.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
#
# Single source of truth for CodeRabbit. Settings that previously lived only in
# the CodeRabbit dashboard (inheritance, auto_assign_reviewers, finishing
# touches, knowledge base, issue enrichment, presidio, auto-review label
# gating) are version-controlled here so every change is reviewable in a PR.
#
# Inheritance is OFF so that claim is actually true. With `inheritance: true`
# the org/dashboard config layers *underneath* this file, and a key set to an
# empty collection here does not read as "override the inherited value with
# nothing" — it reads as unset, and the inherited value survives. That is not
# hypothetical: #1425 set `reviews.auto_review.labels: []` to clear an
# inherited required-labels gate, and afterwards PRs were still landing
# "Review skipped: excluded by label configuration" (e.g. #1483, #1494) — a
# message that can only come from a label gate that is still active. Turning
# inheritance off is the only in-file lever that makes the empty list bind.
#
# Consequence: anything this file leaves unset now falls back to the CodeRabbit
# *schema* default, not to the dashboard. Set values explicitly — even at their
# default — when the default is the behaviour you actually want.
language: en-US
tone_instructions: >-
  Be assertive and direct. Focus on real bugs, security issues, and performance
  problems — not style nitpicks. Flag anything that could break in production.
  When you find an issue, explain why it matters and suggest a concrete fix.
early_access: true
# See the header: `true` lets the dashboard's required-labels gate outlive the
# `reviews.auto_review.labels: []` override below. Do not flip this back without
# first confirming the gate has been removed dashboard-side.
inheritance: false
reviews:
  profile: assertive
  request_changes_workflow: true
  high_level_summary: true
  high_level_summary_in_walkthrough: true
  review_details: true
  fail_commit_status: true
  auto_assign_reviewers: true
  auto_review:
    enabled: true
    # Drafts are not auto-reviewed (reduces cost/noise); mark the PR ready when you want feedback.
    drafts: false
    base_branches:
      - main
    # No label gate. This is the schema default, set explicitly to override an
    # inherited required-labels list from the dashboard/org config, which was
    # deadlocking auto-review against `auto_apply_labels: true` below.
    # This only takes effect because `inheritance: false` above — on its own
    # (as shipped in #1425) the empty list read as unset and the gate survived.
    #
    # The inherited gate required at least one of ~26 labels before a review
    # would start — a set that includes `architecture-gap`, `ci-cd`,
    # `pipeline-critical` and `placeholder-code`, i.e. labels CodeRabbit itself
    # applies *as part of* a review. A PR opens unlabelled, so the gate skipped
    # it ("Review skipped: excluded by label configuration"), and no label was
    # ever applied to un-skip it. Labelling afterwards does not retro-trigger.
    #
    # Net effect: auto-review never fired on open, and every review in this repo
    # had to be requested by hand with `@coderabbitai full review`.
    labels: []
    # Skip work-in-progress PRs that are not opened as drafts.
    ignore_title_keywords:
      - WIP
      - DO NOT MERGE
      - "[skip ci]"
  finishing_touches:
    simplify:
      enabled: true
  # Generated, vendored, lock files, and test directories are excluded so reviews stay
  # signal-rich. The hand-maintained SDK (sdk/python/**) is intentionally NOT
  # excluded — CLAUDE.md requires it stay in sync with the backend models. Test files are
  # excluded to prevent PII scanner false positives on mock/fixture data.
  path_filters:
    - "!**/package-lock.json"
    - "!**/*.lock"
    - "!src/dataconnect-generated/**"
    - "!**/__pycache__/**"
    - "!**/dist/**"
    - "!**/build/**"
    - "!**/.next/**"
    - "!**/.turbo/**"
    - "!**/coverage/**"
    - "!**/htmlcov/**"
    - "!tests/**"
  path_instructions:
    - path: "**/*.ts"
      instructions: >-
        This is a TypeScript/Next.js project. Focus on type safety, null checks,
        async/await error handling, and SSE stream lifecycle management. Flag any
        fetch() calls without AbortSignal.timeout. Check for proper error boundaries.
        Flag any TODO, placeholder, or stub implementations that are not production-ready.
        Enforce TypeScript strict mode compliance — flag implicit any, missing return types,
        and unsafe type assertions.
    - path: "**/*.tsx"
      instructions: >-
        React components in Next.js 16. Check for proper use of 'use client' directives,
        hook dependency arrays, memory leaks in useEffect, and accessibility issues.
        Flag any TODO or placeholder UI components that are not production-ready.
