diff --git a/.coderabbit.yaml b/.coderabbit.yaml index f47f522..a458695 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -1,306 +1,510 @@ # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json # -# ANcpLua.Agents — Microsoft Agent Framework (MAF) helpers + agent test infra -# Stack: C# / .NET, MAF (preview), preview API surface markers (MEAI001, OPENAI002) -# Packages: ANcpLua.Agents (stable), .Testing (preview-only), -# .Testing.Workflows (preview-only) -# Auto-bump pattern (compute_version on push to main). +# CodeRabbit Pro+ / Enterprise-grade review configuration for ANcpLua/ANcpLua.Agents. +# Generated 2026-05-16 from the current schema-backed configuration reference. # -# Schema-validated against: https://coderabbit.ai/integrations/schema.v2.json +# Repository context: Microsoft Agent Framework helper libraries and test infrastructure with preview API boundaries. # +# Posture: maximum useful review depth. CodeRabbit may spend extra context on +# cross-repo knowledge, web search, linked issues/PRs, security tools, +# pre-merge checks, finishing touches, and issue planning. The request-changes +# workflow is enabled intentionally so error-mode checks can block unsafe PRs. language: en-US -tone_instructions: >- - Principal-engineer review. Be direct. Block channel leaks, wrong MAF preview suppressions, - stale MAF mapping, sync-over-async, DateTime.Now/UtcNow, and missing CancellationToken on - public async APIs. +tone_instructions: 'Principal/staff-level review. Spend extra context on architecture, + correctness, maintainability, security, CI/release safety, generated-file drift, + and cross-repo contract drift. Be direct: no praise, no filler, no style nits without + risk.' early_access: true enable_free_tier: false - +inheritance: false reviews: profile: assertive - request_changes_workflow: false + request_changes_workflow: true high_level_summary: true - high_level_summary_in_walkthrough: false + high_level_summary_instructions: 'Write a dense engineering summary: behavior changed, + risk surface, validation evidence, generated artifacts, and cross-repo implications. + Avoid praise and filler.' + high_level_summary_placeholder: "@coderabbitai summary" + high_level_summary_in_walkthrough: true + auto_title_placeholder: "@coderabbitai title" + auto_title_instructions: 'Use conventional commits with an area prefix. Keep under + 72 characters and omit trailing punctuation. Examples: feat(api): add document + search filters, fix(build): pin Codecov upload.' review_status: true review_details: true commit_status: true fail_commit_status: true - collapse_walkthrough: true - changed_files_summary: false - sequence_diagrams: false - estimate_code_review_effort: false + collapse_walkthrough: false + changed_files_summary: true + sequence_diagrams: true + estimate_code_review_effort: true assess_linked_issues: true - related_issues: false - related_prs: false - suggested_labels: false - suggested_reviewers: false + related_issues: true + related_prs: true + suggested_labels: true + labeling_instructions: + - label: area:api + instructions: Apply when REST, RPC, MCP, public endpoints, contracts, or request/response + models change. + - label: area:ui + instructions: Apply when frontend UI, styling, accessibility, or client-side state + changes. + - label: area:build + instructions: Apply when build scripts, NUKE/MSBuild, package managers, Docker, + CI, or release automation change. + - label: area:test + instructions: Apply when tests, fixtures, test infrastructure, coverage, or snapshots + change. + - label: area:docs + instructions: Apply when docs, AGENTS.md, CLAUDE.md, README, changelogs, specs, + or generated reference docs change. + - label: area:security + instructions: Apply when authentication, authorization, secrets, token handling, + logging of sensitive data, or dependency security changes. + - label: area:data + instructions: Apply when database schema, persistence, migrations, queues, storage, + serialization, generated data, or data contracts change. + - label: area:agents + instructions: Apply when agent prompts, MCP tools, AI workflow code, model calls, + tool schemas, or agent-facing instructions change. + - label: area:generated + instructions: Apply when generated files, generators, schemas, OpenAPI/TypeSpec/semconv + models, lockfiles, or generated docs change. + - label: breaking + instructions: Apply when public APIs, CLI flags, package surfaces, endpoint schemas, + storage formats, config keys, or emitted artifacts change incompatibly. + - label: review:slop + instructions: Auto-applied by CodeRabbit slop detection for low-quality AI-generated + changes. Do not apply manually. + - label: area:maf + instructions: Apply when Microsoft Agent Framework integration changes. + - label: area:testing-workflows + instructions: Apply when agent test workflow helpers change. + - label: area:testing + instructions: Apply when the PR modifies src/ANcpLua.Agents.Testing/ (preview-only). + - label: area:workflows + instructions: Apply when the PR modifies src/ANcpLua.Agents.Testing.Workflows/ + (preview-only). + - label: area:tests + instructions: Apply when the PR modifies tests/. + - label: area:tests-live + instructions: Apply when the PR modifies tests/ANcpLua.Agents.Tests.Live/ (live-API + tests). + - label: area:infra + instructions: Apply when the PR modifies .github/, eng/, or root build infrastructure. + auto_apply_labels: true + suggested_reviewers: true auto_assign_reviewers: false + suggested_reviewers_instructions: + - reviewers: + - handle: ANcpLua + type: user + instructions: Suggest for PRs touching architecture, public APIs, security-sensitive + code, release automation, generated artifacts, or cross-repository contracts. in_progress_fortune: false poem: false enable_prompt_for_ai_agents: true - - labeling_instructions: - - label: 'area:agents' - instructions: 'Apply when the PR modifies src/ANcpLua.Agents/ (stable package).' - - label: 'area:testing' - instructions: 'Apply when the PR modifies src/ANcpLua.Agents.Testing/ (preview-only).' - - label: 'area:workflows' - instructions: 'Apply when the PR modifies src/ANcpLua.Agents.Testing.Workflows/ (preview-only).' - - label: 'area:tests' - instructions: 'Apply when the PR modifies tests/.' - - label: 'area:tests-live' - instructions: 'Apply when the PR modifies tests/ANcpLua.Agents.Tests.Live/ (live-API tests).' - - label: 'area:infra' - instructions: 'Apply when the PR modifies .github/, eng/, or root build infrastructure.' - - label: 'breaking' - instructions: >- - Apply when the PR introduces breaking changes to the stable Agents - package surface — preview packages get a lower bar. - auto_apply_labels: true - path_filters: - - 'src/**' - - 'tests/**' - - 'eng/**' - - '.github/**' - - '*.props' - - '*.targets' - - '*.slnx' - - 'global.json' - - 'Directory.*.props' - - 'Directory.*.targets' - - 'Version.props' - - 'coverage.runsettings' - - '!**/*.g.cs' - - '!**/*.Designer.cs' - - '!**/bin/**' - - '!**/obj/**' - - '!**/artifacts/**' - + - "!**/*.g.cs" + - "!**/*.g.ts" + - "!**/*.g.sql" + - "!**/*.g.tsp" + - "!**/*.Designer.cs" + - "!**/Generated/**" + - "!**/generated/**" + - "!**/bin/**" + - "!**/obj/**" + - "!**/dist/**" + - "!**/node_modules/**" + - "!**/coverage/**" + - "!**/.angular/**" + - "!**/.vite/**" + - "!**/.next/**" + - "!**/*.min.js" + - "!**/*.min.css" + - "!**/package-lock.json" + - "!**/pnpm-lock.yaml" + - "!**/yarn.lock" + - "!Artifacts/**" + - "!artifacts/**" + - "!**/*.sarif" + - "!**/*.trx" path_instructions: - - path: 'src/ANcpLua.Agents/**/*.cs' - instructions: | - Stable package consuming Microsoft Agent Framework preview API. - Review for: - - C# 14 with preview features. File-scoped namespaces. Switch expressions. - - `IIncrementalGenerator` only (if any source-gen here). - - No `DateTime.Now` — use `TimeProvider.System`. - - No `.Result`/`.Wait()`/`.GetAwaiter().GetResult()` — `await` always. - - No null-forgiving `!` — rewrite the code. - - No `dynamic` — typed contracts only. - - CancellationToken threaded through every async public method. - - sealed by default for non-public classes. - - ARCHITECTURAL INVARIANTS — flag violations as blocking: - - Preview API markers (MEAI001, OPENAI002) are the ONLY acceptable - suppressions in this package, and ONLY where the underlying MAF - API requires them. Any other suppression → flag. - - Preview types from MAF must NOT leak into our stable public API - without explicit `[Experimental]` / `[RequiresPreviewFeatures]` - marker on the consuming method/type. - - `params ReadOnlySpan` over `params T[]` (C# 13+). - - - path: 'src/ANcpLua.Agents.Testing/**/*.cs' - instructions: | - Preview-only package — published as X.Y.Z-preview.1 (NU5104). Lower - API stability bar; breaking changes acceptable across preview versions. - Still flag: blocking-async, DateTime.Now, null-forgiving `!