GitLab + Claude Code: Using Claude as an External Reviewer for Java Spring Boot
Watch on YouTubeVideo summary
In this video, Michael from GitLab demonstrates how to utilize Claude Code as an external agent within the GitLab Duo Agent platform to enhance Java Spring Boot development workflows. The primary objective is to leverage this AI tool for reviewing code changes on a specific IoT project that utilizes various sensor implementations in different languages. To activate Cloud Code without requiring additional manual configuration, users simply need to ensure that the appropriate service account, identified by an "AI-" prefix followed by the agent name and namespace, is assigned within the project settings. This setup allows the AI to operate securely using GitLab-managed credentials while functioning as a dedicated external reviewer rather than just an integrated chat assistant.
The demonstration highlights a practical scenario where Michael creates a merge request for a new Spring Boot API server featuring REST and WebSocket endpoints. Upon submission, the system automatically triggers both human developer reviews and automated code analysis from GitLab Duo. The AI identifies several critical issues, including potential null pointer exceptions, overly permissive CORS configurations, security vulnerabilities in course settings, and duplicated documentation instructions. While developers can manually address these comments, Michael chooses to engage Cloud Code directly by invoking it with the "@" symbol to handle the feedback loop efficiently. This action launches a dedicated background session that analyzes the full context of the codebase, including existing imports and project structure, to generate comprehensive fixes for all identified problems simultaneously.
Once the external agent completes its analysis, it pushes a series of commits that resolve every point raised by both human reviewers and automated scanners. The resulting changes include fixing null safety issues in API comparisons, restricting problematic WebSocket configurations, adding missing JavaDoc examples, creating new tests, and automatically generating updated documentation to enforce specific style guides. Following these code modifications, the CI/CD pipeline is triggered again to validate that the fixes compile correctly, pass security scans, and satisfy all test requirements before merging. This seamless integration ensures that high-quality standards are maintained throughout the development process without requiring developers to manually write repetitive boilerplate or configuration files.
Ultimately, this workflow illustrates a powerful synergy between human expertise and AI automation in modern software engineering teams. By treating Claude Code as an external agent capable of understanding complex project contexts, developers can significantly accelerate their productivity while maintaining rigorous code quality standards. The ability for the AI to not only identify issues but also implement precise fixes that respect existing architectural decisions reduces cognitive load on engineers and streamlines the review process. This approach effectively turns the merge request cycle into a collaborative effort where human oversight guides direction while external agents handle detailed implementation tasks, ensuring faster delivery of secure and well-documented features.
Read the full video transcript
Hello everyone. My name is Michael, I'm
a developer advocate here at GitLab and
in today's video we want to dive into
Cloud Code together with GitLab Duo
Agent platform, specifically as a as an
external agent.
Um the goal here is to use the Tanuki
IoT platform project which provides
different sensors implemented in
different languages
um and focus on an implementation task
for a new feature.
Um in order to use Cloud Code as an
external agent, we need to enable that
or configure it um inside the
documentation we can see um there is a
couple of external agents already
available and for this specific use case
Cloud Code can be used and doesn't
require any additional configuration. Um
it also uses GitLab managed credentials
um which is important for building and
other things.
Um but for this use case we don't have
any thing to configure
um within the project itself in the AI
menu over here on the left hand side you
can see the agents tab
and the Cloud agents uh already has been
enabled by myself
uh for this project. The most important
part here is to understand that the you
need to mention or at mention or assign
the service account.
Um it's preceded with AI dash and then
uh Cloud agent by GitLab and then the
top level name space in this example.
Um this is important to understand. Now
in order to make use of uh the Cloud
agent
um here's a specific use case. Um today
I was working on improving um the IoT
platform project um and wanted to
implement a Spring Boot API server
um using like a backend REST and a web
socket API um and so on. So there's is
an issue that I created a while ago,
um, and then I started working on it
today. Um, I used Cloud Code for that.
So,
you can see here, um, here's my previous
session from an hour ago.
Um, and I asked, um,
Cloud Code to create a merge request.
