How the checks run

kiln connect deploys two CodeBuild projects for a repository.

A webhook build runs only for a pull request from a trusted GitHub user.

#CI

buildspec.yml is in the repository. It installs the packages, generates a key and the types, then runs lint, types and tests.

#The Flow review

This is the path of the code review guide of Flow, on CodeBuild. The build steps are in AWS, not in the repository, so a pull request cannot change them to read the secrets. No code of the pull request runs.

1. #Prepare

   The build checks out main in another folder, installs the packages there with no scripts, and runs npx flow install --ci. Then it replaces .claude, .flow, CLAUDE.md and node_modules of the pull request with the ones from main.

2. #Review

   The build fetches the Claude token, and runs the flow-code-review skill. The session can read files, read the diff, plan the review, and write in the tmp folder of the app. Each run has a budget of 5 dollars.

3. #Post

   The build gets a short-lived token for the review app. npx flow reviewdog converts the findings, and reviewdog posts each one on its line.

#Severity

.flow/review.yml gives which lens reads which files. The review reads it from main, so a change applies after you merge it.