|
| 1 | +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json |
| 2 | +language: "en-AU" |
| 3 | +early_access: false |
| 4 | + |
| 5 | +reviews: |
| 6 | + profile: "assertive" |
| 7 | + request_changes_workflow: true |
| 8 | + high_level_summary: true |
| 9 | + poem: false |
| 10 | + review_status: true |
| 11 | + collapse_walkthrough: false |
| 12 | + |
| 13 | + auto_review: |
| 14 | + enabled: true |
| 15 | + drafts: false |
| 16 | + |
| 17 | + path_instructions: |
| 18 | + - path: "**/*.rs" |
| 19 | + instructions: | |
| 20 | + Rust code. Check for unsafe blocks, unwrap abuse, missing error propagation, |
| 21 | + and clippy-level issues. Prefer Result over panic. Pay special attention to |
| 22 | + FFI boundaries (NAPI, PyO3) — verify buffer lengths, null checks, and that |
| 23 | + keys/secrets are zeroized on drop. |
| 24 | + - path: "**/*.py" |
| 25 | + instructions: | |
| 26 | + Python code. Enforce ruff compatibility, type hints on public APIs, |
| 27 | + guard clauses over nesting. No bare except clauses. Secrets must use |
| 28 | + pydantic SecretStr. Config via pydantic-settings only. |
| 29 | + - path: "**/*.ts" |
| 30 | + instructions: | |
| 31 | + TypeScript code. Strict mode, no `any` types on public APIs. |
| 32 | + Verify async error handling — no unhandled promise rejections. |
| 33 | + Check that NAPI bindings match Rust function signatures exactly. |
| 34 | + - path: "**/encryption/**" |
| 35 | + instructions: | |
| 36 | + Security-critical encryption code. Verify AAD v0x03 format compliance, |
| 37 | + key length validation (exactly 32 bytes), nonce uniqueness, and that |
| 38 | + keys never leak into error messages or logs. Cross-reference with |
| 39 | + protocol spec at https://github.com/cachekit-io/protocol. |
| 40 | + - path: ".github/workflows/**" |
| 41 | + instructions: | |
| 42 | + GitHub Actions workflows. All actions MUST be pinned to full 40-char SHA |
| 43 | + with a version comment (e.g., @abc123 # v6). Never use tag refs. |
| 44 | + - path: "**/Dockerfile*" |
| 45 | + instructions: | |
| 46 | + Dockerfiles. Check for missing cleanup (rm -rf /var/lib/apt/lists/*), |
| 47 | + unnecessary layers, running as root, and unpinned base images. |
| 48 | +
|
| 49 | + tools: |
| 50 | + shellcheck: |
| 51 | + enabled: true |
| 52 | + actionlint: |
| 53 | + enabled: true |
| 54 | + gitleaks: |
| 55 | + enabled: true |
| 56 | + ruff: |
| 57 | + enabled: true |
| 58 | + yamllint: |
| 59 | + enabled: true |
| 60 | + hadolint: |
| 61 | + enabled: true |
| 62 | + biome: |
| 63 | + enabled: true |
| 64 | + eslint: |
| 65 | + enabled: true |
| 66 | + |
| 67 | +chat: |
| 68 | + auto_reply: true |
0 commit comments