Skip to content

Add skill to triage jira issues against code#108

Open
ariane-bitwarden wants to merge 5 commits into
mainfrom
add/triaging-jira-issues
Open

Add skill to triage jira issues against code#108
ariane-bitwarden wants to merge 5 commits into
mainfrom
add/triaging-jira-issues

Conversation

@ariane-bitwarden

@ariane-bitwarden ariane-bitwarden commented May 6, 2026

Copy link
Copy Markdown

🎟️ Tracking

N/A. Adds the assessing-jira-issue-relevance skill to bitwarden-atlassian-tools.

📔 Objective

Adds a skill that assesses whether a Jira ticket is still relevant or has been addressed.

It gathers ticket context, determines repo scope, identifies and searches for relevant code (locally), and delivers a verdict on the ticket's relevance.

If the skill cannot locate in-scope repos on disk, it will prompt the user to either clone the repo or point to where it is already cloned. Should the user reject, the skill aborts to prevent partial analysis.

@ariane-bitwarden
ariane-bitwarden requested a review from a team as a code owner May 6, 2026 00:13
@ariane-bitwarden ariane-bitwarden added the ai-review Request a Claude code review label May 6, 2026
@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the addition of the assessing-jira-issue-relevance skill to bitwarden-atlassian-tools, covering the new SKILL.md, its worked-examples file, and the supporting version/metadata changes. The skill frontmatter is valid (kebab-case name, trigger-rich description), all four referenced Atlassian MCP tools resolve to real tool definitions in the plugin's MCP server, and the referenced examples file exists. The MINOR version bump to 2.4.0 is consistent across plugin.json, marketplace.json, and the README table, with a matching CHANGELOG entry and the required toplevel cspell addition.

Code Review Details

No blocking or actionable findings.

Notes considered and deliberately not flagged:

  • Bash(git clone:*) in allowed-tools is a write/network operation inside an otherwise read-only plugin, but it is gated behind explicit AskUserQuestion approval and is core to the workflow (searching an un-cloned repo would produce false "no longer relevant" verdicts). Intentional and documented.
  • The shape of the allowed-tools frontmatter and repo-scoping behavior are already under active discussion in existing reviewer threads; not duplicated here.

Comment thread plugins/bitwarden-atlassian-tools/skills/triaging-jira-issues/SKILL.md Outdated
@theMickster

Copy link
Copy Markdown
Contributor

Howdy @ariane-bitwarden 👋🏼

Great start to the new skill, like 98% of the way there. Will you please update the plugins/bitwarden-atlassian-tools/README.md?
Currently, we have a slight misalignment that I'd like to see corrected. We have refrained from large walls of text like we currently have (see line 91) in favor of a simpler table (see plugins/bitwarden-tech-lead/README.md at line 15). Will you please craft a similar table with the new skill you're adding to plugins/bitwarden-atlassian-tools/README.md? Frankly, toss Claude at it and it should be able to create a concise table.

Thanks!

@theMickster theMickster left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor change to the frontmatter of the skill.

Item for discussion / follow-up changes
One thing to keep an eye on is the location where a user starts a session is important. The skill reads to me that the human should start a Claude session in the working directory above clients, server, etc. but what happens if you start a session or trigger the skill from inside clients?

---
name: triaging-jira-issues
description: Use when the user provides a single Jira issue key and asks whether it is still relevant, still applicable, still pending, still a bug, has been fixed, or can be closed. Trigger phrases include "Is [TICKET] still relevant?", "Is this still an issue?", "Is PM-123 still pending?", "Has this been fixed?", "Can we close this?", "Is this ticket still valid?", "Is this still applicable?", "Does this bug still exist?". Fetches the ticket and verifies the described problem against the current codebase to return a verdict with evidence. This skill triages a single ticket at a time; invoke it iteratively for multiple tickets.
---

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Let's update our allowed-tools frontmatter property.

Suggested change
---
allowed-tools: Bash(git log *) Bash(git show *) Grep Read
---

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated allowed-tools to include referenced commands and tools.

- **The specific problem or task**: Read beyond the summary. The description, acceptance criteria, and replication steps are more precise. For bugs: what is the actual broken behavior and what is expected? For tasks: what specific code change is required?
- **Technical identifiers**: Method names, class names, file paths, API endpoint routes, UI strings that appear in source, config keys, feature flag names — anything named in the ticket that can be searched in code. Note these explicitly before moving on.
- **Filed date**: Used to scope `git log` searches.
- **Repo scope signal**: Determine whether this applies to `clients`, `server`, `sdk-internal`, or a combination. Use the team field, component labels, and description content (see Scope Notes below).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓Is this skill intentionally limited to these specific repositories?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0.0 mobile love

image

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed hardcoded repos and mappings so that Claude does not silently ignore relevant repos that are not listed. Claude will make a best-effort attempt to infer the relevant repo(s) then ask the user for confirmation. This eliminates the potential for error in identifying relevant repos.


## Workflow

### Step 1: Fetch the Ticket and Its Context

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ariane-bitwarden should we consider also fetching the Github issue if it's linked to one via the "Github URL" field, and doing the same staleness checks there? If users are reporting it as still happening in Github then that's a signal.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@trmartin4 I like the idea, but I think it goes beyond the intended scope of this PR. I'd like to defer that to a follow-up addition.

ariane-bitwarden and others added 4 commits July 24, 2026 15:57
…SKILL.md


Removing reference to a bulk skill that does not exist yet.

