chore: add .coderabbit.yaml — Pro Plus CCC-triad config - #313
Conversation
Real config derived from the cc-triad-relay harness template (a Claude / Copilot / CodeRabbit triad setup for Claude Code repos), tuned for this marketplace: skill SKILL.md trigger quality, hook fail-open / always-pass detection (the exact class this repo's honesty audit hunts), shell pipefail guards, and plugin.json <-> marketplace.json version sync. Static-analysis tools (shellcheck, markdownlint-cli2, ruff, eslint, yamllint, actionlint, gitleaks) ride CodeRabbit's defaults. request_changes_workflow: true so the APPROVED state is deterministic for a PR-merge gate (charon). Every key attested against the official schema + real configs (voxel51, openshift, scikit-image, cc-triad-relay) — nothing hand-invented. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR introduces a complete ChangesCodeRabbit Configuration for Plugin Marketplace
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Adds a repository-level .coderabbit.yaml to (re)enable and tune CodeRabbit reviews for this Claude Code plugin marketplace repo, including auto-review behavior, file/path targeting, and per-path review instructions aligned with the repo’s plugin/skills/hooks structure.
Changes:
- Introduces a CodeRabbit v2 configuration with auto-review enabled (non-drafts) and bot author exclusions.
- Applies path filters to avoid reviewing generated/vendor artifacts (lockfiles, dist/build, node_modules, minified assets, fixtures).
- Adds path-specific review instructions for
SKILL.md, hooks, shell scripts, and plugin manifests; enables CodeRabbit knowledge-base code guidelines fromCLAUDE.md.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7b47ed39b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Shell scripts that run under `set -euo pipefail`. Flag command substitutions that can abort | ||
| the script on a non-match (e.g. an unguarded `grep` in `$(...)`), unquoted expansions, and | ||
| missing `|| true` / default-value guards. | ||
| - path: "**/.claude-plugin/plugin.json" |
There was a problem hiding this comment.
CodeRabbit applies path_instructions only to files matching this path, so the manifest/marketplace sync check runs only when a plugin's plugin.json is in the diff. A PR that edits only /.claude-plugin/marketplace.json can still desynchronize marketplace versions without this instruction ever being used; add a second path instruction for the marketplace file or broaden the path.
Useful? React with 👍 / 👎.
| encodes WHEN to use the skill (concrete "use when" phrasing), stays under the ~1024-char | ||
| cap, and has no colon-space that would break the YAML frontmatter. Flag task-style skills | ||
| (long imperative numbered lists, no trigger) that should set disable-model-invocation. | ||
| - path: "plugins/*/hooks/**" |
There was a problem hiding this comment.
This hook-specific instruction only matches files under plugins/*/hooks/**, but I checked the hook wiring and plugins/nihil/hooks/hooks.json runs its PreToolUse and Stop implementations from plugins/nihil/scripts/nihil-pretooluse.py and plugins/nihil/scripts/nihil-stop.py. Changes to those actual guard scripts therefore won't receive the fail-open/always-pass guidance this config is trying to enforce; add the wired hook script paths or broaden the glob.
Useful? React with 👍 / 👎.
| instructions: | | ||
| Skill definitions. The `description` frontmatter is the ONLY trigger mechanism — check it | ||
| encodes WHEN to use the skill (concrete "use when" phrasing), stays under the ~1024-char | ||
| cap, and has no colon-space that would break the YAML frontmatter. Flag task-style skills |
There was a problem hiding this comment.
When a PR edits a SKILL.md whose description is quoted, a colon-space is valid YAML, but this instruction tells CodeRabbit to flag any colon-space unconditionally. Several current skill descriptions already use quoted strings with colon-space, so with request_changes_workflow: true this can produce blocking false positives for valid frontmatter; narrow this to unquoted descriptions or require parsing validation instead.
Useful? React with 👍 / 👎.
| presenting as protection, and any detection / regex that cannot match what it claims to | ||
| catch. Hooks must fail SAFE (allow the stop, never silently abort) and branch exhaustively | ||
| on their inputs. | ||
| - path: "**/*.{sh,bash}" |
There was a problem hiding this comment.
This glob only matches files ending in .sh or .bash, but I checked shell shebangs in the repo and found executable shell entrypoints without those extensions, including plugins/exodia/bin/findings-inject and plugins/metacognitive-guard/bin/commit-integrity-hook. PRs touching those scripts will miss the shell-specific review guidance, so include shebang-based bin paths or add explicit plugins/*/bin/** patterns.
Useful? React with 👍 / 👎.
| - path: "**/*.{sh,bash}" | ||
| instructions: | | ||
| Shell scripts that run under `set -euo pipefail`. Flag command substitutions that can abort |
There was a problem hiding this comment.
This instruction is applied to every .sh/.bash file, but it assumes the script runs under set -euo pipefail; I inspected the current shell scripts and several matching files such as automation/scripts/bench.sh and automation/scripts/quick-gate.sh only use set -u. For PRs touching those non-strict scripts, CodeRabbit can block on unnecessary grep/command-substitution guards because the described abort semantics do not apply; scope this guidance to strict-mode scripts or phrase it as conditional.