`, missing - CancellationToken on async public methods. - - - path: 'src/ANcpLua.Agents.Testing.Workflows/**/*.cs' - instructions: | - Preview-only package — same rules as ANcpLua.Agents.Testing. Workflow- - specific test fixtures. Review for: deterministic test setup, no - sleep-based synchronization, proper resource disposal in test fixtures. - - - path: 'tests/**/*.cs' - instructions: | - xUnit + FluentAssertions. AAA pattern. NSubstitute for mocks. - Flag: blocking-async (`Task.Run(() => x.Result)`), missing - `async Task` (sync-void), `Thread.Sleep` instead of `await Task.Delay`, - tests asserting on private state via reflection. - - - path: 'tests/ANcpLua.Agents.Tests.Live/**' - instructions: | - Live-API tests — hit real MAF / OpenAI / Azure endpoints. - Review for: tests gated behind environment variables (don't run by - default), API keys never logged, retries with backoff for transient - failures, and that test data doesn't leak PII or org-specific names. - - - path: '**/*.props' - instructions: | - MSBuild property files. Multi-targeting matters here. Review for - correct TargetFrameworks, that preview-package csproj sets - `true` only when intended, and that - version override (`-preview.N` suffix) is correctly applied. - - - path: 'Version.props' - instructions: | - Single source of truth for version. Auto-bump pattern: - compute_version bumps from latest tag on push to main. - Preview packages take `X.Y.Z-preview.1` (filtered out of - next-version.sh stable regex). Review for: matches latest tag. - - - path: '.github/workflows/**' - instructions: | - Pin third-party actions to SHA. First-party (actions/*) tag-pin OK. - Concurrency groups required on push-triggered workflows. - Secrets via env: not inline. No secrets in logs. - Tag-with-gate pattern: nuget environment requires manual approval. - - - path: 'AGENTS.md' - instructions: | - Coordination file for AI agents. Review for: consistency with actual - repo structure, accurate package descriptions, and the - MAF1.4Mapping.md reference is current. - - - path: 'MAF1.4Mapping.md' - instructions: | - Mapping document between our Agents abstractions and Microsoft Agent - Framework's current public surface. Review for: accuracy against the - currently-pinned MAF version (Version.props), no stale type references, - and that mapping notes call out where MAF preview markers (MEAI001, - OPENAI002) apply. - + - path: "**/*.{cs,csproj,props,targets,sln,slnx}" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*Tests/**/*.cs" + instructions: ".NET tests. Review that tests assert observable behavior, not implementation + details; async tests return Task; timing-sensitive tests use deterministic signals/fakes + instead of sleeps; Testcontainers resources are disposed; cancellation tokens + are threaded; mocks are strict where the repo convention expects strictness; + and new behavior has focused regression coverage. Do not accept weakening or + deleting truthful tests to make a PR pass." + - path: ".github/workflows/**" + instructions: GitHub Actions review. Pin third-party actions to immutable SHAs + unless the repo explicitly documents tag-pinning; keep permissions minimal per + job; use concurrency for push/PR workflows; avoid secrets in command lines/logs; + keep required and non-blocking jobs clear; preserve tokenless OIDC upload patterns + where used; and flag any admin-bypass, force-push, destructive cleanup, or auto-merge + behavior that can mask a failed required check. + - path: "**/*.{md,mdx}" + instructions: 'Documentation review. Treat docs as executable team memory: flag + instructions that disagree with actual scripts, package versions, branch protection, + generated-file workflows, or repo layout. Keep AGENTS.md/CLAUDE.md rules coherent + with automation. Do not request cosmetic prose changes unless ambiguity would + mislead an agent or maintainer.' + - path: "**/*.{g.cs,g.ts,g.sql,g.tsp,Designer.cs,generated.