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
The skill was limited to clients, server, and sdk-internal via a hardcoded
Scope Notes mapping, so tickets against any other Bitwarden repo were
misrouted. It also assumed affected repos were cloned locally without
checking; searching an absent repo returns no matches, which reads the
same as the code having been deleted and could close a live ticket.

Repo scope is now confirmed with the user before any searching, and the
skill halts without a verdict when a repo in scope is unavailable.

Renamed because the skill does not triage: it assesses one ticket at a
time and neither ranks nor prioritizes across a set.

Adds scoped allowed-tools so routine use stops prompting on every MCP
fetch. No version bump: 2.4.0 is unpublished and exists only on this
branch, so the changelog entry was folded in rather than superseded.
@SaintPatrck
SaintPatrck force-pushed the add/triaging-jira-issues branch from 865090b to 8d03837 Compare July 24, 2026 21:48
@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown

Plugin Validation Summary — PR #108

Plugin: bitwarden-atlassian-tools · Version: 2.4.0 (MINOR bump) · Result: ✅ All checks passed

This PR adds one new skill, assessing-jira-issue-relevance, with a worked-examples file, and bumps the plugin from 2.3.0 → 2.4.0 with a matching changelog entry. Three validations were run: plugin structure (plugin-validator), skill quality (skill-reviewer), and security (reviewing-claude-config). No critical, major, or blocking issues were found.

Changed files reviewed

  • plugins/bitwarden-atlassian-tools/.claude-plugin/plugin.json
  • plugins/bitwarden-atlassian-tools/CHANGELOG.md
  • plugins/bitwarden-atlassian-tools/skills/assessing-jira-issue-relevance/SKILL.md
  • plugins/bitwarden-atlassian-tools/skills/assessing-jira-issue-relevance/examples/relevance_assessment_workflow.md

1. Plugin Structure Validation — ✅ PASS

Check Result
plugin.json valid JSON, required fields present name, version, description, author, keywords
Semantic versioning 2.4.0 is valid semver; MINOR bump correct for a backward-compatible new skill
Version consistency across files plugin.json:3, .claude-plugin/marketplace.json:51, and CHANGELOG.md:8 all agree on 2.4.0
Description consistency ✅ byte-identical between plugin.json:4 and marketplace.json:52
CHANGELOG format (Keep a Changelog) ✅ dated [2.4.0] header with ### Added category (CHANGELOG.md:8-15)
Skill frontmatter (name, description, allowed-tools) name matches directory; well-formed YAML
MCP tool references resolve ✅ all 4 referenced MCP tools exist in the bundled server
Referenced example file exists examples/relevance_assessment_workflow.md (referenced at SKILL.md:123)
README.md present ✅ at plugin root
Hardcoded credentials ✅ none found

2. Skill Review — ✅ PASS

Check Result
Required frontmatter (name, description) ✅ present; name matches directory
Description quality ✅ third-person "Use when…" form, 8 concrete quoted trigger phrases, explicit single-ticket scope boundary
Word count (target 1,000–3,000) ✅ ~1,668 body words
Writing style ✅ consistently imperative/infinitive; no second-person drift
Progressive disclosure ✅ core SKILL.md lean; detailed worked examples offloaded to examples/
Referenced files exist examples/relevance_assessment_workflow.md present
Anti-patterns (vague triggers, bloat, missing examples) ✅ none

Strengths noted: strong safety design (Step 2 hard-halt when a repo is not cloned, with rationale for why proceeding would yield a false "No longer relevant"); clear separation between the Step 2 halt and the Step 5 "Cannot determine" verdict; least-privilege allowed-tools; a "What NOT to Do" section encoding real anti-patterns.

Minor / optional (warnings, non-blocking):

  • SKILL.md:123 — the example is referenced via a bare heading (### examples/relevance_assessment_workflow.md) rather than a clickable markdown link. Optional polish: See [examples/relevance_assessment_workflow.md](examples/relevance_assessment_workflow.md).
  • SKILL.md:3 — description is ~530 characters, marginally over the ~500-char soft guideline. Justified by the trigger-phrase coverage and scope note; no action needed.

3. Security Validation — ✅ PASS

Check Result
Committed secrets / API keys / tokens / passwords ✅ none in any of the 4 files
Hardcoded credentials ✅ none; example file uses placeholder keys (PM-XXXX) and generic identifiers
settings.local.json committed ✅ not present
Permission scoping (allowed-tools, SKILL.md:4) ✅ least-privilege — read-only Read/Grep/Glob/AskUserQuestion, narrowly-scoped git subcommands, 4 fully-qualified read-only MCP tools
Dangerous command auto-approvals ✅ none — no broad Bash(*); only mutating command is Bash(git clone:*), gated behind explicit AskUserQuestion user approval (SKILL.md:56-58)
Overly broad file access ✅ none

git clone is the sole write/network operation and is intentionally scoped and user-confirmed by the skill's Step 2 workflow — appropriate for its purpose.


Overall Assessment

Ready to merge. Clean MINOR version bump adding one well-structured, correctly-scoped skill. Version, manifest, marketplace entry, and changelog are mutually consistent; frontmatter and file references valid; least-privilege permissions; no credentials leaked. Only two optional, non-blocking polish suggestions on the skill.

Note: the repo scripts validate-plugin-structure.sh and validate-marketplace.sh require interactive approval in this environment and were not executed here; their checks were performed manually and via the plugin-validator agent. Recommend CI run them directly to confirm.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants