From 60288e684c458e758af86e1a422a829de13f13ae Mon Sep 17 00:00:00 2001 From: ancplua Date: Sat, 16 May 2026 15:55:21 +0200 Subject: [PATCH 1/3] chore(coderabbit): enable proplus review config --- .coderabbit.yaml | 515 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 406 insertions(+), 109 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 186eea2..cad21d1 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -1,48 +1,41 @@ # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json # -# Canonical CodeRabbit baseline for ANcpLua + O-ANcppLua repos. -# Synced into target repos by .github/workflows/enforce-repo-settings.yml. +# CodeRabbit Pro+ / Enterprise-grade review configuration for ANcpLua/ErrorOrX. +# Generated 2026-05-16 from the current schema-backed configuration reference. # -# Posture: advisory, never blocking. CodeRabbit comments on every PR but -# does NOT submit formal CHANGES_REQUESTED reviews and is NOT a required -# reviewer at the branch-protection level. Merges go through GitHub native -# auto-merge driven by Renovate's `platformAutomerge: true` (see -# ANcpLua/renovate-config) plus per-PR opt-in for human-authored work. +# Repository context: Error/result abstraction repository; review public API compatibility, generic typing, and package documentation. # -# Why this shape: -# - Sticky CHANGES_REQUESTED reviews from CodeRabbit were the only reason -# the legacy destructive-auto-merge.yml workflow needed --admin bypass. -# Removing the formal-review path removes the need for the bypass. -# - Tools and slop detection stay on — the review value is in the -# comments, not in the gate. -# -# Per-repo overrides: drop a `.coderabbit.yaml` in the target repo to -# override anything below. Repos with bespoke path_instructions (e.g. qyl) -# carry their own file; this template is the default for everything else. +# Posture: maximum useful review depth. CodeRabbit may spend extra context on +# cross-repo knowledge, web search, linked issues/PRs, security tools, +# pre-merge checks, finishing touches, and issue planning. The request-changes +# workflow is enabled intentionally so error-mode checks can block unsafe PRs. language: en-US -tone_instructions: >- - Principal-level stewardship. Architecture, maintainability, correctness only. - Flag duplication, spec drift, silent behavior changes. No praise. No nits. +tone_instructions: 'Principal/staff-level review. Spend extra context on architecture, + correctness, maintainability, security, CI/release safety, generated-file drift, + and cross-repo contract drift. Be direct: no praise, no filler, no style nits without + risk.' early_access: true enable_free_tier: false - +inheritance: false reviews: profile: assertive - - # Advisory, not blocking. The defining choice of this template. - request_changes_workflow: false - + request_changes_workflow: true high_level_summary: true + high_level_summary_instructions: 'Write a dense engineering summary: behavior changed, + risk surface, validation evidence, generated artifacts, and cross-repo implications. + Avoid praise and filler.' + high_level_summary_placeholder: "@coderabbitai summary" high_level_summary_in_walkthrough: true - auto_title_instructions: >- - Use conventional commits format with area prefix. Keep under 72 characters. - No periods. Examples: feat(api): add endpoint, fix(build): pin SDK. + auto_title_placeholder: "@coderabbitai title" + auto_title_instructions: 'Use conventional commits with an area prefix. Keep under + 72 characters and omit trailing punctuation. Examples: feat(api): add document + search filters, fix(build): pin Codecov upload.' review_status: true review_details: true commit_status: true - fail_commit_status: false - collapse_walkthrough: true + fail_commit_status: true + collapse_walkthrough: false changed_files_summary: true sequence_diagrams: true estimate_code_review_effort: true @@ -50,47 +43,130 @@ reviews: related_issues: true related_prs: true suggested_labels: true + labeling_instructions: + - label: area:api + instructions: Apply when REST, RPC, MCP, public endpoints, contracts, or request/response + models change. + - label: area:ui + instructions: Apply when frontend UI, styling, accessibility, or client-side state + changes. + - label: area:build + instructions: Apply when build scripts, NUKE/MSBuild, package