|
| 1 | +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json |
| 2 | +language: en-US |
| 3 | + |
| 4 | +reviews: |
| 5 | + profile: assertive |
| 6 | + request_changes_workflow: true |
| 7 | + high_level_summary: true |
| 8 | + high_level_summary_instructions: >- |
| 9 | + Act as an adversarial second-opinion reviewer. Verify PR claims against implementation, |
| 10 | + contracts, and tests. Trace changed inputs through normal, boundary, error, cancellation, |
| 11 | + retry, and default paths and their consumers. Seek plausible counterexamples and regressions |
| 12 | + from removed safeguards. Report only concrete, actionable findings grounded in changed code |
| 13 | + and repository conventions. Prioritize correctness, security, data loss, lifecycle, and test |
| 14 | + gaps. Avoid speculative style comments and unrelated refactors. Search for existing helpers |
| 15 | + before suggesting abstractions, and distinguish actual defects from unsupported checks. |
| 16 | + high_level_summary_in_walkthrough: true |
| 17 | + review_status: true |
| 18 | + review_details: true |
| 19 | + collapse_walkthrough: true |
| 20 | + changed_files_summary: true |
| 21 | + poem: false |
| 22 | + |
| 23 | + auto_review: |
| 24 | + enabled: true |
| 25 | + drafts: false |
| 26 | + auto_incremental_review: true |
| 27 | + |
| 28 | + path_filters: |
| 29 | + - "!**/node_modules/**" |
| 30 | + - "!**/dist/**" |
| 31 | + - "!**/out/**" |
| 32 | + - "!**/coverage/**" |
| 33 | + - "!**/.turbo/**" |
| 34 | + - "!apps/vscode-e2e/.vscode-test/**" |
| 35 | + - "!bin/*.vsix" |
| 36 | + - "!pnpm-lock.yaml" |
| 37 | + - "!webview-ui/**/__screenshots__/**" |
| 38 | + |
| 39 | + path_instructions: |
| 40 | + - path: "**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}" |
| 41 | + instructions: >- |
| 42 | + Check strict typing and exhaustive behavior across normal, boundary, error, |
| 43 | + cancellation, retry, and compatibility paths. Verify promises and errors are handled, |
| 44 | + existing helpers are reused, and new code introduces no `any`, unjustified double |
| 45 | + assertions, floating promises, duplicated helpers, or increased lint suppressions. |
| 46 | +
|
| 47 | + - path: "**/*.{test,spec}.{ts,tsx,js,jsx}" |
| 48 | + instructions: >- |
| 49 | + Require regression coverage at the lowest valid harness with behavior-focused |
| 50 | + assertions, including relevant negative, error, false/unset, and boundary cases. |
| 51 | + Check cleanup and deterministic async behavior and prefer shared typed test helpers. |
| 52 | + Visible webview changes require a durable Playwright component snapshot; behavior-only |
| 53 | + changes do not. |
| 54 | +
|
| 55 | + - path: "**/__tests__/**" |
| 56 | + instructions: >- |
| 57 | + Require regression coverage at the lowest valid harness with behavior-focused |
| 58 | + assertions, including relevant negative, error, false/unset, and boundary cases. |
| 59 | + Check cleanup and deterministic async behavior and prefer shared typed test helpers. |
| 60 | + Visible webview changes require a durable Playwright component snapshot; behavior-only |
| 61 | + changes do not. |
| 62 | +
|
| 63 | + - path: "apps/vscode-e2e/**" |
| 64 | + instructions: >- |
| 65 | + Reserve end-to-end coverage for behavior that requires the real VS Code host, workspace |
| 66 | + APIs, extension activation, webview messaging, file watchers, or a full workflow. Keep |
| 67 | + detailed protocol, parsing, storage, retry, and edge cases at lower test layers. |
| 68 | +
|
| 69 | + - path: "{packages/types/src/**,webview-ui/src/components/settings/**,src/core/config/**,src/core/webview/**}" |
| 70 | + instructions: >- |
| 71 | + For persisted settings, verify the complete schema/storage/runtime/webview round trip, |
| 72 | + shared default semantics, and focused true plus false/unset tests. SettingsView controls |
| 73 | + must read and update local `cachedState`, include the value in the explicit save payload, |
| 74 | + and receive the persisted value back from extension state. |
| 75 | +
|
| 76 | + - path: "src/**" |
| 77 | + instructions: >- |