So, the merge request is already open,
and it triggered, uh, GitLab Duo code
review, um, on it. This is what we know.
Let's go back to, um,
the issue itself. We can see the merge
request is, um, linked over here.
And, um, let's click on that.
You can see a lot of changes happened.
The
uh, the diffs, um, the diff is like
huge. You can also see an indicator
that, uh, three open threads. Um, so,
the review has already happened or is
already in progress. The pipelines are
green or have passed, at least. Um,
and we can see that,
um, there are some comments. So, a
developer commented and said the
password is incorrect. And, um, there's
also some duplicated information here
for the agent instructions in agents.md.
Um, and after that, or in parallel to
that, um, GitLab Duo, uh, code review
went in, and it identified a potential
null pointer exception,
um, a security vulnerability with a
course configuration or too permissive,
and some other things. So, it added
comments and included suggestions. Now,
I could apply those immediately,
but I also want to verify whether they
are,
um, correct in the specific context. Um,
and so, I thought about, "Hey, let's
put that into action, and actually
address
address it leveraging
uh
GitLab
not GitLab Cloud Code um integrated as
an external agent. So, by typing @ai,
uh we can see the auto complete here,
and then say, "Can you help me address
the review feedback?"
Click on comment,
and this will kick off
the agent
um over here,
and it will start a new session. So, I
could go
or click here to go immediately into the
session view,
or if I want to see it on the right-hand
side of the panel here, uh the chat
panel can also be used to
inspect the running sessions on the
platform. So, um
that's kicked off over here. The session
information I can
click on that and see that the session
has started for the external agent, and
now it's doing it its work. If you want
to go dive or go deep um into the
internals and how it works, can see it
runs on on a GitLab CI/CD
uh
runner as a using a flow a specific flow
executor, and everything hap- happens in
the background over here.
This will take
some minutes, it'll take a while. So,
while the while we're waiting to finish
that, I will
um
speed up the recording, and we'll see
each other in a bit.
And we can see
that a fix was pushed to address the
review feedback,
and a summary was posted by Cloud Agent
over here. So, it addressed the full
review findings,
and specifically
um
addressed also the human in the loop,
the developers' feedback as well. So,
the null safe API comparison has been
changed.
Uh, it restricted the web socket cause
problem, um, the sensor type validation
and RFC problem.
It added Java doc examples and a new
test. So, um, let's click on that.
Curious what the changes are.
It implemented the usage of objects. It
also, um,
added the import that is necessary to
use that. So, that's great.
Um,
made the changes.
And so on. So, this is quite, quite a
lot. It's also super helpful that I
don't need to write the docs myself.
So, this is,
um, a helpful way to auto generate it
and enforce it a certain development
style guide.
Um,
here is the allocations.
Um, configuration for the course header,
which is also
which looks good.
Um,
yeah.
We can see after a commit has been
pushed, this is a default configuration
in in GitLab to my knowledge,
um, a new pipeline is being triggered.
Um,
so we can validate that, um, the
the code is actually compiling or
building and we can see here is the
um, the
the build, uh, job for the Spring Boot
API server in this merge request. So,
the CI/CD config also has been updated.
And everything else is running,
including security scanning,
um, and specific more tests.
And there's also a test running for the
Spring Boot server. So, yes. Um,
this looks good.
Um,
let's see what else
we can do um
other than that.
I mean, certainly we could dismiss that
feedback and then continue working um
until it's
uh until everything is ready. Now, um
to summarize what happened um
what what happened here is um
I was working on a specific
um feature, which is the REST API or the
Java Spring Boot server here using Cloud
Code, created a merge request using the
GitLab MCP 0 in the background and um
and it got some review feedback um
from GitLab 2 Agent Platform and uh
developer.
Um yeah, and Cloud um as an external
agent was able to address the feedback
immediately, created a fix
um
put everything into context, so also
importing specific packages in the Java
uh Java configuration uh in the Java
code.
Yeah, and generally it looks good. The
pipelines are green and we can continue
working to um with GitLab and uh Cloud
Code um
So, this is a great learning, great
exercise. I hope you learned something
new today
um and see you in the next session.