align skills repo with CodeRabbit CLI install flow#10
Conversation
- README: lead with `curl ... install.sh | sh`; document `integrations setup` / `integrations disable`, the TTY/consent decision matrix, and the `~/.coderabbit/skills.json` state file. Demote `npx skills add` and the Claude Code plugin to an "Alternative installers" section. - code-review SKILL.md: add `version: 0.1.0` so the CLI's versioned state tracking in `skills.json` isn't a no-op. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
📜 Recent review details🧰 Additional context used🪛 LanguageToolREADME.md[uncategorized] ~117-~117: The official name of this software platform is spelled with a capital “H”. (GITHUB) 🔇 Additional comments (5)
📝 WalkthroughWalkthroughReworked README to center installation/authentication on the CodeRabbit CLI, removed inline Changes
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 12-15: Add a short security warning around the "curl -fsSL
https://cli.coderabbit.ai/install.sh | sh" install line advising against piping
remote scripts directly to sh; then provide safer alternatives: a
package-manager installation command (if available), instructions to download
the script first and verify its contents (e.g., "curl -fsSL -o install.sh ...;
inspect install.sh; sh install.sh"), and guidance to verify a published checksum
or GPG signature before execution; update the same guidance near the duplicate
occurrence at line 31.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 8c90cc71-247f-4644-9f34-4063f0e74d8b
📒 Files selected for processing (2)
README.mdskills/code-review/SKILL.md
📜 Review details
🔇 Additional comments (2)
skills/code-review/SKILL.md (1)
4-4: Version frontmatter addition looks correct.Adding
version: 0.1.0in Line 4 is consistent with the integrations metadata contract and keeps this skill aligned with CLI sync behavior.README.md (1)
26-74: Installation flow docs are clear and actionable.The trigger ordering, behavior table, and
~/.coderabbit/skills.jsonsemantics are well documented and reduce ambiguity for users and support teams.
The Agent Skills spec (https://agentskills.io/specification) enforces a closed set of top-level frontmatter keys — name, description, license, allowed-tools, metadata, compatibility — and places `version` under `metadata`. Top-level `version:` fails `skills-ref validate`. The CLI parser in coderabbitai/mono#13542 needs a matching change: read `metadata.version` instead of top-level `version`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
triggers is not a spec field; nesting it under metadata keeps the frontmatter within the agentskills.io closed-set schema while preserving the trigger patterns the autofix skill relies on. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
README.md (1)
13-15:⚠️ Potential issue | 🟠 MajorAdd a safe-install note next to
curl | sh.This still promotes direct script execution without integrity/inspection guidance. Please add a short security note (package manager preferred; or download-inspect-then-run, plus checksum/signature verification when available).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 13 - 15, Update the README to add a short security note alongside the curl command that prefers using Homebrew or the documented package manager, and if users must use the curl | sh line ("curl -fsSL https://cli.coderabbit.ai/install.sh | sh") instruct them to instead download the script to a file first, inspect its contents, and verify its checksum/signature (pointing to the project's checksum/signature URL or verification instructions if available) before executing; keep the note concise and adjacent to the install command.
🧹 Nitpick comments (1)
README.md (1)
13-15: Quickstart/Installation copy is inconsistent about Homebrew.The text says “Use Homebrew or the install script,” but only the script path is shown inline. Either add the Homebrew command here or reword to “install via script (see CLI docs for alternatives).”
Also applies to: 25-27
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 13 - 15, The README's quickstart header saying "Use Homebrew or the install script" is inconsistent because only the script is shown; either add the Homebrew install command (e.g., the brew install invocation) next to the curl line or change the wording to explicitly indicate the script is shown and Homebrew is documented elsewhere (e.g., "Install via script (see CLI docs for Homebrew and other options)"). Update the same phrasing at the repeated block around lines 25-27 so both places are consistent and mention the Homebrew command or a pointer to the CLI docs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@README.md`:
- Around line 13-15: Update the README to add a short security note alongside
the curl command that prefers using Homebrew or the documented package manager,
and if users must use the curl | sh line ("curl -fsSL
https://cli.coderabbit.ai/install.sh | sh") instruct them to instead download
the script to a file first, inspect its contents, and verify its
checksum/signature (pointing to the project's checksum/signature URL or
verification instructions if available) before executing; keep the note concise
and adjacent to the install command.
---
Nitpick comments:
In `@README.md`:
- Around line 13-15: The README's quickstart header saying "Use Homebrew or the
install script" is inconsistent because only the script is shown; either add the
Homebrew install command (e.g., the brew install invocation) next to the curl
line or change the wording to explicitly indicate the script is shown and
Homebrew is documented elsewhere (e.g., "Install via script (see CLI docs for
Homebrew and other options)"). Update the same phrasing at the repeated block
around lines 25-27 so both places are consistent and mention the Homebrew
command or a pointer to the CLI docs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: b94743bc-e077-4de1-afb4-299a42902146
📒 Files selected for processing (1)
README.md
📜 Review details
🧰 Additional context used
🪛 LanguageTool
README.md
[uncategorized] ~95-~95: The official name of this software platform is spelled with a capital “H”.
Context: ... | | GitHub Copilot | .github/skills/ | ~/.copilot/skills/ ...
(GITHUB)
🔇 Additional comments (1)
README.md (1)
50-56: Nice docs restructuring for agent-specific integration paths.The Cursor/Codex guidance links and simplified supported-agents table improve navigation and reduce install ambiguity.
Also applies to: 79-117
1 participant
Summary
curl -fsSL https://cli.coderabbit.ai/install.sh | sh, and the Installation section documents the three entry points (install.sh auto-prompt,coderabbit integrations setup,coderabbit integrations disable) along with a trigger × preference × TTY decision table.~/.coderabbit/skills.jsonstate, the "where skills land" layout, and the opt-out semantics. Demotenpx skills addand the/plugin install coderabbitflow to an "Alternative installers" subsection.metadata.version: "0.1.0"to bothskills/code-review/SKILL.mdandskills/autofix/SKILL.mdso the CLI state tracking inskills.jsonrecords a real version per skill. Placed undermetadata:(not top-level) to conform to the agentskills.io spec — the closed-set validator inskills-refrejects unknown top-level keys, and the CLI'sparseSkillVersionregex trims each frontmatter line before matching, so the indented placement still parses.triggers:field inautofix/SKILL.mdundermetadata:for the same reason.Aligns this repo with the contract expected by the CLI's new integrations flow in coderabbitai/mono#13542. No skill behavior changes; docs + frontmatter only.
Test plan
grep -E '^\s*version:' skills/*/SKILL.mdshowsversion: "0.1.0"(indented undermetadata:) for bothcode-reviewandautofix.curl -fsSL https://cli.coderabbit.ai/install.sh | shon a clean machine prompts once, and accepting the prompt installs skills into every detected agent's global skills path.coderabbit integrations setupagainstmainof this repo installs all listed skills and populates~/.coderabbit/skills.jsonwith aversionper skill.coderabbit integrations setuprun short-circuits as a no-op (archive sha256 unchanged).coderabbit integrations disableflips the preference to opted-out without removing previously installed skill files.Summary by CodeRabbit
Documentation
Chores