| 78 | + Verify extension/webview contracts, cancellation and error propagation, VS Code |
| 79 | + lifecycle correctness, and behavior under retries and partial failure. Check listeners, |
| 80 | + resources, and providers are disposed without stale state or duplicate work. |
| 81 | +
|
| 82 | + - path: "webview-ui/**" |
| 83 | + instructions: >- |
| 84 | + Check React state and effect dependencies, cleanup, accessibility, i18n, and light/dark |
| 85 | + theme behavior. New markup should use Tailwind; add VS Code CSS variables to |
| 86 | + `src/index.css` before Tailwind use. Use Vitest for behavior and Playwright component |
| 87 | + snapshots only for durable visible changes. |
| 88 | +
|
| 89 | + - path: "{src/api/**,src/core/prompts/**,src/core/tools/**,src/services/mcp/**,src/services/destructive-command-guard/**}" |
| 90 | + instructions: >- |
| 91 | + Treat model, provider, MCP, path, command, and tool data as untrusted. Check approval and |
| 92 | + allowlist bypasses, injection and traversal risks, secrets/PII exposure in logs, abort and |
| 93 | + stream behavior, retries, provider compatibility, and enforcement at execution time—not |
| 94 | + only at presentation or planning time. |
| 95 | +
|
| 96 | + - path: "{src/**/{state,history,task,tasks,service,services,cache,caches,worktree,worktrees}/**,packages/**/{state,history,task,tasks,service,services,cache,caches,worktree,worktrees}/**,webview-ui/src/**/{state,history,task,tasks,service,services,cache,caches,worktree,worktrees}/**}" |
| 97 | + instructions: >- |
| 98 | + Check persistence and lifecycle invariants: awaited atomic writes, rollback or explicit |
| 99 | + partial-failure behavior, cross-window state consistency, stale listeners/watchers, |
| 100 | + cancellation, idempotency, and safe restart/resume without lost or duplicated state. |
| 101 | +
|
| 102 | + - path: ".github/**" |
| 103 | + instructions: >- |
| 104 | + Require full commit SHA pins, least-privilege permissions, safe expression and shell |
| 105 | + interpolation, and trusted metadata handling. Privileged workflows must never check out, |
| 106 | + execute, install from, or otherwise trust a fork PR head. |
| 107 | +
|
| 108 | + - path: "{AGENTS.md,**/AGENTS.md,CONTRIBUTING.md,.changeset/**,CHANGELOG.md,src/CHANGELOG.md}" |
| 109 | + instructions: >- |
| 110 | + Enforce repository policy: routine PRs must not add changesets or edit changelogs except |
| 111 | + during release preparation. Verify documentation describes real behavior and contracts, |
| 112 | + and deprioritize prose-only nits that do not affect correctness or usability. |
| 113 | +
|
| 114 | + pre_merge_checks: |
| 115 | + custom_checks: |
| 116 | + - name: Regression evidence |
| 117 | + mode: warning |
| 118 | + instructions: >- |
| 119 | + Fail only when a concrete changed behavior lacks focused coverage at the lowest valid |
| 120 | + test layer, tests merely mirror implementation, an affected error/negative/unset branch |
| 121 | + is omitted, or a durable visible UI change lacks its required Playwright component |
| 122 | + snapshot. Do not demand tests for unchanged behavior, mechanical configuration, or every |
| 123 | + branch without a plausible regression scenario. Cite the changed behavior and missing |
| 124 | + evidence. |
| 125 | + - name: Trust and persistence invariants |
| 126 | + mode: error |
| 127 | + instructions: >- |
| 128 | + Fail only for a concrete changed path that leaks secrets or PII, trusts or executes |
| 129 | + unvalidated input, bypasses approval or allowlist controls, can lose persisted state due |
| 130 | + to a missing await, non-atomic write, or omitted default propagation, or leaks lifecycle |
| 131 | + resources. Cite the path and a plausible triggering scenario; pass when no such changed |
| 132 | + path exists. |
| 133 | +
|
| 134 | + tools: |
| 135 | + eslint: |
| 136 | + enabled: true |
| 137 | + actionlint: |
| 138 | + enabled: true |
| 139 | + shellcheck: |
| 140 | + enabled: true |
| 141 | + gitleaks: |
| 142 | + enabled: true |
| 143 | + semgrep: |
| 144 | + enabled: true |
0 commit comments