Useful? React with 👍 / 👎.
…in via #313 after this branch was cut Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…/workflows + refresh counts/CHANGELOG (#311) * docs: derot hygiene sweep — purge dead refs to deleted tooling/config/workflows + refresh counts/CHANGELOG Four read-only rot-scouts verified every item against ground truth (13 plugins / 24 commands / 24 skills / 30 agents, excluding cc-plugin-eval/fixtures). This applies the corrected values so the docs describe the repo that actually exists at HEAD. What was contradicting reality, now fixed: docs/ARCHITECTURE.md - Count comment 9/22/14/21 → 13/24/24/30; "7 custom plugins" → 13; plugin tree gains charon, derot, nihil, tomevault-publish (alphabetical, └── closes the box). - Drop dead config lines: .coderabbit.yaml (no such file) and .markdownlint.json (actual name is .markdownlint.jsonc). - .claude/ tree now reflects disk: commands/ rules/ workflows/ worktrees/ — not settings.json; rules/ holds the Opus 4.8 System Card PDF, not "auto-loaded rules". - workflows/ listed the two non-existent CodeRabbit/Codex YAMLs; real set is auto-merge.yml, ci.yml, claude.yml. - Delete dangling pointers to files that do not exist: solid-principles.md, devops-calms.md, and the "CLAUDE.md Section 5.5.1" cross-reference; remove the weave-validate.sh wrapper mention (tooling/ was deleted). claude-code-review.yml → claude.yml. Last Verified 2026-06-06 → 2026-06-11. docs/decisions/ADR-0001 - "tooling/ and docs/" → "docs/" (tooling/ removed); spec.md (never existed) → the docs/specs/ documents, in all three places it was cited. .github/copilot-instructions.md - Replace every weave-validate.sh / tooling/ reference with the real gate: validation is ci.yml (inline jq for JSON syntax + plugin.json/marketplace.json fields + source-dir existence + SKILL.md frontmatter, shellcheck, markdownlint, actionlint). - Structure tree: 3-plugin enumeration (exodia tagged v2.0.0) → "13 plugins — see marketplace.json"; dependabot.yml moved to .github/ (it is not under workflows/); .claude/rules/ note corrected; auto-merge.yml + claude.yml added; tooling/ subtree deleted. claude-code-review.yml → claude.yml on @claude mentions. README.md - "GitHub review automation" named codex-code-review.yml + OPENAI_API_KEY, neither of which exists. Rewritten to reality: auto-merge.yml recognizes codex/ + copilot/ branches and chatgpt-codex-connector[bot] approvals; claude.yml runs on @claude. plugins/cc-plugin-eval/README.md - Illustrative marketplace snippet version 0.1.0 → 0.2.0 (matches plugin.json + marketplace.json). CHANGELOG.md - [Unreleased] gains the #286–#310 wave (each entry grounded against git log + current plugin.json): charon 0.1.0→0.2.1, derot 0.2.0 (+/depmigrate), nihil 0.3.0 (/nihil:raze), tomevault-publish 0.1.0, cc-plugin-eval CC710 0.2.0; exodia 3.x /exodia:fix collapse; and the #289/#299 removal of the AGENTS.md/GEMINI.md single-source model (CLAUDE.md is now canonical). Left untouched on purpose: docs/specs/spec-0004 (Status: Parked — frozen snapshot), README's "Tri-AI … CodeRabbit" line (CodeRabbit unverified, flagged for human), and tome.json (generated by the TomeVault crawler). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(architecture): restore .coderabbit.yaml refs — file landed on main via #313 after this branch was cut Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Revives CodeRabbit in the CCC trio (Claude / Copilot / CodeRabbit) now that Pro Plus is active (comped through Jul 10).
Not hand-rolled — derived from the best real configs on GitHub (you asked for "best 3, call it"): the
cc-triad-relayharness template (a Claude/Copilot/CodeRabbit triad setup built for Claude Code repos) as the base, withpath_filters/ multi-language ideas fromvoxel51/fiftyoneandopenshift/networking-console-plugin. Every key validated against CodeRabbit's officialschema.v2.json.Tuned for this repo:
path_instructionsfor SKILL.md (description = the only trigger; cap; colon-space YAML break), hooks (flag fail-open / always-pass guards + unmatchable detection — the exact class the honesty audit hunts), shell (set -euo pipefailabort traps), and plugin.json ↔ marketplace.json version sync.request_changes_workflow: true→ deterministicAPPROVEDstate, so a PR-merge gate (charon) can rely on it.fixtures/excluded;dependabot/renovateignored;base_branches: ^main$.This PR is also the live test: if CodeRabbit is back, it should auto-review this very PR within a couple minutes.
🤖 Generated with Claude Code
Summary by CodeRabbit