    - path: "**/*.py"
      instructions: >-
        Python backend code. Check for type hints, proper exception handling,
        async context manager usage, and potential blocking calls in async functions.
        Flag any bare except clauses or missing timeout parameters on network calls.
        CRITICAL: Flag any file that contains placeholder/stub implementations — especially
        in unified_ai_sdk. Any class or function that says "TODO: Replace with production
        implementation" or returns mock/fake data must be flagged as a blocking issue.
        Flag any code generation output that reaches users without AST validation or
        syntax checking.
    - path: "src/uvai/ml/**"
      instructions: >-
        ML model code with Ray Serve. Check for tensor shape mismatches, gradient
        accumulation bugs, checkpoint corruption risks, and thread safety issues.
    - path: "apps/web/src/app/api/**"
      instructions: >-
        Next.js API routes including SSE streaming endpoints. Critical path — check for
        stream lifecycle issues, controller.close() always being called, and fire-and-forget
        patterns for non-blocking post-processing. This was the source of a production
        95% hang bug (issue #139).
    - path: ".github/workflows/**"
      instructions: >-
        GitHub Actions workflows. Check for missing permissions, insecure token handling,
        proper use of continue-on-error vs actual error handling, and Node.js version
        compatibility (Node 20 deprecation warning).
    - path: "**/unified_ai_sdk/**"
      instructions: >-
        CRITICAL PATH: This is the AI provider integration layer. Flag any placeholder,
        mock, or stub implementation as a BLOCKING issue. Verify that OpenAI, Anthropic,
        and Google Gemini integrations are real production implementations — not TODO stubs.
        Any function that returns hardcoded/fake data instead of calling a real API must
        be flagged immediately.
    - path: "**/mcp*/**"
      instructions: >-
        MCP (Model Context Protocol) integration code. Verify tools follow proper MCP
        protocol structure — correct tool definitions, input schemas, and response formats.
        Flag any MCP tool that doesn't handle errors gracefully or lacks proper input validation.
    - path: "**/stainless*/**"
      instructions: >-
        Stainless SDK integration. Verify the SDK is actually wired into real API calls —
        not just installed as a dependency. Flag any ad-hoc fetch() calls that should be
        using the type-safe Stainless-generated client instead.
    - path: "sdk/python/eventrelay_sdk/**"
      instructions: >-
        Hand-maintained Python SDK that MUST stay in sync with
        src/youtube_extension/backend/api/v1/models.py (the source of truth). Flag drift:
        required backend fields weakened to Optional, enum fields typed as str instead of the
        SDK enum, or response shapes that diverge from the backend models.
  tools:
    shellcheck:
      enabled: true
    ruff:
      enabled: true
    biome:
      enabled: true
    hadolint:
      enabled: true
    markdownlint:
      enabled: true
    languagetool:
      enabled: true
    yamllint:
      enabled: true
    gitleaks:
      enabled: true
    checkov:
      enabled: true
    ast-grep:
      enabled: true
    presidio:
      enabled: true
  labeling_instructions:
    - label: security
      instructions: >-
        Apply when the PR touches authentication, API keys, token handling,
        or fixes a CVE/Dependabot alert.
    - label: pipeline-critical
      instructions: >-
        Apply when the PR modifies the SSE streaming pipeline, CloudEvents,
        or the agent orchestration flow.
    - label: ml-model
      instructions: >-
        Apply when the PR modifies Ray Serve models, weight persistence,
        or training data export.
    - label: frontend
      instructions: >-
        Apply when the PR modifies React components, pages, or UI logic.
    - label: ci-cd
      instructions: >-
        Apply when the PR modifies GitHub Actions workflows or deployment config.
    - label: architecture-gap
      instructions: >-
        Apply when the PR touches unified_ai_sdk, Stainless SDK integration, MCP tools,
        or any component identified as a gap in the Video-to-Anything architecture.
    - label: placeholder-code
      instructions: >-
        Apply when the PR contains or modifies TODO stubs, placeholder implementations,
        or mock data that is not production-ready.
  auto_apply_labels: true
chat:
  auto_reply: true
  instructions: >-
    When users ask "@coderabbitai plan", respond with an execution-focused plan:
    summarize completed findings, list pending tasks, and provide a concrete
    checklist to implement fixes and validate with tests.
knowledge_base:
  learnings:
    scope: auto
  linear:
    usage: enabled
  mcp:
    usage: enabled
issue_enrichment:
  auto_enrich:
    enabled: true
  labeling:
    auto_apply_labels: true