Skip to content

chore: add .coderabbit.yaml — Pro Plus CCC-triad config #313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ANcpLua merged 1 commit into from
Jun 11, 2026
Merged

chore: add .coderabbit.yaml — Pro Plus CCC-triad config #313

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 75 additions & 0 deletions .coderabbit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
#
# CodeRabbit configuration for the ancplua-claude-plugins marketplace.
#
# Base: the cc-triad-relay harness template — a Claude / Copilot / CodeRabbit
# "triad" review setup for Claude Code repos — tuned for this repo: markdown
# skills, JS + Python + shell plugin tooling, plugin.json manifests, and
# PreToolUse / Stop hooks. Static-analysis tools (shellcheck, markdownlint-cli2,
# ruff, eslint, yamllint, actionlint, gitleaks, …) are on by CodeRabbit's
# defaults, so they are not re-listed here.
#
# Docs: https://docs.coderabbit.ai/getting-started/configure-coderabbit
# Schema: https://coderabbit.ai/integrations/schema.v2.json

language: "en-US"
tone_instructions: "Be direct and constructive. Prioritize bugs, security issues, and fail-open or always-pass logic over style nits."

reviews:
profile: "chill" # actionable-only (CodeRabbit's default)
# request_changes_workflow makes the APPROVED state fire deterministically, so a
# PR-merge gate (the charon ferry) can rely on it. Flip to false if it feels too
# blocking day-to-day.
request_changes_workflow: true
high_level_summary: true
changed_files_summary: true
sequence_diagrams: false
poem: false
auto_review:
enabled: true
drafts: false
ignore_usernames:
- dependabot[bot]
- renovate[bot]
base_branches: # regex, not glob
- "^main$"
path_filters:
- "!**/*.lock"
- "!**/dist/**"
- "!**/build/**"
- "!**/node_modules/**"
- "!**/*.min.js"
- "!**/*.min.css"
- "!plugins/cc-plugin-eval/fixtures/**" # test scaffolding, not shipped
path_instructions:
- path: "plugins/*/skills/**/SKILL.md"
instructions: |
Skill definitions. The `description` frontmatter is the ONLY trigger mechanism — check it
encodes WHEN to use the skill (concrete "use when" phrasing), stays under the ~1024-char
cap, and has no colon-space that would break the YAML frontmatter. Flag task-style skills

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid flagging valid quoted colons

When a PR edits a SKILL.md whose description is quoted, a colon-space is valid YAML, but this instruction tells CodeRabbit to flag any colon-space unconditionally. Several current skill descriptions already use quoted strings with colon-space, so with request_changes_workflow: true this can produce blocking false positives for valid frontmatter; narrow this to unquoted descriptions or require parsing validation instead.

Useful? React with 👍 / 👎.

(long imperative numbered lists, no trigger) that should set disable-model-invocation.
- path: "plugins/*/hooks/**"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Include hook command scripts in hook guidance

This hook-specific instruction only matches files under plugins/*/hooks/**, but I checked the hook wiring and plugins/nihil/hooks/hooks.json runs its PreToolUse and Stop implementations from plugins/nihil/scripts/nihil-pretooluse.py and plugins/nihil/scripts/nihil-stop.py. Changes to those actual guard scripts therefore won't receive the fail-open/always-pass guidance this config is trying to enforce; add the wired hook script paths or broaden the glob.

Useful? React with 👍 / 👎.

instructions: |
PreToolUse / Stop hooks. Flag any guard or validator that FAIL-OPENS or always-passes while
presenting as protection, and any detection / regex that cannot match what it claims to
catch. Hooks must fail SAFE (allow the stop, never silently abort) and branch exhaustively
on their inputs.
- path: "**/*.{sh,bash}"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Match extensionless shell entrypoints

This glob only matches files ending in .sh or .bash, but I checked shell shebangs in the repo and found executable shell entrypoints without those extensions, including plugins/exodia/bin/findings-inject and plugins/metacognitive-guard/bin/commit-integrity-hook. PRs touching those scripts will miss the shell-specific review guidance, so include shebang-based bin paths or add explicit plugins/*/bin/** patterns.

Useful? React with 👍 / 👎.

instructions: |
Shell scripts that run under `set -euo pipefail`. Flag command substitutions that can abort
Comment on lines +57 to +59

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Limit strict-mode advice to strict scripts

This instruction is applied to every .sh/.bash file, but it assumes the script runs under set -euo pipefail; I inspected the current shell scripts and several matching files such as automation/scripts/bench.sh and automation/scripts/quick-gate.sh only use set -u. For PRs touching those non-strict scripts, CodeRabbit can block on unnecessary grep/command-substitution guards because the described abort semantics do not apply; scope this guidance to strict-mode scripts or phrase it as conditional.

Useful? React with 👍 / 👎.

the script on a non-match (e.g. an unguarded `grep` in `$(...)`), unquoted expansions, and
missing `|| true` / default-value guards.
- path: "**/.claude-plugin/plugin.json"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Cover marketplace-only version edits

CodeRabbit applies path_instructions only to files matching this path, so the manifest/marketplace sync check runs only when a plugin's plugin.json is in the diff. A PR that edits only /.claude-plugin/marketplace.json can still desynchronize marketplace versions without this instruction ever being used; add a second path instruction for the marketplace file or broaden the path.

Useful? React with 👍 / 👎.

instructions: |
Plugin manifest. Verify `name` is kebab-case and `version` is valid SemVer, and that the
version matches this plugin's entry in /.claude-plugin/marketplace.json — the two must stay
in sync.

chat:
auto_reply: true

knowledge_base:
code_guidelines:
enabled: true
filePatterns:
- "CLAUDE.md"
Loading