codereview guids

[akshaydeo]

Summary

Adds automated code review configuration for CodeRabbit and Greptile to enforce Bifrost-specific review rules consistently across all PRs.

Changes

• Added .coderabbit.yaml to configure CodeRabbit with assertive review profile, path-specific review instructions for each major area (core/, framework/, transports/, plugins/, ui/, tests/e2e/, docs/), and exclusion filters for generated/build output directories.
• Added .greptile/config.json with strictness level, comment types, and a set of named rules covering multi-module Go workspace hygiene, provider streaming client usage, pooled object reset discipline, ProviderQueue channel lifecycle safety, plugin hook ordering, config schema source-of-truth alignment, migration large-table safety, frontend crypto secure-context alerting, E2E data-testid preservation, and E2E payload construction constraints.
• Added .greptile/files.json to point Greptile at key reference files (AGENTS.md, transports/config.schema.json, go.work) with scoped applicability.
• Added .greptile/rules.md as a human-readable and machine-readable reference for all review priorities, repository-wide rules, and path-specific checks used by both automated reviewers and human contributors.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

No runtime behavior changes. Validate by opening a draft PR and confirming CodeRabbit and Greptile post review comments consistent with the configured rules and path instructions.

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

The Greptile rules explicitly flag browser crypto API usage in frontend code that could fail outside HTTPS contexts, and the governance plugin rules enforce fail-closed behavior for budget, rate-limit, and RBAC paths. No new secrets or auth surfaces are introduced by this PR.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: cd0bb9e1-4d99-42cb-bb99-66f04b385042

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-28-codereviewe-guides

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[akshaydeo]

• scim docs with webhook configuration #3831
• codereview guids #3830 👈 (View in Graphite)
• adds helm changelogs to the docs #3827
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Confidence Score: 4/5

Safe to merge after fixing the path_filters prefix bug in .coderabbit.yaml; all other files look correct.

The Greptile files are accurate and well-formed. The only defect is in .coderabbit.yaml where two path_filters entries lack the ! negation prefix — as written, CodeRabbit would skip reviewing every file in the repo except go.work.sum and **/go.sum, defeating the purpose of the config until corrected.

.coderabbit.yaml — the path_filters bug needs a fix before CodeRabbit will review any meaningful part of the codebase.

Important Files Changed

Filename	Overview
.coderabbit.yaml	Adds CodeRabbit AI review config with path_instructions per module area; go.work.sum and **/go.sum in path_filters are missing the ! prefix, which causes CodeRabbit to review only those two auto-generated files and skip everything else.
.greptile/config.json	Adds Greptile review configuration with strictness level, comment types, and ten named rules covering streaming, pooling, migrations, and UI security; content looks correct and consistent with the repo's review guidelines.
.greptile/files.json	Adds context file registry pointing Greptile to AGENTS.md, transports/config.schema.json, and go.work for scoped review context; no issues.
.greptile/rules.md	Adds Greptile rules document covering provider, streaming, pooling, migration, and UI patterns; content matches the repository's established conventions.

_{Reviews (1): Last reviewed commit: "codereview guids" | Re-trigger Greptile}

[greptile-apps]

The go.work.sum and **/go.sum entries in path_filters are missing the ! negation prefix. In CodeRabbit's gitignore-style filter semantics, mixing positive (no !) and negative (!) patterns means CodeRabbit will review only files matching the positive patterns — so only go.work.sum and **/go.sum would be reviewed, while all other changed files (Go source, docs, UI, etc.) would be silently skipped. The intent is almost certainly to exclude these auto-generated sum files, not to exclusively include them.

Suggested change

	- "go.work.sum"
	- "**/go.sum"
	- "!go.work.sum"
	- "!**/go.sum"

[akshaydeo]

Merge activity

• May 28, 8:48 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 28, 8:49 AM UTC: @akshaydeo merged this pull request with Graphite.