From bb22f38e0d168b2cd7aa6d5d5f6ad208d457df9f Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Sun, 31 May 2026 16:45:12 -0400 Subject: [PATCH 01/17] Install Shadow PR review bot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds: - .github/workflows/shadow.yml — caller workflow that invokes sudsali/shadow's reusable workflow on every PR. - .shadow.yml — config for the bot (Python source dir, model overrides). See https://github.com/sudsali/shadow for the security model. --- .github/workflows/shadow.yml | 34 ++++++++++++++++++++++++++++++++++ .shadow.yml | 15 +++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 .github/workflows/shadow.yml create mode 100644 .shadow.yml diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml new file mode 100644 index 00000000000..f5eb87a1fe1 --- /dev/null +++ b/.github/workflows/shadow.yml @@ -0,0 +1,34 @@ +# Shadow PR review bot — installed via reusable workflow at sudsali/shadow. +# See https://github.com/sudsali/shadow for docs and security model. +name: Shadow + +on: + pull_request_target: + types: [opened, reopened, synchronize] + workflow_dispatch: + inputs: + pr_number: + required: true + description: "PR number to review" + dry_run: + type: boolean + default: false + shadow_ref: + default: v0 + description: "Pin to a Shadow release (v0 or commit SHA)" + +permissions: + contents: read + id-token: write + pull-requests: write + issues: write + +jobs: + shadow: + uses: sudsali/shadow/.github/workflows/shadow-review.yml@v0 + with: + pr_number: ${{ inputs.pr_number }} + dry_run: ${{ inputs.dry_run && 'true' || 'false' }} + shadow_ref: ${{ inputs.shadow_ref || 'v0' }} + secrets: + AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }} diff --git a/.shadow.yml b/.shadow.yml new file mode 100644 index 00000000000..1975694c68a --- /dev/null +++ b/.shadow.yml @@ -0,0 +1,15 @@ +# Shadow PR review bot config — see https://github.com/sudsali/shadow +codebase: + src_dir: aws_lambda_powertools # primary source root + file_ext: .py # narrow tool searches to Python + test_dir: tests # used by find_tests_for + language: python # legacy issue-respond path only + +bot: + name: shadow + escalate_label: needs-human + +models: + investigator: us.anthropic.claude-opus-4-7 + critic: us.anthropic.claude-opus-4-7 + reporter: us.anthropic.claude-haiku-4-5-20251001-v1:0 From 151028d7ba834954b896a88f8c964592a66e794e Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Sun, 31 May 2026 16:51:24 -0400 Subject: [PATCH 02/17] Pin Shadow workflow to v0 SHA Lockdown lint requires SHA-pinning third-party workflows. Trailing `# v0` comment so the human-readable tag is preserved. --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index f5eb87a1fe1..28b14f5f2b8 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -25,7 +25,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@9dd3bd34d7d4960cf8a9d4caa49b7890a529e074 # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 0478099af009eb63802d91c5a35158ca0fe91648 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Sun, 31 May 2026 21:58:29 -0400 Subject: [PATCH 03/17] Pin Shadow workflow to latest v0 SHA --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 28b14f5f2b8..af66d3027a8 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -25,7 +25,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@9dd3bd34d7d4960cf8a9d4caa49b7890a529e074 # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@cc9aea0bf5407458db5be1a238387ca1d03d162f # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 939bc512d9802168f43f0887f62b7eb28d4ea490 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Sun, 31 May 2026 23:59:35 -0400 Subject: [PATCH 04/17] Pin Shadow workflow to current v0 SHA --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index af66d3027a8..dd8e3a97f6a 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -25,7 +25,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@cc9aea0bf5407458db5be1a238387ca1d03d162f # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@38f2dd08914b79a43a2eb0100a246ad5e664acfc # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From d74b70bc3bd3d7cc376c008642ddb5b86676244e Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 00:04:39 -0400 Subject: [PATCH 05/17] Pin Shadow workflow to current v0 SHA --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index dd8e3a97f6a..ce2f421e1a9 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -25,7 +25,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@38f2dd08914b79a43a2eb0100a246ad5e664acfc # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@fb2948860eb9dd13feb6912983a9346b95411ce0 # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From ec0101add4641a7cbbc740321b7dfdd00804868b Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 00:18:47 -0400 Subject: [PATCH 06/17] Add issues trigger + bump Shadow to current v0 SHA --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index ce2f421e1a9..2316050715c 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -25,7 +25,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@fb2948860eb9dd13feb6912983a9346b95411ce0 # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@ae8415e900559a1c59395cfe9193b4011aa433aa # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 535fbf8f4c44d83241815661c6fbd93d66a94917 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 00:19:27 -0400 Subject: [PATCH 07/17] Add issues trigger to Shadow caller (test issue review) --- .github/workflows/shadow.