKILL.md @@ -61,7 +61,7 @@ For each selected repo: ## Step 3: Commit, Push, and Create PRs -For each repo, ask the user to stage, commit, and push manually: +Do not run the staging, commit, or push commands yourself. For each repo, present the block below for the user to run manually as a suggestion: ```bash git add .github/ diff --git a/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md b/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md index 6489e6bc..c6518c57 100644 --- a/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md +++ b/plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md @@ -84,7 +84,7 @@ After all fixes are applied: 1. Show a `git diff` of all changes made. 2. Ask the user to confirm they want to proceed with a PR. -3. Ask the user to stage, commit, and push manually: +3. Do not run the staging, commit, or push commands yourself. Present the block below for the user to run manually as a suggestion: ```bash git add .github/workflows/