From ab143401e49cda4d26c263460d00f58bcc64a260 Mon Sep 17 00:00:00 2001 From: stranske Date: Thu, 9 Jul 2026 05:31:13 -0500 Subject: [PATCH 1/2] =?UTF-8?q?chore(coderabbit):=20align=20Workflows=20ro?= =?UTF-8?q?ot=20config=20=E2=80=94=20ignore=20maintenance=20bots=20+=20rel?= =?UTF-8?q?ease=20PRs,=20add=20core-path=20review=20guidance?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .coderabbit.yaml | 42 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 1fb6e358c..d7f992288 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -1,8 +1,11 @@ # CodeRabbit configuration — https://docs.coderabbit.ai/getting-started/configure-coderabbit +# Governs the Workflows repo ITSELF (which is the sync source, NOT a consumer). +# Keep the auto_review block aligned with templates/consumer-repo/.coderabbit.yaml. # Tuned for the stranske autonomous-agent fleet: -# - strict review of agent-authored PRs (profile: assertive) +# - assertive review of substantial agent-authored PRs # - ADVISORY / non-gating, matching the fleet rule that review never blocks a merge -# - a workflow-injection guard, since workflow YAML is synced to 9 consumer repos +# - maintenance-bot and generated release PRs do not spend review budget +# - guards for the workflow YAML and .github/scripts synced across the consumer repos language: en-US reviews: profile: assertive @@ -12,6 +15,27 @@ reviews: auto_review: enabled: true drafts: false # opener creates drafts; review when marked ready + # Skip automatic-review budget on maintenance-bot PRs (dependency bumps, CI/version + # syncs) and generated release PRs. agents-workflows-bot is intentionally NOT listed — + # it authors substantial agent code PRs that should still be reviewed; its release-please + # PRs are caught by the "chore(main): release" title filter below instead. + ignore_usernames: + - "renovate[bot]" + - "dependabot[bot]" + - "github-actions[bot]" + - "stranske-keepalive[bot]" + ignore_title_keywords: + - "chore(main): release" + - "chore: sync workflow templates" + - "sync workflow templates" + labels: + - "!sync" + - "!workflow:source-sync" + - "!workflow:source-maintenance" + - "!consumer-sync" + - "!integration-sync" + - "!workflows-sync" + - "!template-sync" path_filters: - "!**/*.lock" - "!**/vendor/**" @@ -20,7 +44,17 @@ reviews: - path: ".github/workflows/**" instructions: >- Flag template-injection, unpinned third-party actions, and spoofable bot-actor - checks — this workflow YAML is synced to 9 consumer repos, so one bug replicates - fleet-wide. + checks — this workflow YAML is synced across the consumer repos, so one bug + replicates fleet-wide. + - path: ".github/scripts/**" + instructions: >- + These scripts run with an elevated GITHUB_TOKEN across the fleet. Flag unhandled + promise rejections, missing validation of GitHub API / event payloads, command or + template injection, and spoofable bot-actor checks. + - path: "**/*.py" + instructions: >- + Prioritize correctness, error handling, and test coverage. Flag new or changed + behavior with no accompanying test, silently swallowed exceptions, and unguarded + NaN/None propagation in numeric or scoring code. chat: auto_reply: true From 221486b1767ea6e23b462f2988168306fd0a9e6b Mon Sep 17 00:00:00 2001 From: stranske Date: Thu, 9 Jul 2026 05:31:15 -0500 Subject: [PATCH 2/2] =?UTF-8?q?chore(coderabbit):=20consumer=20template=20?= =?UTF-8?q?=E2=80=94=20ignore=20release=20PRs=20+=20add=20core/migration?= =?UTF-8?q?=20path=20guidance?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- templates/consumer-repo/.coderabbit.yaml | 28 +++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/templates/consumer-repo/.coderabbit.yaml b/templates/consumer-repo/.coderabbit.yaml index 0f4c3cff9..6aa218df5 100644 --- a/templates/consumer-repo/.coderabbit.yaml +++ b/templates/consumer-repo/.coderabbit.yaml @@ -3,8 +3,8 @@ # Tuned for the stranske autonomous-agent fleet: # - assertive review of substantial agent-authored PRs # - advisory / non-gating, matching the fleet rule that review never blocks a merge -# - maintenance-bot PRs and generated sync/draft PRs do not spend review budget -# - a workflow-injection guard, since workflow YAML is synced across consumer repos +# - maintenance-bot, generated sync/release, and draft PRs do not spend review budget +# - path guidance concentrates review depth on core source, migrations, and workflow YAML language: en-US reviews: profile: assertive @@ -15,15 +15,16 @@ reviews: enabled: true drafts: false # opener creates drafts; review when marked ready # Skip automatic-review budget on maintenance-bot PRs (dependency bumps, CI/version - # syncs). agents-workflows-bot is intentionally NOT listed — it authors substantial - # agent code PRs (e.g. "Agent belt for #N") that should still be reviewed. + # syncs) and generated sync/release PRs. agents-workflows-bot is intentionally NOT listed + # — it authors substantial agent code PRs (e.g. "Agent belt for #N") that should still be + # reviewed; its release-please PRs are caught by the "chore(main): release" title filter. ignore_usernames: - "renovate[bot]" - "dependabot[bot]" - "github-actions[bot]" - "stranske-keepalive[bot]" - # Also skip generated maintenance / sync PRs by title and by negative label. ignore_title_keywords: + - "chore(main): release" - "chore: sync workflow templates" - "sync workflow templates" labels: @@ -44,5 +45,22 @@ reviews: Flag template-injection, unpinned third-party actions, and spoofable bot-actor checks — this workflow YAML is synced across consumer repos, so one bug replicates fleet-wide. + - path: "**/*.py" + instructions: >- + Prioritize correctness, error handling, and test coverage. Flag new or changed + behavior with no accompanying test, silently swallowed exceptions, and unguarded + NaN/None propagation in numeric or scoring code. + - path: "**/alembic/**" + instructions: >- + Verify migrations are reversible and portable across SQLite (CI) and PostgreSQL + (prod): keep constraint/index identifiers within Postgres' 63-char limit, use + op.f() for auto-named constraints, and guard dialect-specific SQL. Flag a + downgrade() that does not invert upgrade(). + - path: "**/migrations/**" + instructions: >- + Verify migrations are reversible and portable across SQLite (CI) and PostgreSQL + (prod): keep constraint/index identifiers within Postgres' 63-char limit, use + op.f() for auto-named constraints, and guard dialect-specific SQL. Flag a + downgrade() that does not invert upgrade(). chat: auto_reply: true