ci: add aireceipts auto-attach hook (two-file kit)#2033
Conversation
…e existing config)
WalkthroughUpdates ChangesClaude Settings Hook
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfde8c3381
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "npx -y aireceipts-cli@latest hook pre-push", |
There was a problem hiding this comment.
In Claude Code sessions for this repo, the PreToolUse group matches every Bash tool call, and because this handler has no if guard, unrelated commands such as tests, rg, or cat still spawn npx -y aireceipts-cli@latest and wait until it exits or hits the 10s timeout. Claude Code hook resolution supports narrowing Bash handlers with an if pattern to avoid this process-spawn overhead, so this should be filtered to the git-push commands the receipt hook actually needs; otherwise normal terminal work is slowed and noisy whenever npm is cold, offline, or cannot resolve the package.
Useful? React with 👍 / 👎.
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "npx -y aireceipts-cli@latest hook pre-push", |
There was a problem hiding this comment.
This committed project hook executes aireceipts-cli@latest, so every Claude Code user can run newly published hook code and receipt-generation behavior without any reviewed repo change; I checked npx --help, which describes running local or remote npm package specs as <pkg>[@<version>], and this line deliberately selects the moving latest tag. Since the commit message says the dogfood target is v0.6.0, pinning that version (or vendoring the hook) avoids future CLI releases unexpectedly changing or breaking pushes for contributors.
Useful? React with 👍 / 👎.
| { | ||
| "type": "command", | ||
| "command": "npx -y aireceipts-cli@latest hook pre-push", | ||
| "timeout": 10 |
There was a problem hiding this comment.
On the first git push from a developer machine, npx -y aireceipts-cli@latest may need to resolve and download the package before the receipt logic runs, but this hook gives Claude Code only 10 seconds before cancellation; the Claude hook reference defines timeout as seconds before canceling the handler. In cold npm-cache or slow-network environments the push still proceeds silently while the receipt is never generated, leaving the existing pr-check workflow with nothing to post, so the hook needs a larger timeout or a preinstalled/pinned local executable.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.claude/settings.json (1)
25-25: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider pinning the CLI version for reproducibility.
Using
@latestmeans the hook's behavior can change at any time if a new version is published. While this is consistent with the CI workflow's usage, pinning to a specific version (e.g.,aireceipts-cli@0.6.0) would improve reproducibility and reduce supply-chain risk for a hook that runs on every bash command.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/settings.json at line 25, The pre-push hook command in the settings config uses aireceipts-cli@latest, which makes the hook non-reproducible and subject to unexpected changes. Update the command to use a pinned aireceipts-cli version instead of `@latest`, keeping it consistent with the hook setup in the settings configuration and ensuring the version is explicit and stable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/settings.json:
- Around line 21-26: The Bash hook command in the settings configuration can
still return a non-zero exit code and block all Bash tool invocations. Update
the hook entry for the `command` used by the `hooks` array so it cannot fail the
caller, and make sure the non-blocking safeguard is applied directly in the
configuration alongside the `Bash` matcher and `npx -y aireceipts-cli@latest
hook pre-push` invocation.
---
Nitpick comments:
In @.claude/settings.json:
- Line 25: The pre-push hook command in the settings config uses
aireceipts-cli@latest, which makes the hook non-reproducible and subject to
unexpected changes. Update the command to use a pinned aireceipts-cli version
instead of `@latest`, keeping it consistent with the hook setup in the settings
configuration and ensuring the version is explicit and stable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d2bde75b-0361-49c0-8baf-977acd9a8e67
📒 Files selected for processing (1)
.claude/settings.json
| "matcher": "Bash", | ||
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "npx -y aireceipts-cli@latest hook pre-push", | ||
| "timeout": 10 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add || true to enforce the "never block" guarantee at the configuration level.
The PR objectives state the hook "always exit with 0" and "never block a push," but the command has no exit-code safeguard. If aireceipts-cli exits non-zero (network error, bug, unexpected input), the PreToolUse hook could block the tool execution. This is especially critical because the Bash matcher fires on every Bash tool invocation — not just git push — so a CLI failure would block all bash commands, not just pushes.
The PR objectives also claim the hook "only runs on a real branch push to origin," but the Bash matcher doesn't enforce this; filtering must happen inside the CLI tool. Every bash command will incur npx overhead regardless.
🛡️ Proposed fix: append `|| true` to guarantee non-blocking behavior
{
"type": "command",
- "command": "npx -y aireceipts-cli@latest hook pre-push",
+ "command": "npx -y aireceipts-cli@latest hook pre-push || true",
"timeout": 10
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "matcher": "Bash", | |
| "hooks": [ | |
| { | |
| "type": "command", | |
| "command": "npx -y aireceipts-cli@latest hook pre-push", | |
| "timeout": 10 | |
| "matcher": "Bash", | |
| "hooks": [ | |
| { | |
| "type": "command", | |
| "command": "npx -y aireceipts-cli@latest hook pre-push || true", | |
| "timeout": 10 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/settings.json around lines 21 - 26, The Bash hook command in the
settings configuration can still return a non-zero exit code and block all Bash
tool invocations. Update the hook entry for the `command` used by the `hooks`
array so it cannot fail the caller, and make sure the non-blocking safeguard is
applied directly in the configuration alongside the `Bash` matcher and `npx -y
aireceipts-cli@latest hook pre-push` invocation.
Bundle Size Reportdarwin-arm64: 75.6 MB
linux-x64: 77.5 MB
win32-x64: 77.9 MB
|
Code Review SummaryStatus: No New Issues Found | Recommendation: Merge Overview
Kilo independently reviewed the changed config and found no new issues beyond what other reviewers have already raised on this PR — no new inline comments were added. The substantive design points are already covered by existing comments (no duplicates added):
Files Reviewed (1 file)
Reviewed by glm-5.2 · Input: 42.2K · Output: 8.7K · Cached: 144.8K Review guidance: REVIEW.md from base branch |
🤖 Code Review — OpenCodeReview (Gemini) — No Issues FoundNo comments generated. Looks good to me. |
2 participants
Adds the aireceipts auto-attach hook (second file of the two-file kit) by merging a
hooks.PreToolUseentry into the existing.claude/settings.json— yourpermissionsandmcpServersconfig is preserved unchanged.The hook runs
npx -y aireceipts-cli@latest hook pre-push: it never blocks your push (exits 0 always, no output) and only acts on a real branch push toorigin, so receipts generate automatically for the existingpr-checkworkflow to post. This repo runs no otherrefs/receipts/*producer (no collision). Revert anytime. Part of the org-wide aireceipts dogfood (v0.6.0).Note
Low Risk
Local Claude tooling config only; no app runtime, auth, or deployment paths change.
Overview
Extends
.claude/settings.jsonwith ahooks.PreToolUserule for Bash that runsnpx -y aireceipts-cli@latest hook pre-push(60s timeout), so receipt generation can run before shell/git push actions without changing existingpermissionsormcpServers.MCP
argsarrays are reformatted to multi-line only; behavior is unchanged.Reviewed by Cursor Bugbot for commit f5e049a. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
aireceipts-clipre-push check before operations proceed.