*,snap}" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: src/ANcpLua.Agents/**/*.cs + instructions: Stable package consuming Microsoft Agent Framework preview APIs. + Preview suppressions must be limited and justified; preview MAF types must not + leak into stable public API silently; public async APIs need CancellationToken; + no sync-over-async; no DateTime.Now/UtcNow; prefer params ReadOnlySpan where + practical. + - path: src/ANcpLua.Agents.Testing*/**/*.cs + instructions: Preview testing packages. Lower API stability bar, but still enforce + deterministic test fixtures, no sleep-based synchronization, proper resource + disposal, and explicit live-API gating. + - path: src/ANcpLua.Agents.Testing/**/*.cs + instructions: | + Preview-only package — published as X.Y.Z-preview.1 (NU5104). Lower + API stability bar; breaking changes acceptable across preview versions. + Still flag: blocking-async, DateTime.Now, null-forgiving `!`, missing + CancellationToken on async public methods. + - path: src/ANcpLua.Agents.Testing.Workflows/**/*.cs + instructions: | + Preview-only package — same rules as ANcpLua.Agents.Testing. Workflow- + specific test fixtures. Review for: deterministic test setup, no + sleep-based synchronization, proper resource disposal in test fixtures. + - path: tests/**/*.cs + instructions: | + xUnit + FluentAssertions. AAA pattern. NSubstitute for mocks. + Flag: blocking-async (`Task.Run(() => x.Result)`), missing + `async Task` (sync-void), `Thread.Sleep` instead of `await Task.Delay`, + tests asserting on private state via reflection. + - path: tests/ANcpLua.Agents.Tests.Live/** + instructions: | + Live-API tests — hit real MAF / OpenAI / Azure endpoints. + Review for: tests gated behind environment variables (don't run by + default), API keys never logged, retries with backoff for transient + failures, and that test data doesn't leak PII or org-specific names. + - path: "**/*.props" + instructions: | + MSBuild property files. Multi-targeting matters here. Review for + correct TargetFrameworks, that preview-package csproj sets + `true` only when intended, and that + version override (`-preview.N` suffix) is correctly applied. + - path: Version.props + instructions: | + Single source of truth for version. Auto-bump pattern: + compute_version bumps from latest tag on push to main. + Preview packages take `X.Y.Z-preview.1` (filtered out of + next-version.sh stable regex). Review for: matches latest tag. + - path: AGENTS.md + instructions: | + Coordination file for AI agents. Review for: consistency with actual + repo structure, accurate package descriptions, and the + MAF1.4Mapping.md reference is current. + - path: MAF1.4Mapping.md + instructions: | + Mapping document between our Agents abstractions and Microsoft Agent + Framework's current public surface. Review for: accuracy against the + currently-pinned MAF version (Version.props), no stale type references, + and that mapping notes call out where MAF preview markers (MEAI001, + OPENAI002) apply. + abort_on_close: true + disable_cache: true + slop_detection: + enabled: true + label: review:slop auto_review: enabled: true + description_keyword: "@coderabbitai review" auto_incremental_review: true auto_pause_after_reviewed_commits: 0 - drafts: false ignore_title_keywords: - - 'deps(' - - '[skip ci]' - - '[skip review]' - - 'wip' + - "[skip review]" labels: [] - base_branches: [] - ignore_usernames: - - 'dependabot[bot]' - - 'renovate[bot]' - + drafts: true + base_branches: + - ".*" + ignore_usernames: [] finishing_touches: docstrings: - enabled: false + enabled: true unit_tests: - enabled: false - + enabled: true + simplify: + enabled: true + custom: + - enabled: true + name: architecture hardening + instructions: Refactor only changed code where doing so removes meaningful duplication, + hidden fallback paths, tangled responsibilities, or brittle coupling. Preserve + behavior unless the PR explicitly changes it. Prefer deleting bad indirection + over adding wrappers. Include tests or note exactly why no test can cover + the improvement. + - enabled: true + name: security pass + instructions: Inspect the PR for secrets, injection risk, path traversal, unsafe + deserialization, authz/authn drift, overbroad logging, unsafe dependency changes, + and CI token permission expansion. Apply minimal fixes directly when safe; + otherwise leave precise comments. + - enabled: true + name: