How to Run Claude‑Powered AI Code Review in CodeBuild: A Step‑By‑Step Guide

aws secretsmanager create-secret \
  --name claude/api-key \
  --secret-string "$(cat ~/.claude_key)"

# buildspec.yml
version: 0.2

env:
  secrets-manager:
    CLAUDE_API_KEY: "arn:aws:secretsmanager:us-east-1:123456789012:secret:claude/api-key-abc123"

phases:
  install:
    runtime-versions:
      nodejs: 22
    commands:
      - echo "Installing dependencies..."
      - npm ci
  build:
    commands:
      - echo "Running AI code review..."
      - node review.js
artifacts:
  files:
    - diff-output.json

// create-project.ts
import { CodeBuildClient, CreateProjectCommand, UpdateProjectCommand } from "@aws-sdk/client-codebuild";

// Initialise the client – it reads credentials from the usual places (env, shared config, etc.)
const client = new CodeBuildClient({ region: "us-east-1" });

async function ensureProject() {
  const projectName = "ClaudeCodeReview";

  try {
    // Try to fetch the project; if it exists we will update it.
    const existing = await client.send(new CreateProjectCommand({ /* ... */ }));
    console.log(`Project ${projectName} already exists – skipping creation.`);
  } catch (err) {
    // If the project does not exist we fall back to creating it.
    if (err.name === "ResourceNotFoundException") {
      console.log(`Creating project ${projectName}...`);
      await client.send(new CreateProjectCommand({
        name: projectName,
        source: {
          type: "CODECOMMIT",
          location: "https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo"
        },
        environment: {
          type: "LINUX_CONTAINER",
          image: "aws/codebuild/standard:7.0", // Node 22 available here
          computeType: "BUILD_GENERAL1_SMALL",
          environmentVariables: [
            // Reference secret via the special syntax
            { name: "CLAUDE_API_KEY", value: "${secretsmanager:arn:aws:secretsmanager:us-east-1:123456789012:secret:claude/api-key-abc123}", type: "PLAINTEXT" }
          ]
        },
        // Ensure logs do not accidentally print env vars
        logsConfig: { cloudWatchLogs: { status: "ENABLED", groupName: "/aws/codebuild/ClaudeCodeReview" } }
      }));
      console.log(`Project ${projectName} created.`);
    } else {
      // Any other error we surface – this helps debugging mis‑configurations.
      console.error("Unexpected error:", err);
    }
  }
}

ensureProject().catch(console.error);

You are a senior software engineer. Review the following TypeScript file and suggest a minimal diff that fixes any logic errors, missing edge‑case handling, or performance issues. Return ONLY a JSON object:
{
  "file": "path/to/file.ts",
  "diff": "unified diff string"
}

// review.js
import { readFileSync, readdirSync } from "fs";
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { LambdaClient, InvokeCommand } from "@aws-sdk/client-lambda";

// Node 22 has a built‑in fetch implementation
const CLAUDE_ENDPOINT = "https://api.anthropic.com/v1/complete";
const MODEL = "claude-3-5-sonnet-20241022"; // example model name

// Helper: exponential backoff for retrying transient errors
async function retry(fn, attempts = 3, delay = 500) {
  for (let i = 0; i < attempts; i++) {
    try {
      return await fn();
    } catch (err) {
      if (i === attempts - 1) throw err; // give up on the last try
      const wait = delay * Math.pow(2, i);
      console.warn(`Retry ${i + 1}/${attempts} after ${wait}ms:`, err.message);
      await new Promise(r => setTimeout(r, wait));
    }
  }
}

// 1️⃣ Collect changed files (simple glob for demo)
function getChangedFiles() {
  // In a real pipeline you would use `git diff --name-only $BASE $HEAD`
  // Here we just read everything under src/
  return readdirSync("./src", { withFileTypes: true })
    .filter(e => e.isFile() && e.name.endsWith(".ts"))
    .map(e => `src/${e.name}`);
}

// 2️⃣ Build the request payload for Claude
function buildPayload(filePath, fileContent) {
  return {
    model: MODEL,
    max_tokens: 1024,
    temperature: 0,
    prompt: `You are a senior software engineer. Review the following TypeScript file and suggest a minimal diff that fixes any logic errors, missing edge‑case handling, or performance issues. Return ONLY a JSON object:\n\nFile: ${filePath}\n\`\`\`typescript\n${fileContent}\n\`\`\``,
  };
}

