
Security News
Google’s OSV Fix Just Added 500+ New Advisories — All Thanks to One Small Policy Change
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
Autonomous GitHub Issue workflow automation CLI that bridges GitHub Issues with Claude Code, enabling AI-driven development cycles.
soba CLI automates the entire development workflow from issue creation to pull request merging. It monitors GitHub Issues, automatically processes them through planning, implementation, review, and merge phases using Claude Code AI assistance.
graph TD
A[Multiple soba:todo] -->|soba: Priority check| B[One becomes soba:queued]
B -->|soba: Immediately| C[soba:planning]
C -->|Claude: Plan creation| D[soba:ready]
D -->|soba: Auto-detect| E[soba:doing]
E -->|Claude: Implement & PR| F[soba:review-requested]
F -->|soba: Auto-detect| G[soba:reviewing]
G -->|Claude: Approve| H[soba:done + PR:soba:lgtm]
G -->|Claude: Request changes| I[soba:requires-changes]
I -->|soba: Auto-detect| K[soba:revising]
K -->|Claude: Apply fixes| F
H -->|soba: Auto-merge| J[soba:merged]
J -->|Next queuing| A
gem install soba-cli
# Clone the repository
git clone https://github.com/douhashi/soba-cli.git
cd soba-cli
# Install dependencies
bundle install
# Run from source
bin/soba --help
soba uses --dangerously-skip-permissions
by default to support AI-driven autonomous development. (This can be disabled in the configuration file)
When using default settings, please take necessary precautions such as using devcontainers and restricting external access.
Initialize configuration
soba init
Configure settings
Edit .soba/config.yml
:
github:
# Use gh command authentication (if available)
auth_method: gh
# Or use environment variable
# auth_method: env
# token: ${GITHUB_TOKEN}
repository: owner/repo
Start automation
soba start
Create an issue with label
Add soba:todo
label to any GitHub issue to start automated processing.
Configuration file location: .soba/config.yml
(in project root)
soba supports multiple authentication methods:
GitHub CLI (gh command) - Recommended
gh
authenticationauth_method: gh
in configEnvironment Variable
GITHUB_TOKEN
environment variableauth_method: env
in configAuto-detect (Default)
gh
command firstgh
is not availableauth_method
field for auto-detection# GitHub settings
github:
# Authentication method: 'gh', 'env', or omit for auto-detect
# Use 'gh' to use GitHub CLI authentication (gh auth token)
# Use 'env' to use environment variable
auth_method: gh # or 'env', or omit for auto-detect
# Personal Access Token (required when auth_method is 'env' or omitted)
# Can use environment variable
# token: ${GITHUB_TOKEN}
# Target repository (format: owner/repo)
repository: douhashi/soba-cli
# Workflow settings
workflow:
# Issue polling interval in seconds (default: 20)
interval: 20
# Use tmux for Claude execution (default: true)
use_tmux: true
# Enable automatic PR merging (default: true)
auto_merge_enabled: true
# Clean up tmux windows for closed issues (default: true)
closed_issue_cleanup_enabled: true
# Cleanup interval in seconds (default: 300)
closed_issue_cleanup_interval: 300
# Command delay for tmux panes in seconds (default: 3)
tmux_command_delay: 3
# Slack notifications
slack:
# Webhook URL for Slack notifications
# Get your webhook URL from: https://api.slack.com/messaging/webhooks
webhook_url: ${SLACK_WEBHOOK_URL}
# Enable notifications for phase starts (default: false)
notifications_enabled: false
# Git settings
git:
# Base path for git worktrees
worktree_base_path: .git/soba/worktrees
# Auto-setup workspace on phase start (default: true)
setup_workspace: true
# Phase commands (optional - for custom Claude commands)
phase:
plan:
command: claude
options:
- --dangerously-skip-permissions
parameter: '/soba:plan {{issue-number}}'
implement:
command: claude
options:
- --dangerously-skip-permissions
parameter: '/soba:implement {{issue-number}}'
review:
command: claude
options:
- --dangerously-skip-permissions
parameter: '/soba:review {{issue-number}}'
revise:
command: claude
options:
- --dangerously-skip-permissions
parameter: '/soba:revise {{issue-number}}'
Variable | Description | Required |
---|---|---|
GITHUB_TOKEN | GitHub Personal Access Token with repo/read:org/write:discussion scopes | Yes |
SLACK_WEBHOOK_URL | Slack Webhook URL | No |
Soba automatically deploys Claude command templates to .claude/commands/soba/
during initialization. These templates define the workflow automation commands for each phase:
These templates are included in the gem package and can be found in: lib/soba/templates/claude_commands/
soba init
Initialize soba configuration in the current project.
# Basic initialization
soba init
# Interactive mode
soba init --interactive
soba start
Start the workflow automation daemon.
# Start in daemon mode (background)
soba start
# Start in daemon mode
soba start --daemon
# Start with specific issue
soba start 123
# Start without tmux
soba start --no-tmux
soba status
Show daemon status and recent logs.
# Basic status
soba status
# Show more log lines
soba status --log 50
# Output as JSON
soba status --json
soba stop
Stop the running daemon.
# Graceful stop
soba stop
# Force stop immediately
soba stop --force
# Custom timeout
soba stop --timeout 60
soba open
Open or list tmux sessions for tasks.
# Open tmux session
soba open
# List all active sessions
soba open --list
soba config
Display current configuration.
# Show configuration
soba config
# Use specific config file
soba --config /path/to/config.yml config
Label | State | Description |
---|---|---|
soba:todo | Waiting | New issue awaiting processing |
soba:queued | Queued | Selected for processing |
soba:planning | Planning | Claude creating implementation plan |
soba:ready | Ready | Plan complete, awaiting implementation |
soba:doing | Implementing | Claude working on implementation |
soba:review-requested | Review Pending | PR created, awaiting review |
soba:reviewing | Reviewing | Claude reviewing PR |
soba:done | Complete | Review approved, ready to merge |
soba:requires-changes | Changes Needed | Review requested modifications |
soba:revising | Revising | Claude applying requested changes |
soba:merged | Merged | PR merged and issue closed |
Label | Description |
---|---|
soba:lgtm | Review approved, eligible for auto-merge |
lib/
├── soba/
│ ├── cli/ # CLI framework setup
│ ├── commands/ # Command implementations
│ ├── domain/ # Domain models
│ ├── services/ # Business logic
│ └── infrastructure/ # External integrations
# Run all tests
bundle exec rspec
# Run with coverage
bundle exec rake coverage
# Run specific test suite
bundle exec rspec spec/unit/
# Run Rubocop (Airbnb style)
bundle exec rubocop
# Auto-fix violations
bundle exec rubocop -a
# Security audit
bundle exec bundler-audit
The project uses pre-commit hooks for code quality:
Setup hooks:
./scripts/setup-hooks.sh
claude
command)soba CLI follows a layered architecture:
For detailed architecture documentation, see docs/development/architecture.md.
git checkout -b feature/amazing-feature
)git commit -m 'Add amazing feature'
)git push origin feature/amazing-feature
)Please ensure:
bundle exec rspec
)bundle exec rubocop
)This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
Unknown package
We found that soba-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
Research
/Security News
175 malicious npm packages (26k+ downloads) used unpkg CDN to host redirect scripts for a credential-phishing campaign targeting 135+ organizations worldwide.
Security News
Python 3.14 adds template strings, deferred annotations, and subinterpreters, plus free-threaded mode, an experimental JIT, and Sigstore verification.