managers, Docker, + CI, or release automation change. + - label: area:test + instructions: Apply when tests, fixtures, test infrastructure, coverage, or snapshots + change. + - label: area:docs + instructions: Apply when docs, AGENTS.md, CLAUDE.md, README, changelogs, specs, + or generated reference docs change. + - label: area:security + instructions: Apply when authentication, authorization, secrets, token handling, + logging of sensitive data, or dependency security changes. + - label: area:data + instructions: Apply when database schema, persistence, migrations, queues, storage, + serialization, generated data, or data contracts change. + - label: area:agents + instructions: Apply when agent prompts, MCP tools, AI workflow code, model calls, + tool schemas, or agent-facing instructions change. + - label: area:generated + instructions: Apply when generated files, generators, schemas, OpenAPI/TypeSpec/semconv + models, lockfiles, or generated docs change. + - label: breaking + instructions: Apply when public APIs, CLI flags, package surfaces, endpoint schemas, + storage formats, config keys, or emitted artifacts change incompatibly. + - label: review:slop + instructions: Auto-applied by CodeRabbit slop detection for low-quality AI-generated + changes. Do not apply manually. + auto_apply_labels: true suggested_reviewers: true auto_assign_reviewers: false + suggested_reviewers_instructions: + - reviewers: + - handle: ANcpLua + type: user + instructions: Suggest for PRs touching architecture, public APIs, security-sensitive + code, release automation, generated artifacts, or cross-repository contracts. in_progress_fortune: false poem: false enable_prompt_for_ai_agents: true + path_filters: + - "!**/*.g.cs" + - "!**/*.g.ts" + - "!**/*.g.sql" + - "!**/*.g.tsp" + - "!**/*.Designer.cs" + - "!**/Generated/**" + - "!**/generated/**" + - "!**/bin/**" + - "!**/obj/**" + - "!**/dist/**" + - "!**/node_modules/**" + - "!**/coverage/**" + - "!**/.angular/**" + - "!**/.vite/**" + - "!**/.next/**" + - "!**/*.min.js" + - "!**/*.min.css" + - "!**/package-lock.json" + - "!**/pnpm-lock.yaml" + - "!**/yarn.lock" + - "!Artifacts/**" + - "!artifacts/**" + - "!**/*.sarif" + - "!**/*.trx" + path_instructions: + - path: "**/*.{cs,csproj,props,targets,sln,slnx}" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*Tests/**/*.cs" + instructions: ".NET tests. Review that tests assert observable behavior, not implementation + details; async tests return Task; timing-sensitive tests use deterministic signals/fakes + instead of sleeps; Testcontainers resources are disposed; cancellation tokens + are threaded; mocks are strict where the repo convention expects strictness; + and new behavior has focused regression coverage. Do not accept weakening or + deleting truthful tests to make a PR pass." + - path: ".github/workflows/**" + instructions: GitHub Actions review. Pin third-party actions to immutable SHAs + unless the repo explicitly documents tag-pinning; keep permissions minimal per + job; use concurrency for push/PR workflows; avoid secrets in command lines/logs; + keep required and non-blocking jobs clear; preserve tokenless OIDC upload patterns + where used; and flag any admin-bypass, force-push, destructive cleanup, or auto-merge + behavior that can mask a failed required check. + - path: "**/*.{md,mdx}" + instructions: 'Documentation review. Treat docs as executable team memory: flag + instructions that disagree with actual scripts, package versions, branch protection, + generated-file workflows, or repo layout. Keep AGENTS.md/CLAUDE.md rules coherent + with automation. Do not request cosmetic prose changes unless ambiguity would + mislead an agent or maintainer.' + - path: "**/*.{g.cs,g.ts,g.sql,g.tsp,Designer.cs,generated.*,snap}" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. abort_on_close: true disable_cache: true - slop_detection: enabled: true - label: 'review:slop' - - path_filters: - - '!**/*.g.cs' - - '!**/*.g.ts' - - '!**/*.g.sql' - - '!**/*.g.tsp' - - '!**/*.Designer.cs' - - '!**/Generated/**' - - '!**/generated/**' - - '!**/bin/**' - - '!**/obj/**' - - '!**/dist/**' - - '!**/node_modules/**' - - '!**/*.min.js' - - '!**/*.min.css' - - '!**/package-lock.json' - - '!**/pnpm-lock.yaml' - - '!