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 2316050715c..955a0c8ae62 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -5,6 +5,8 @@ name: Shadow on: pull_request_target: types: [opened, reopened, synchronize] + issues: + types: [opened, reopened] workflow_dispatch: inputs: pr_number: From 7afbbd751c85204f7b61d5a68fbd9142be09b907 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 00:39:27 -0400 Subject: [PATCH 08/17] Bump Shadow to v0 with issue-trigger support --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 955a0c8ae62..d3a17d37c59 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -27,7 +27,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@ae8415e900559a1c59395cfe9193b4011aa433aa # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@61a8130c3990b3989ef5382270cacd7c2d3250f7 # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From bf9494bccde1c1658feeb1fa6e9936cb9b917d8d Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 01:13:44 -0400 Subject: [PATCH 09/17] Bump Shadow to v0 with issue prompts --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index d3a17d37c59..f974a51b3b0 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -27,7 +27,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@61a8130c3990b3989ef5382270cacd7c2d3250f7 # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@d0fb2981c586b2ff171a91b286e2cfd645163934 # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 983cc76429b7084b2ca1b6cc3f3b1e58fb671185 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 01:18:49 -0400 Subject: [PATCH 10/17] Bump Shadow to v0 with Haiku issue path --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index f974a51b3b0..6add1a804c6 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -27,7 +27,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@d0fb2981c586b2ff171a91b286e2cfd645163934 # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@1b9216cdecc65d62054a065eb05e3a287094940e # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 14a9a2b3c2e27858dc278bc773dba075e5f8db74 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 09:54:41 -0400 Subject: [PATCH 11/17] Bump Shadow pin to e5b53f8 (round-18) + run-name template --- .github/workflows/shadow.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 6add1a804c6..966e41db8e1 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -2,6 +2,13 @@ # See https://github.com/sudsali/shadow for docs and security model. name: Shadow +# Embed the PR/issue number in the run name. The reusable workflow's run-name +# is ignored when invoked via workflow_call — only the caller's template +# applies. This is what lets the rate-limit gate (BOT_MAX_RUNS_PER_HOUR) match +# prior runs for issue/issue_comment events, where the workflow_run record +# has no `pull_requests` array to match on. +run-name: "Shadow #${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}" + on: pull_request_target: types: [opened, reopened, synchronize] @@ -27,7 +34,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@1b9216cdecc65d62054a065eb05e3a287094940e # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@e5b53f8c4bf79c0e9048250ea218d38f2dac5451 # v0 (round-18) with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 81f416a70e8c744aae60d180c5698a9ed842a7ca Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 14:21:12 -0400 Subject: [PATCH 12/17] Bump Shadow pin to 37bac7d (round-18 squashed) --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 966e41db8e1..dbc836b593d 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -34,7 +34,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@e5b53f8c4bf79c0e9048250ea218d38f2dac5451 # v0 (round-18) + uses: sudsali/shadow/.github/workflows/shadow-review.yml@37bac7df2cb4d6457cf486d92d392d88bdb75ae8 # v0 (round-18 squashed) with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 3f4cfd15cc3dfe0cf505fd808941878eda885c1d Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 14:24:24 -0400 Subject: [PATCH 13/17] Bump Shadow pin to 728308e --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index dbc836b593d..651a6751d16 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -34,7 +34,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@37bac7df2cb4d6457cf486d92d392d88bdb75ae8 # v0 (round-18 squashed) + uses: sudsali/shadow/.github/workflows/shadow-review.yml@728308ea73eaeebb2a983ba798c2980ee707451f # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 16a87ef1aedb9e9789a2c051826ffe48c41b65b9 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 1 Jun 2026 14:38:49 -0400 Subject: [PATCH 14/17] Bump Shadow pin to 5340649 --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 651a6751d16..dca69f7a72f 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -34,7 +34,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@728308ea73eaeebb2a983ba798c2980ee707451f # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@5340649de5784ea90e4a7815d19beeb1fb82cfd0 # v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From 497efa75be803c4d56905d368607e6291ecaea76 Mon Sep 17 00:00:00 2001 From: sudsali Date: Mon, 1 Jun 2026 22:45:09 -0400 Subject: [PATCH 15/17] Bump Shadow ref to @v0 (auto-track latest) --- .github/workflows/shadow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index dca69f7a72f..03acdfa6c42 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -34,7 +34,7 @@ permissions: jobs: shadow: - uses: sudsali/shadow/.github/workflows/shadow-review.yml@5340649de5784ea90e4a7815d19beeb1fb82cfd0 # v0 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@v0 with: pr_number: ${{ inputs.pr_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} From d263b5bc06dd1619e6dc6829a70fb5e6d2475f0c Mon Sep 17 00:00:00 2001 From: sudsali Date: Thu, 4 Jun 2026 22:34:03 -0400 Subject: [PATCH 16/17] Forward GUARDRAIL_ID/VERSION to reusable workflow --- .github/workflows/shadow.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index 03acdfa6c42..cd709688621 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -41,3 +41,5 @@ jobs: shadow_ref: ${{ inputs.shadow_ref || 'v0' }} secrets: AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }} + GUARDRAIL_ID: ${{ secrets.GUARDRAIL_ID }} + GUARDRAIL_VERSION: ${{ secrets.GUARDRAIL_VERSION }} From 5c8a2136a8d2988d22734838c30afc31708136f7 Mon Sep 17 00:00:00 2001 From: sudsali Date: Fri, 5 Jun 2026 12:28:13 -0400 Subject: [PATCH 17/17] Add issue_comment trigger for followup-reply demo --- .github/workflows/shadow.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/shadow.yml b/.github/workflows/shadow.yml index cd709688621..06eaff37cf7 100644 --- a/.github/workflows/shadow.yml +++ b/.github/workflows/shadow.yml @@ -14,6 +14,8 @@ on: types: [opened, reopened, synchronize] issues: types: [opened, reopened] + issue_comment: + types: [created] workflow_dispatch: inputs: pr_number: