From 2b7b12b7616c7f15b0d3176f5f6b1911e598865c Mon Sep 17 00:00:00 2001 From: Martin Kleinberger Date: Sat, 7 Nov 2026 13:43:32 +0000 Subject: [PATCH] [skip ci] review: whole repo --- .coderabbit.yaml | 78 +++++++++++++++++++++++++++++++ .github/dependabot.yml | 14 ++++++ .github/workflows/fleet-lint.yaml | 21 +++++++++ .github/workflows/validate.yaml | 21 +++++++++ README.md | 15 ++++++ 5 files changed, 149 insertions(+) create mode 100644 .coderabbit.yaml create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/fleet-lint.yaml create mode 100644 .github/workflows/validate.yaml create mode 100644 README.md diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 0000000..de3c80a --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,78 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +# +# Central CodeRabbit config for every repo of its owner. kleinbem/coderabbit is +# the source; sync-org.yaml copies it to kleinbem-dev/coderabbit. A repo's own +# .coderabbit.yaml replaces this file unless it sets `inheritance: true`, in +# which case it merges on top. The web UI settings don't apply while this file +# exists. + +language: en-GB +tone_instructions: "Short and direct. Lead with the problem and the fix. No praise, no filler." +early_access: false + +reviews: + profile: chill + # PRs auto-merge once green; reviews inform, they don't block. + request_changes_workflow: false + high_level_summary: true + poem: false + in_progress_fortune: false + sequence_diagrams: false + review_status: true + # The CodeRabbit check is required: a review that errors must block, not pass. + fail_commit_status: true + collapse_walkthrough: true + + auto_review: + enabled: true + # A skipped draft review passes the required check: a draft with auto-merge + # armed merges unreviewed the moment it goes ready. no-link: GitHub documents + # skipped as passing; nothing upstream to wait on. + drafts: true + # Never pause on a busy branch: a paused review reports "skipped", which + # passes the required check and lets the PR merge unreviewed (kleinbem#21). + auto_pause_after_reviewed_commits: 0 + # Lock bumps, docs syncs and dependency updates: not worth the rate limit. + ignore_usernames: + - "kleinbem-bot[bot]" + - "dependabot[bot]" + + # Generated or vendored files. + path_filters: + - "!**/flake.lock" + - "!**/Cargo.lock" + - "!**/package-lock.json" + - "!**/INFRASTRUCTURE.yaml" + - "!infra/*.json" + - "!traffic_data/**" + - "!governance-report.json" + - "!DASHBOARD.md" + + path_instructions: + - path: "**" + instructions: | + Every workaround or fix for someone else's bug (patch, override, pin, disabled tests, blacklisted module, feature switched off, "drop once …") needs a comment linking the upstream issue or PR it waits on: a URL or owner/repo#123. Flag new or changed workarounds without one, and links that point at a closed or merged report (the workaround may be droppable). A comment that only mentions a workaround may say "no-link: ". + - path: "**/*.nix" + instructions: | + NixOS fleet config. Check especially: + - sops.secrets for a feature must be gated behind that feature's enable option; a secret for a disabled feature breaks activation. + - /var is tmpfs on every host: new service state needs an impermanence/persistence entry. + - No plaintext secrets; they belong in kleinbem-secrets (sops). + - Prefer upstream nixpkgs options over custom wrappers. + - path: "**/*.sh" + instructions: "Scripts run under `set -euo pipefail`: flag unbound variables and unquoted expansions." + - path: ".github/workflows/**" + instructions: "Third-party actions must be pinned by commit SHA. Secrets must not reach pull_request runs from forks; flag pull_request_target and self-hosted runners." + - path: "**/*.tf" + instructions: "OpenTofu. Watch for changes that force replacement or destroy existing resources, and for secrets in plain variables or outputs." + # Agent skills and agents copied from upstream projects (e.g. sveltejs/ai-tools) + # stay byte-identical to upstream. no-link: not a bug workaround; doc fixes go upstream. + - path: ".agents/skills/**" + instructions: | + Vendored from upstream projects and kept identical to upstream. Only flag security and permission problems: agent permission modes or tool grants, commands that run code, unpinned installs or downloads, hooks. Skip wording, links, code examples, markdown style and version notes. + - path: ".claude/agents/**" + instructions: | + Vendored from upstream projects and kept identical to upstream. Only flag security and permission problems: agent permission modes or tool grants, commands that run code, unpinned installs or downloads, hooks. Skip wording, links, code examples, markdown style and version notes. + +chat: + auto_reply: true diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..695f84b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + # One grouped PR a week for pinned actions; the cooldown skips releases + # younger than a week. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + groups: + actions: + patterns: ["*"] + update-types: [minor, patch] diff --git a/.github/workflows/fleet-lint.yaml b/.github/workflows/fleet-lint.yaml new file mode 100644 index 0000000..20cdd60 --- /dev/null +++ b/.github/workflows/fleet-lint.yaml @@ -0,0 +1,21 @@ +name: fleet-lint + +on: + push: + branches: [main] + pull_request: + +permissions: {} + +jobs: + fleet-lint: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 # gitleaks scans every commit of the PR + persist-credentials: false + - uses: kleinbem/actions/nix-setup@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1 + - uses: kleinbem/actions/lint@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1 diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml new file mode 100644 index 0000000..4c2af6a --- /dev/null +++ b/.github/workflows/validate.yaml @@ -0,0 +1,21 @@ +name: Validate + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Check .coderabbit.yaml against CodeRabbit's schema + run: | + curl -fsSL https://coderabbit.ai/integrations/schema.v2.json -o /tmp/schema.json + pipx run check-jsonschema --schemafile /tmp/schema.json .coderabbit.yaml diff --git a/README.md b/README.md new file mode 100644 index 0000000..cd38684 --- /dev/null +++ b/README.md @@ -0,0 +1,15 @@ +# coderabbit + +Central [CodeRabbit](https://coderabbit.ai) config for every `kleinbem-dev` repo. +CodeRabbit reads `.coderabbit.yaml` from this repo for any repo without its own. +While it exists, the web UI settings don't apply. + +A repo that needs something extra adds its own `.coderabbit.yaml` with +`inheritance: true`, so it merges on top of this one instead of replacing it. +See [central configuration](https://docs.coderabbit.ai/configuration/central-configuration) +and [inheritance](https://docs.coderabbit.ai/configuration/configuration-inheritance). + +CI checks the file against CodeRabbit's schema on every PR. + +The `kleinbem` user account has its own copy in `kleinbem/coderabbit`. +Keep the two in step.