**/yarn.lock' - - '!Artifacts/**' - + label: review:slop auto_review: enabled: true + description_keyword: "@coderabbitai review" auto_incremental_review: true auto_pause_after_reviewed_commits: 0 - drafts: true ignore_title_keywords: - - '[skip review]' - ignore_usernames: - - 'renovate[bot]' - + - "[skip review]" + labels: [] + drafts: true + base_branches: + - ".*" + ignore_usernames: [] finishing_touches: docstrings: enabled: true @@ -98,44 +174,136 @@ reviews: enabled: true simplify: enabled: true - - # Hard gates are off in the baseline — they are repo-specific. qyl keeps - # its own pre_merge_checks block in qyl/.coderabbit.yaml. + custom: + - enabled: true + name: architecture hardening + instructions: Refactor only changed code where doing so removes meaningful duplication, + hidden fallback paths, tangled responsibilities, or brittle coupling. Preserve + behavior unless the PR explicitly changes it. Prefer deleting bad indirection + over adding wrappers. Include tests or note exactly why no test can cover + the improvement. + - enabled: true + name: security pass + instructions: Inspect the PR for secrets, injection risk, path traversal, unsafe + deserialization, authz/authn drift, overbroad logging, unsafe dependency changes, + and CI token permission expansion. Apply minimal fixes directly when safe; + otherwise leave precise comments. + - enabled: true + name: test gap closure + instructions: Generate focused tests for changed behavior and edge cases. Prefer + existing test frameworks and fixtures. Do not create broad snapshot churn + or tests that merely assert implementation details. Include regression tests + for bugs and riskier boundary changes. + - enabled: true + name: docs and changelog alignment + instructions: Update docs, README, AGENTS/CLAUDE guidance, generated reference + docs, and changelog entries only where the PR changes user-visible behavior, + public contracts, workflows, or agent instructions. Keep entries concise and + consistent with repo rules. + - enabled: true + name: performance and allocation pass + instructions: Review changed hot paths for avoidable allocations, repeated parsing, + unbounded concurrency, N+1 calls, missing streaming/backpressure, and inefficient + data structures. Apply low-risk improvements with tests or benchmarks where + the repo already has them. pre_merge_checks: + override_requested_reviewers_only: true docstrings: - mode: 'off' - title: mode: warning + threshold: 75 + title: + mode: error + requirements: Conventional commits with an area scope; under 72 characters; + no trailing punctuation; accurately names the highest-impact change. description: - mode: warning + mode: error issue_assessment: - mode: 'off' - + mode: warning + custom_checks: + - mode: error + name: No Secrets Or PII + instructions: 'Pass/fail criteria: fail if the PR adds secrets, tokens, credentials, + private keys, real user data, personal data, API keys, connection strings, + or logs that expose sensitive request/response bodies. Test placeholders are + allowed only when obviously synthetic and documented.' + - mode: error + name: Generated Files Regenerated + instructions: 'Pass/fail criteria: if a source schema/model/template/generator + input changes, all generated downstream files required by the repository must + be updated in the same PR. Fail if generated files appear hand-edited without + the source generator/input change, or if generated output is missing after + source-model changes.' + - mode: error + name: Async And Cancellation Safe + instructions: 'Pass/fail criteria: fail C#/TS/Python changes that introduce + sync-over-async, unobserved fire-and-forget work, missing CancellationToken/AbortSignal + propagation on public/internal async boundaries, sleeps for synchronization, + or resource disposal paths that can drop in-flight work.' + - mode: error + name: Public Contract Documented + instructions: 'Pass/fail criteria: fail if public APIs, endpoint schemas, CLI + flags, config keys, package surfaces, storage formats, event schemas, MCP + tool schemas, or generated contracts change without matching docs/tests and + explicit compatibility notes in the PR description or changelog where the + repo uses one.' + - mode: error + name: CI Release Safety + instructions: 'Pass/fail criteria: fail workflow/build/release changes that + reduce required validation, introduce admin bypasses, broaden token permissions + without