// 3️⃣ Call Claude with proper headers and error handling
async function callClaude(payload) {
  const response = await retry(() => fetch(CLAUDE_ENDPOINT, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": process.env.CLAUDE_API_KEY, // injected from Secrets Manager
    },
    body: JSON.stringify(payload),
  }));
  if (!response.ok) {
    const errBody = await response.text();
    throw new Error(`Claude returned ${response.status}: ${errBody}`);
  }
  const data = await response.json();
  // Claude returns the text inside a "completion" field
  return JSON.parse(data.completion);
}

// 4️⃣ Store the diff in S3 for later consumption
async function uploadDiff(diffObj) {
  const s3 = new S3Client({ region: "us-east-1" });
  const key = `review-results/${Date.now()}-${diffObj.file}.json`;
  await s3.send(new PutObjectCommand({
    Bucket: "my-ai-review-bucket",
    Key: key,
    Body: JSON.stringify(diffObj, null, 2),
    ContentType: "application/json",
  }));
  console.log(`✅ Diff uploaded to s3://${key}`);
}

// 5️⃣ Rotate the Claude API key via Lambda (security best practice)
async function rotateKey() {
  const lambda = new LambdaClient({ region: "us-east-1" });
  const cmd = new InvokeCommand({
    FunctionName: "RotateClaudeKey",
    InvocationType: "RequestResponse",
  });
  const result = await lambda.send(cmd);
  if (result.FunctionError) {
    throw new Error(`Lambda rotation failed: ${result.FunctionError}`);
  }
  console.log("🔄 Claude API key rotated successfully.");
}

// Main driver
(async () => {
  try {
    const files = getChangedFiles();
    for (const file of files) {
      const content = readFileSync(file, "utf-8");
      const payload = buildPayload(file, content);
      const diff = await callClaude(payload);
      await uploadDiff(diff);
    }

    // Optional: rotate the key after the build to limit exposure time
    await rotateKey();
  } catch (err) {
    // Distinguish network problems from CodeBuild specific errors
    if (err.name === "CodeBuildException") {
      console.error("❗ CodeBuild error:", err);
    } else {
      console.error("❗ Unexpected error:", err);
    }
    process.exit(1); // signal failure to CodeBuild
  }
})();

// rotate-key.ts
import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand } from "@aws-sdk/client-secrets-manager";

/**
 * This Lambda reads the current Claude key, generates a new one
 * (here we just mock it), stores the new key, and returns the ARN.
 * In a real world you would call the Claude provider’s key‑rotation API.
 */
export const handler = async () => {
  const sm = new SecretsManagerClient({ region: "us-east-1" });
  const secretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:claude/api-key-abc123";

  // 1️⃣ Retrieve current secret (optional – we may just replace it)
  const current = await sm.send(new GetSecretValueCommand({ SecretId: secretArn }));
  console.log("Current key fetched (masked).");

  // 2️⃣ Generate a fresh mock key – replace with real rotation logic
  const newKey = "new-mocked-claude-key-" + Date.now();

  // 3️⃣ Store the new key, overwriting the old value
  await sm.send(new PutSecretValueCommand({
    SecretId: secretArn,
    SecretString: newKey,
  }));

  console.log("Secret rotated.");
  return { status: "ok", newKeyArn: secretArn };
};

async function callClaude(payload) {
  const response = await retry(() => fetch(CLAUDE_ENDPOINT, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": process.env.CLAUDE_API_KEY,
    },
    body: JSON.stringify(payload),
  }));
  if (response.status === 429) {
    const reset = response.headers.get("retry-after") || "60"; // seconds
    throw new Error(`Rate limit hit – retry after ${reset}s`);
  }
  // …rest unchanged
}

async function callClaudeWithBackoff(payload) {
  let attempt = 0;
  while (attempt < 5) {
    try {
      return await callClaude(payload);
    } catch (err) {
      if (err.message.includes("Rate limit")) {
        const waitSec = parseInt(err.message.split("after ")[1]) || 60;
        console.warn(`⏳ Waiting ${waitSec}s before retry #${attempt + 1}`);
        await new Promise(r => setTimeout(r, waitSec * 1000));
      } else {
        // Re‑throw other errors to be handled by the outer catch
        throw err;
      }
    }
    attempt++;
  }
  throw new Error("Exceeded max retries due to rate limits");
}