test gap closure + instructions: Generate focused tests for changed behavior and edge cases. Prefer + existing test frameworks and fixtures. Do not create broad snapshot churn + or tests that merely assert implementation details. Include regression tests + for bugs and riskier boundary changes. + - enabled: true + name: docs and changelog alignment + instructions: Update docs, README, AGENTS/CLAUDE guidance, generated reference + docs, and changelog entries only where the PR changes user-visible behavior, + public contracts, workflows, or agent instructions. Keep entries concise and + consistent with repo rules. + - enabled: true + name: performance and allocation pass + instructions: Review changed hot paths for avoidable allocations, repeated parsing, + unbounded concurrency, N+1 calls, missing streaming/backpressure, and inefficient + data structures. Apply low-risk improvements with tests or benchmarks where + the repo already has them. pre_merge_checks: + override_requested_reviewers_only: true docstrings: - mode: 'off' + mode: warning + threshold: 75 title: mode: error - requirements: | - Conventional commits: feat|fix|refactor|chore|docs|test|ci|perf|deps. - Under 72 chars, no trailing period. - Examples: feat(agents): add agent observability adapter, - fix(testing): correct workflow timeout default + requirements: Conventional commits with an area scope; under 72 characters; + no trailing punctuation; accurately names the highest-impact change. description: - mode: warning + mode: error issue_assessment: mode: warning custom_checks: - - mode: error - name: 'No DateTime.Now/UtcNow' - instructions: | - Scan added/modified C# files for `DateTime.Now` or `DateTime.UtcNow`. - Pass if none. Fail if any usage — use `TimeProvider.System`. - - mode: error - name: 'No .Result/.Wait() blocking async' - instructions: | - Scan added/modified C# files for `.Result`, `.Wait()`, or - `.GetAwaiter().GetResult()`. Pass if none. Fail if any. - - mode: warning - name: 'No null-forgiving operator without justification' - instructions: | - Scan added/modified C# files for `!` (null-forgiving). Pass if - none. Fail if any `!` is added without an inline comment. - - mode: warning - name: 'Suppressions limited to MEAI001/OPENAI002' - instructions: | - Scan added/modified C# files for `#pragma warning disable` or - `[SuppressMessage]` attributes. Pass if none added. Fail if a - suppression is added for a code OTHER than MEAI001 or OPENAI002 - (the only acceptable suppressions per repo policy — MAF preview - API markers). Also fail if MEAI001/OPENAI002 is suppressed on - code that doesn't actually call MAF preview API. - - mode: warning - name: 'No preview-type leak into stable surface' - instructions: | - Scan added/modified C# files in src/ANcpLua.Agents/ (NOT in the - .Testing or .Testing.Workflows packages) for public methods or - types whose signature includes a Microsoft Agent Framework - experimental type. Pass if no public surface exposes preview - types, OR if the consuming method/type is itself marked with - `[Experimental]` or `[RequiresPreviewFeatures]`. Fail otherwise — - preview types must not leak into stable API silently. - + - mode: error + name: No Secrets Or PII + instructions: 'Pass/fail criteria: fail if the PR adds secrets, tokens, credentials, + private keys, real user data, personal data, API keys, connection strings, + or logs that expose sensitive request/response bodies. Test placeholders are + allowed only when obviously synthetic and documented.' + - mode: error + name: Generated Files Regenerated + instructions: 'Pass/fail criteria: if a source schema/model/template/generator + input changes, all generated downstream files required by the repository must + be updated in the same PR. Fail if generated files appear hand-edited without + the source generator/input change, or if generated output is missing after + source-model changes.' + - mode: error + name: Async And Cancellation Safe + instructions: 'Pass/fail criteria: fail C#/TS/Python changes that introduce + sync-over-async, unobserved fire-and-forget work, missing CancellationToken/AbortSignal + propagation on public/internal async boundaries, sleeps for synchronization, + or resource disposal paths that can drop in-flight work.' + - mode: error + name: Public Contract Documented + instructions: 'Pass/fail criteria: fail if public APIs, endpoint schemas, CLI + flags, config keys, package surfaces, storage formats, event schemas, MCP + tool schemas, or generated contracts change without matching docs/tests and + explicit compatibility notes in the PR description or changelog where the + repo uses one.' + - mode: error + name: CI Release Safety + instructions: 'Pass/fail criteria: fail workflow/build/release changes that + reduce required validation, introduce admin bypasses, broaden token permissions + without justification, leak secrets, remove concurrency where needed, make + publish steps run on the wrong trigger, or allow failed required checks to + be ignored.' + - mode: warning + name: Tests Match Risk + instructions: 'Pass/fail criteria: warn when production behavior changes without + focused tests or when tests only assert implementation details. Require integration/e2e + coverage for persistence, queues, external-service boundaries, generated contracts, + migrations, or user-visible workflows touched by the PR.' + - mode: warning + name: No Copy Paste Tables + instructions: 'Pass/fail criteria: warn when a PR introduces hardcoded repetitive + case lists, hand-maintained mapping tables, duplicate switch branches, or + parallel arrays where a data-driven or generated structure would be more maintainable. + Do not warn for small explicit protocol enums or tests where duplication clarifies + cases.' + - mode: warning + name: No Hidden Fallback Path + instructions: 'Pass/fail criteria: warn when code catches and silently falls + back, adds compatibility wrappers, duplicate implementation paths, or default + behavior that hides upstream failure unless the fallback is a documented product + requirement with tests for both paths.' + - mode: warning + name: Observability Boundary + instructions: 'Pass/fail criteria: warn when new services, background jobs, + queues, network clients, storage writers, MCP tools, or agent workflows lack + structured logging, tracing/metrics where the repository already uses them, + or actionable error context.' + - mode: warning + name: Dependency Hygiene + instructions: 'Pass/fail criteria: warn when dependencies are added without + clear need, version pins drift from central package files, lockfile changes + do not match manifest changes, transitive security-sensitive packages are + introduced, or package manager conventions are violated.' + - mode: error + name: No DateTime.Now/UtcNow + instructions: | + Scan added/modified C# files for `DateTime.Now` or `DateTime.UtcNow`. + Pass if none. Fail if any usage — use `TimeProvider.System`. + - mode: error + name: No .Result/.Wait() blocking async + instructions: | + Scan added/modified C# files for `.Result`, `.Wait()`, or + `.GetAwaiter().GetResult()`. Pass if none. Fail if any. + - mode: warning + name: No null-forgiving operator without justification + instructions: | + Scan added/modified C# files for `!` (null-forgiving). Pass if + none. Fail if any `!` is added without an inline comment. + - mode: warning + name: Suppressions limited to MEAI001/OPENAI002 + instructions: | + Scan added/modified C# files for `#pragma warning disable` or + `[SuppressMessage]` attributes. Pass if none added. Fail if a + suppression is added for a code OTHER than MEAI001 or OPENAI002 + (the only acceptable suppressions per repo policy — MAF preview + API markers). Also fail if MEAI001/OPENAI002 is suppressed on + code that doesn't actually call MAF preview API. + - mode: warning + name: No preview-type leak into stable surface + instructions: | + Scan added/modified C# files in src/ANcpLua.Agents/ (NOT in the + .Testing or .Testing.Workflows packages) for public methods or + types whose signature includes a Microsoft Agent Framework + experimental type. Pass if no public surface exposes preview + types, OR if the consuming method/type is itself marked with + `[Experimental]` or `[RequiresPreviewFeatures]`. Fail otherwise — + preview types must not leak into stable API silently. tools: + ast-grep: + essential_rules: true shellcheck: enabled: true - actionlint: - enabled: true + ruff: + enabled: false markdownlint: enabled: true + github-checks: + enabled: true + timeout_ms: 900000 + languagetool: + enabled: true + level: picky + biome: + enabled: false + hadolint: + enabled: false + swiftlint: + enabled: false + phpstan: + enabled: false + phpmd: + enabled: false + phpcs: + enabled: false + golangci-lint: + enabled: false + yamllint: + enabled: true gitleaks: enabled: true - github-checks: + trufflehog: enabled: true - timeout_ms: 180000 - ast-grep: - essential_rules: true - eslint: { enabled: false } - biome: { enabled: false } - oxc: { enabled: false } - ruff: { enabled: false } - pylint: { enabled: false } - flake8: { enabled: false } - phpstan: { enabled: false } - phpmd: { enabled: false } - phpcs: { enabled: false } - swiftlint: { enabled: false } - detekt: { enabled: false } - pmd: { enabled: false } - semgrep: { enabled: false } - opengrep: { enabled: false } - trufflehog: { enabled: false } - checkov: { enabled: false } - tflint: { enabled: false } - fortitudeLint: { enabled: false } - rubocop: { enabled: false } - buf: { enabled: false } - regal: { enabled: false } - clang: { enabled: false } - cppcheck: { enabled: false } - circleci: { enabled: false } - clippy: { enabled: false } - sqlfluff: { enabled: false } - trivy: { enabled: false } - prismaLint: { enabled: false } - shopifyThemeCheck: { enabled: false } - luacheck: { enabled: false } - brakeman: { enabled: false } - dotenvLint: { enabled: false } - htmlhint: { enabled: false } - stylelint: { enabled: false } - checkmake: { enabled: false } - osvScanner: { enabled: false } - blinter: { enabled: false } - yamllint: { enabled: false } - psscriptanalyzer: { enabled: false } - languagetool: { enabled: false } - hadolint: { enabled: false } - golangci-lint: { enabled: false } - + checkov: + enabled: true + tflint: + enabled: false + detekt: + enabled: false + eslint: + enabled: false + flake8: + enabled: false + fortitudeLint: + enabled: false + rubocop: + enabled: false + buf: + enabled: false + regal: + enabled: false + actionlint: + enabled: true + pmd: + enabled: false + clang: + enabled: false + cppcheck: + enabled: false + opengrep: + enabled: true + semgrep: + enabled: true + circleci: + enabled: false + clippy: + enabled: false + sqlfluff: + enabled: false + trivy: + enabled: true + prismaLint: + enabled: false + pylint: + enabled: false + oxc: + enabled: false + shopifyThemeCheck: + enabled: false + luacheck: + enabled: false + brakeman: + enabled: false + dotenvLint: + enabled: false + htmlhint: + enabled: false + stylelint: + enabled: false + checkmake: + enabled: false + osvScanner: + enabled: true + presidio: + enabled: true + blinter: + enabled: false + smartyLint: + enabled: false + emberTemplateLint: + enabled: false + psscriptanalyzer: + enabled: false chat: - auto_reply: true art: false + allow_non_org_members: false + auto_reply: true integrations: jira: usage: disabled linear: usage: disabled - knowledge_base: opt_out: false web_search: @@ -308,30 +512,169 @@ knowledge_base: code_guidelines: enabled: true filePatterns: - - '**/CLAUDE.md' - - '**/AGENTS.md' - - 'Directory.Build.props' - - 'Directory.Packages.props' - - 'Version.props' - - 'MAF1.4Mapping.md' + - CLAUDE.md + - AGENTS.md + - "**/CLAUDE.md" + - "**/AGENTS.md" + - ".editorconfig" + - README.md + - docs/**/*.md + - Directory.Build.props + - Directory.Packages.props + - global.json + - package.json + - pnpm-workspace.yaml + - Version.props learnings: - scope: auto + scope: global issues: - scope: auto - pull_requests: - scope: auto + scope: global jira: usage: disabled linear: usage: disabled + pull_requests: + scope: global mcp: - usage: auto - + usage: enabled + linked_repositories: + - repository: ANcpLua/ANcpLua.Analyzers + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ANcpLua.NET.Sdk + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/ANcpLua.OtelConventions.Api + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ANcpLua.Roslyn.Utilities + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/Arqio + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/BSc_2025_Alexander_Nachtmann + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/C64AIToolChain + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ErrorOrX + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/Nuke.OpenTelemetry.Conventions + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/Paperless + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ancplua-claude-plugins + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/dotcov + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/nhmw-digital-collection + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/qyl + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/safe-autoresearch + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/typespec-otel-semconv + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/yt-transcript + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. +code_generation: + docstrings: + language: en-US + path_instructions: + - path: "**/*.cs" + instructions: Generate XML docs for public/protected APIs and package surfaces. + Document intent, contracts, cancellation, exceptions, and compatibility. Do + not add obvious comments to private implementation details. + - path: "**/*.{ts,tsx}" + instructions: Generate concise TSDoc only for exported APIs, hooks, reusable + components, schemas, and non-obvious utility behavior. Avoid restating prop + names. + unit_tests: + path_instructions: + - path: "**/*.cs" + instructions: Use the repo test stack (xUnit v3/Microsoft Testing Platform where + present). Prefer focused unit tests plus integration tests for persistence, + queues, external clients, and generated contracts. Avoid sleeps; use fakes/signals. + - path: "**/*.{ts,tsx}" + instructions: Use the repo frontend test stack. Assert user-visible behavior + and accessible roles/states. Avoid waitForTimeout and brittle snapshots. + - path: "**/*.py" + instructions: Use pytest-style focused tests where a Python test stack exists. + Mock network and filesystem boundaries unless explicitly live-gated. issue_enrichment: auto_enrich: enabled: true planning: + enabled: true auto_planning: - enabled: false + enabled: true + labels: + - plan:auto + - enhancement + - bug + - good-first-issue + - help-wanted labeling: - auto_apply_labels: true \ No newline at end of file + labeling_instructions: + - label: area:api + instructions: Apply when REST, RPC, MCP, public endpoints, contracts, or request/response + models change. + - label: area:ui + instructions: Apply when frontend UI, styling, accessibility, or client-side + state changes. + - label: area:build + instructions: Apply when build scripts, NUKE/MSBuild, package managers, Docker, + CI, or release automation change. + - label: area:test + instructions: Apply when tests, fixtures, test infrastructure, coverage, or + snapshots change. + - label: area:docs + instructions: Apply when docs, AGENTS.md, CLAUDE.md, README, changelogs, specs, + or generated reference docs change. + - label: area:security + instructions: Apply when authentication, authorization, secrets, token handling, + logging of sensitive data, or dependency security changes. + - label: area:data + instructions: Apply when database schema, persistence, migrations, queues, storage, + serialization, generated data, or data contracts change. + - label: area:agents + instructions: Apply when agent prompts, MCP tools, AI workflow code, model calls, + tool schemas, or agent-facing instructions change. + - label: area:generated + instructions: Apply when generated files, generators, schemas, OpenAPI/TypeSpec/semconv + models, lockfiles, or generated docs change. + - label: breaking + instructions: Apply when public APIs, CLI flags, package surfaces, endpoint + schemas, storage formats, config keys, or emitted artifacts change incompatibly. + - label: review:slop + instructions: Auto-applied by CodeRabbit slop detection for low-quality AI-generated + changes. Do not apply manually. + - label: area:maf + instructions: Apply when Microsoft Agent Framework integration changes. + - label: area:testing-workflows + instructions: Apply when agent test workflow helpers change. + - label: area:testing + instructions: Apply when the PR modifies src/ANcpLua.Agents.Testing/ (preview-only). + - label: area:workflows + instructions: Apply when the PR modifies src/ANcpLua.Agents.Testing.Workflows/ + (preview-only). + - label: area:tests + instructions: Apply when the PR modifies tests/. + - label: area:tests-live + instructions: Apply when the PR modifies tests/ANcpLua.Agents.Tests.Live/ (live-API + tests). + - label: area:infra + instructions: Apply when the PR modifies .github/, eng/, or root build infrastructure. + auto_apply_labels: true