justification, leak secrets, remove concurrency where needed, make + publish steps run on the wrong trigger, or allow failed required checks to + be ignored.' + - mode: warning + name: Tests Match Risk + instructions: 'Pass/fail criteria: warn when production behavior changes without + focused tests or when tests only assert implementation details. Require integration/e2e + coverage for persistence, queues, external-service boundaries, generated contracts, + migrations, or user-visible workflows touched by the PR.' + - mode: warning + name: No Copy Paste Tables + instructions: 'Pass/fail criteria: warn when a PR introduces hardcoded repetitive + case lists, hand-maintained mapping tables, duplicate switch branches, or + parallel arrays where a data-driven or generated structure would be more maintainable. + Do not warn for small explicit protocol enums or tests where duplication clarifies + cases.' + - mode: warning + name: No Hidden Fallback Path + instructions: 'Pass/fail criteria: warn when code catches and silently falls + back, adds compatibility wrappers, duplicate implementation paths, or default + behavior that hides upstream failure unless the fallback is a documented product + requirement with tests for both paths.' + - mode: warning + name: Observability Boundary + instructions: 'Pass/fail criteria: warn when new services, background jobs, + queues, network clients, storage writers, MCP tools, or agent workflows lack + structured logging, tracing/metrics where the repository already uses them, + or actionable error context.' + - mode: warning + name: Dependency Hygiene + instructions: 'Pass/fail criteria: warn when dependencies are added without + clear need, version pins drift from central package files, lockfile changes + do not match manifest changes, transitive security-sensitive packages are + introduced, or package manager conventions are violated.' tools: ast-grep: essential_rules: true - markdownlint: - enabled: true - hadolint: - enabled: true shellcheck: enabled: true - gitleaks: - enabled: true - actionlint: + ruff: + enabled: false + markdownlint: enabled: true github-checks: enabled: true timeout_ms: 900000 - presidio: + languagetool: enabled: true + level: picky biome: - enabled: true - languagetool: enabled: false - ruff: + hadolint: enabled: false - golangci-lint: + swiftlint: enabled: false phpstan: enabled: false @@ -143,36 +311,44 @@ reviews: enabled: false phpcs: enabled: false - swiftlint: - enabled: false - detekt: - enabled: false - pmd: - enabled: false - semgrep: - enabled: false - opengrep: + golangci-lint: enabled: false + yamllint: + enabled: true + gitleaks: + enabled: true trufflehog: - enabled: false + enabled: true checkov: - enabled: false + enabled: true tflint: enabled: false + detekt: + enabled: false eslint: enabled: false flake8: enabled: false + fortitudeLint: + enabled: false rubocop: enabled: false buf: enabled: false regal: enabled: false + actionlint: + enabled: true + pmd: + enabled: false clang: enabled: false cppcheck: enabled: false + opengrep: + enabled: true + semgrep: + enabled: true circleci: enabled: false clippy: @@ -180,7 +356,7 @@ reviews: sqlfluff: enabled: false trivy: - enabled: false + enabled: true prismaLint: enabled: false pylint: @@ -202,49 +378,134 @@ reviews: checkmake: enabled: false osvScanner: - enabled: false + enabled: true + presidio: + enabled: true blinter: enabled: false - yamllint: + smartyLint: + enabled: false + emberTemplateLint: enabled: false psscriptanalyzer: enabled: false - chat: - auto_reply: true art: false allow_non_org_members: false + auto_reply: true integrations: jira: usage: disabled linear: usage: disabled - knowledge_base: opt_out: false web_search: enabled: true - learnings: - scope: auto - issues: - scope: auto - pull_requests: - scope: auto code_guidelines: enabled: true filePatterns: - - 'CLAUDE.md' - - 'AGENTS.md' - - '**/CLAUDE.md' - - '**/AGENTS.md' - - '.editorconfig' + - CLAUDE.md + - AGENTS.md + - "**/CLAUDE.md" + - "**/AGENTS.md" + - ".editorconfig" + - README.md + - docs/**/*.md + - Directory.Build.props + - Directory.Packages.props + - global.json + - package.json + - pnpm-workspace.yaml + - Version.props + learnings: + scope: global + issues: + scope: global jira: usage: disabled linear: usage: disabled + pull_requests: + scope: global mcp: usage: enabled - + linked_repositories: + - repository: ANcpLua/ANcpLua.Agents + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ANcpLua.Analyzers + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ANcpLua.NET.Sdk + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/ANcpLua.OtelConventions.Api + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ANcpLua.Roslyn.Utilities + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/Arqio + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/BSc_2025_Alexander_Nachtmann + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/C64AIToolChain + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/Nuke.OpenTelemetry.Conventions + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/Paperless + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/ancplua-claude-plugins + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/dotcov + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/nhmw-digital-collection + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: O-ANcppLua/qyl + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/safe-autoresearch + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/typespec-otel-semconv + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. + - repository: ANcpLua/yt-transcript + instructions: Related ANcpLua/O-ANcppLua repository. Use for cross-repo API, package, + build, telemetry, and agent workflow context when reviewing changes. +code_generation: + docstrings: + language: en-US + path_instructions: + - path: "**/*.cs" + instructions: Generate XML docs for public/protected APIs and package surfaces. + Document intent, contracts, cancellation, exceptions, and compatibility. Do + not add obvious comments to private implementation details. + - path: "**/*.{ts,tsx}" + instructions: Generate concise TSDoc only for exported APIs, hooks, reusable + components, schemas, and non-obvious utility behavior. Avoid restating prop + names. + unit_tests: + path_instructions: + - path: "**/*.cs" + instructions: Use the repo test stack (xUnit v3/Microsoft Testing Platform where + present). Prefer focused unit tests plus integration tests for persistence, + queues, external clients, and generated contracts. Avoid sleeps; use fakes/signals. + - path: "**/*.{ts,tsx}" + instructions: Use the repo frontend test stack. Assert user-visible behavior + and accessible roles/states. Avoid waitForTimeout and brittle snapshots. + - path: "**/*.py" + instructions: Use pytest-style focused tests where a Python test stack exists. + Mock network and filesystem boundaries unless explicitly live-gated. issue_enrichment: auto_enrich: enabled: true @@ -253,8 +514,44 @@ issue_enrichment: auto_planning: enabled: true labels: - - 'plan:auto' - - 'good-first-issue' - - 'help-wanted' + - plan:auto + - enhancement + - bug + - good-first-issue + - help-wanted labeling: + labeling_instructions: + - label: area:api + instructions: Apply when REST, RPC, MCP, public endpoints, contracts, or request/response + models change. + - label: area:ui + instructions: Apply when frontend UI, styling, accessibility, or client-side + state changes. + - label: area:build + instructions: Apply when build scripts, NUKE/MSBuild, package managers, Docker, + CI, or release automation change. + - label: area:test + instructions: Apply when tests, fixtures, test infrastructure, coverage, or + snapshots change. + - label: area:docs + instructions: Apply when docs, AGENTS.md, CLAUDE.md, README, changelogs, specs, + or generated reference docs change. + - label: area:security + instructions: Apply when authentication, authorization, secrets, token handling, + logging of sensitive data, or dependency security changes. + - label: area:data + instructions: Apply when database schema, persistence, migrations, queues, storage, + serialization, generated data, or data contracts change. + - label: area:agents + instructions: Apply when agent prompts, MCP tools, AI workflow code, model calls, + tool schemas, or agent-facing instructions change. + - label: area:generated + instructions: Apply when generated files, generators, schemas, OpenAPI/TypeSpec/semconv + models, lockfiles, or generated docs change. + - label: breaking + instructions: Apply when public APIs, CLI flags, package surfaces, endpoint + schemas, storage formats, config keys, or emitted artifacts change incompatibly. + - label: review:slop + instructions: Auto-applied by CodeRabbit slop detection for low-quality AI-generated + changes. Do not apply manually. auto_apply_labels: true From ca16cc3fc28791d69e6afe6764a067c2cd794d80 Mon Sep 17 00:00:00 2001 From: ancplua Date: Sat, 16 May 2026 16:03:50 +0200 Subject: [PATCH 2/3] fix(coderabbit): review generated outputs --- .coderabbit.yaml | 60 ++++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 43 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index cad21d1..8a35e7e 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -90,13 +90,6 @@ reviews: poem: false enable_prompt_for_ai_agents: true path_filters: - - "!**/*.g.cs" - - "!**/*.g.ts" - - "!**/*.g.sql" - - "!**/*.g.tsp" - - "!**/*.Designer.cs" - - "!**/Generated/**" - - "!**/generated/**" - "!**/bin/**" - "!**/obj/**" - "!**/dist/**" @@ -107,9 +100,6 @@ reviews: - "!**/.next/**" - "!**/*.min.js" - "!**/*.min.css" - - "!**/package-lock.json" - - "!**/pnpm-lock.yaml" - - "!**/yarn.lock" - "!Artifacts/**" - "!artifacts/**" - "!**/*.sarif" @@ -521,37 +511,21 @@ issue_enrichment: - help-wanted labeling: labeling_instructions: - - label: area:api - instructions: Apply when REST, RPC, MCP, public endpoints, contracts, or request/response - models change. - - label: area:ui - instructions: Apply when frontend UI, styling, accessibility, or client-side - state changes. - - label: area:build - instructions: Apply when build scripts, NUKE/MSBuild, package managers, Docker, - CI, or release automation change. - - label: area:test - instructions: Apply when tests, fixtures, test infrastructure, coverage, or - snapshots change. - - label: area:docs - instructions: Apply when docs, AGENTS.md, CLAUDE.md, README, changelogs, specs, - or generated reference docs change. - - label: area:security - instructions: Apply when authentication, authorization, secrets, token handling, - logging of sensitive data, or dependency security changes. - - label: area:data - instructions: Apply when database schema, persistence, migrations, queues, storage, - serialization, generated data, or data contracts change. - - label: area:agents - instructions: Apply when agent prompts, MCP tools, AI workflow code, model calls, - tool schemas, or agent-facing instructions change. - - label: area:generated - instructions: Apply when generated files, generators, schemas, OpenAPI/TypeSpec/semconv - models, lockfiles, or generated docs change. - - label: breaking - instructions: Apply when public APIs, CLI flags, package surfaces, endpoint - schemas, storage formats, config keys, or emitted artifacts change incompatibly. - - label: review:slop - instructions: Auto-applied by CodeRabbit slop detection for low-quality AI-generated - changes. Do not apply manually. + - label: bug + instructions: Apply when the issue reports incorrect behavior, failing tests, + regressions, or broken automation. + - label: enhancement + instructions: Apply when the issue asks for new capability or meaningful improvement. + - label: documentation + instructions: Apply when the issue is primarily about docs, examples, guides, + or agent instructions. + - label: security + instructions: Apply when the issue involves secrets, auth, privacy, dependency + risk, or exploitability. + - label: dependencies + instructions: Apply when the issue is about package, SDK, runtime, or lockfile + updates. + - label: good-first-issue + instructions: Apply only when the issue is small, well-scoped, and low-risk + for a new contributor or agent. auto_apply_labels: true From 65466229cf1af68a5d8546b48704206fae501c6a Mon Sep 17 00:00:00 2001 From: ancplua Date: Sat, 16 May 2026 16:07:42 +0200 Subject: [PATCH 3/3] fix(coderabbit): use minimatch path globs --- .coderabbit.yaml | 105 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 99 insertions(+), 6 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 8a35e7e..bb1aa0c 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -105,7 +105,57 @@ reviews: - "!**/*.sarif" - "!**/*.trx" path_instructions: - - path: "**/*.{cs,csproj,props,targets,sln,slnx}" + - path: "**/*.cs" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*.csproj" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*.props" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*.targets" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*.sln" + instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, + package boundaries, and generated code as correctness concerns. Flag sync-over-async + (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without + lifecycle/error handling, missing CancellationToken on public/internal async + methods, `DateTime.Now`/`UtcNow` in domain logic instead of TimeProvider, null-forgiving + `!` without a documented proof, catch-and-fallback paths that hide failures, + and service registration drift. Prefer data-driven, composable code over hardcoded + switch/case tables. Public package/API surface changes need XML docs and explicit + compatibility notes. + - path: "**/*.slnx" instructions: C#/.NET review. Treat warnings, nullable annotations, async flow, package boundaries, and generated code as correctness concerns. Flag sync-over-async (`.Result`, `.Wait()`, `.GetAwaiter().GetResult()`), fire-and-forget work without @@ -129,13 +179,49 @@ reviews: keep required and non-blocking jobs clear; preserve tokenless OIDC upload patterns where used; and flag any admin-bypass, force-push, destructive cleanup, or auto-merge behavior that can mask a failed required check. - - path: "**/*.{md,mdx}" + - path: "**/*.md" + instructions: 'Documentation review. Treat docs as executable team memory: flag + instructions that disagree with actual scripts, package versions, branch protection, + generated-file workflows, or repo layout. Keep AGENTS.md/CLAUDE.md rules coherent + with automation. Do not request cosmetic prose changes unless ambiguity would + mislead an agent or maintainer.' + - path: "**/*.mdx" instructions: 'Documentation review. Treat docs as executable team memory: flag instructions that disagree with actual scripts, package versions, branch protection, generated-file workflows, or repo layout. Keep AGENTS.md/CLAUDE.md rules coherent with automation. Do not request cosmetic prose changes unless ambiguity would mislead an agent or maintainer.' - - path: "**/*.{g.cs,g.ts,g.sql,g.tsp,Designer.cs,generated.*,snap}" + - path: "**/*.g.cs" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.g.ts" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.g.sql" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.g.tsp" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.Designer.cs" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.generated.*" + instructions: Generated-output discipline. Do not suggest hand-editing generated + files. If generated output is wrong or missing, identify the generator/source + input and require regeneration in the same PR. If source model changes without + matching generated artifacts, flag it. + - path: "**/*.snap" instructions: Generated-output discipline. Do not suggest hand-editing generated files. If generated output is wrong or missing, identify the generator/source input and require regeneration in the same PR. If source model changes without @@ -288,7 +374,7 @@ reviews: timeout_ms: 900000 languagetool: enabled: true - level: picky + level: default biome: enabled: false hadolint: @@ -480,7 +566,11 @@ code_generation: instructions: Generate XML docs for public/protected APIs and package surfaces. Document intent, contracts, cancellation, exceptions, and compatibility. Do not add obvious comments to private implementation details. - - path: "**/*.{ts,tsx}" + - path: "**/*.ts" + instructions: Generate concise TSDoc only for exported APIs, hooks, reusable + components, schemas, and non-obvious utility behavior. Avoid restating prop + names. + - path: "**/*.tsx" instructions: Generate concise TSDoc only for exported APIs, hooks, reusable components, schemas, and non-obvious utility behavior. Avoid restating prop names. @@ -490,7 +580,10 @@ code_generation: instructions: Use the repo test stack (xUnit v3/Microsoft Testing Platform where present). Prefer focused unit tests plus integration tests for persistence, queues, external clients, and generated contracts. Avoid sleeps; use fakes/signals. - - path: "**/*.{ts,tsx}" + - path: "**/*.ts" + instructions: Use the repo frontend test stack. Assert user-visible behavior + and accessible roles/states. Avoid waitForTimeout and brittle snapshots. + - path: "**/*.tsx" instructions: Use the repo frontend test stack. Assert user-visible behavior and accessible roles/states. Avoid waitForTimeout and brittle snapshots. - path: "**/*.py"