feat: add CodeRabbit configuration

[MitaliBhalla]

Adds .coderabbit.yaml with:

• Path-specific review rules for cmd/, pkg/, tests, .github/
• Custom recipes: @coderabbitai run security check
• Pre-merge checks for PR titles
• Auto-labeling and issue enrichment
• Skips vendor/generated/mock files

Test: @coderabbitai configuration on this PR

Made with Cursor

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f6da05ac-fbf5-4d9d-81ff-bd85c2c2064b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MitaliBhalla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [MitaliBhalla]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[MitaliBhalla]

@coderabbitai configuration

[coderabbitai]

Configuration used: Path: .coderabbit.yaml

CodeRabbit configuration

language: en-US
tone_instructions: ''
early_access: true
enable_free_tier: true
inheritance: false
reviews:
  profile: chill
  request_changes_workflow: false
  high_level_summary: true
  high_level_summary_instructions: ''
  high_level_summary_placeholder: '@coderabbitai summary'
  high_level_summary_in_walkthrough: true
  auto_title_placeholder: '@coderabbitai'
  auto_title_instructions: ''
  review_status: true
  review_details: false
  commit_status: true
  fail_commit_status: false
  collapse_walkthrough: false
  changed_files_summary: true
  sequence_diagrams: true
  estimate_code_review_effort: true
  assess_linked_issues: true
  related_issues: true
  related_prs: true
  suggested_labels: true
  labeling_instructions:
    - label: security
      instructions: >-
        Apply when PR touches authentication, authorization, credentials, or
        token handling
    - label: breaking-change
      instructions: Apply when public APIs, CLI flags, or config formats change incompatibly
    - label: dependencies
      instructions: Apply when go.mod or go.sum changes
    - label: documentation
      instructions: Apply when docs/, README, or help text changes
    - label: ci
      instructions: Apply when .github/workflows or Makefile changes
  auto_apply_labels: false
  suggested_reviewers: true
  auto_assign_reviewers: false
  in_progress_fortune: true
  poem: false
  enable_prompt_for_ai_agents: true
  path_filters:
    - '!vendor/**'
    - '!**/*.generated.go'
    - '!**/mock_*.go'
    - '!**/zz_generated*.go'
    - '!**/mocks/**'
  path_instructions:
    - path: cmd/**
      instructions: |
        CLI command code for OCM plugin (ocm-backplane).
        Focus on:
        - Consistent error messages with actionable guidance
        - Proper cobra command patterns (Use(), Short, Long, RunE)
        - Input validation before processing
        - Help text clarity and completeness
        - Exit codes (0=success, non-zero=error)
    - path: pkg/**
      instructions: |
        Core library code.
        Focus on:
        - API backward compatibility (don't break existing callers)
        - Thread safety for concurrent operations
        - Error wrapping with context (fmt.Errorf with %w)
        - No hardcoded credentials, URLs, or cluster names
        - Proper context.Context propagation
    - path: internal/**
      instructions: |
        Internal packages.
        Focus on:
        - Clear separation of concerns
        - No circular dependencies
        - Should not be imported outside this module
    - path: '**/*_test.go'
      instructions: |
        Test files.
        Ensure:
        - Table-driven tests for multiple cases
        - Cover error paths, not just happy paths
        - Meaningful test names describing behavior
        - No hardcoded credentials (use mocks/fakes)
        - Tests are deterministic (no flaky tests)
    - path: go.mod
      instructions: |
        Dependency changes.
        Check:
        - Is this a major version bump requiring code changes?
        - Are there known CVEs in new versions?
        - Is the dependency necessary or can stdlib be used?
        - Does it align with OpenShift dependency versions?
    - path: .github/**
      instructions: |
        GitHub Actions and workflows.
        Verify:
        - No secrets hardcoded in workflow files
        - Minimal permissions (principle of least privilege)
        - Pinned action versions (avoid `@main`, use `@v1.2.3` or SHA)
        - Proper error handling in scripts
    - path: hack/**
      instructions: |
        Build and development scripts.
        Verify:
        - Scripts are portable (avoid bashisms if targeting sh)
        - Proper error handling (set -e, set -o pipefail)
        - No hardcoded paths specific to one developer's machine
  abort_on_close: true
  disable_cache: false
  slop_detection:
    enabled: true
  auto_review:
    enabled: true
    description_keyword: ''
    auto_incremental_review: true
    auto_pause_after_reviewed_commits: 5
    ignore_title_keywords:
      - WIP
      - DO NOT MERGE
    labels: []
    drafts: false
    base_branches:
      - main
      - master
    ignore_usernames: []
  finishing_touches:
    docstrings:
      enabled: true
    unit_tests:
      enabled: true
    simplify:
      enabled: false
    custom: []
  pre_merge_checks:
    override_requested_reviewers_only: false
    docstrings:
      mode: warning
      threshold: 80
    title:
      mode: warning
      requirements: |
        PR title should be clear and descriptive.
        Preferred format: type: description
        Types: feat, fix, docs, chore, refactor, test, ci
        Example: "feat: add cluster login timeout flag"
    description:
      mode: warning
    issue_assessment:
      mode: warning
    custom_checks: []
  tools:
    ast-grep:
      rule_dirs: []
      util_dirs: []
      essential_rules: true
      packages: []
    shellcheck:
      enabled: true
    ruff:
      enabled: true
    markdownlint:
      enabled: true
    github-checks:
      enabled: true
      timeout_ms: 90000
    languagetool:
      enabled: true
      enabled_rules: []
      disabled_rules: []
      enabled_categories: []
      disabled_categories: []
      enabled_only: false
      level: default
    biome:
      enabled: true
    hadolint:
      enabled: true
    swiftlint:
      enabled: true
    phpstan:
      enabled: true
      level: default
    phpmd:
      enabled: true
    phpcs:
      enabled: true
    golangci-lint:
      enabled: true
    yamllint:
      enabled: true
    gitleaks:
      enabled: true
    trufflehog:
      enabled: true
    checkov:
      enabled: true
    tflint:
      enabled: true
    detekt:
      enabled: true
    eslint:
      enabled: true
    flake8:
      enabled: true
    fortitudeLint:
      enabled: true
    rubocop:
      enabled: true
    buf:
      enabled: true
    regal:
      enabled: true
    actionlint:
      enabled: true
    pmd:
      enabled: true
    clang:
      enabled: true
    cppcheck:
      enabled: true
    opengrep:
      enabled: true
    semgrep:
      enabled: true
    circleci:
      enabled: true
    clippy:
      enabled: true
    sqlfluff:
      enabled: true
    trivy:
      enabled: true
    prismaLint:
      enabled: true
    pylint:
      enabled: true
    oxc:
      enabled: true
    shopifyThemeCheck:
      enabled: true
    luacheck:
      enabled: true
    brakeman:
      enabled: true
    dotenvLint:
      enabled: true
    htmlhint:
      enabled: true
    stylelint:
      enabled: true
    checkmake:
      enabled: true
    osvScanner:
      enabled: true
    blinter:
      enabled: true
    smartyLint:
      enabled: true
    emberTemplateLint:
      enabled: true
    psscriptanalyzer:
      enabled: true
chat:
  art: true
  allow_non_org_members: true
  auto_reply: true
  integrations:
    jira:
      usage: auto
    linear:
      usage: auto
knowledge_base:
  opt_out: false
  web_search:
    enabled: true
  code_guidelines:
    enabled: true
    filePatterns: []
  learnings:
    scope: auto
  issues:
    scope: auto
  jira:
    usage: auto
    project_keys: []
  linear:
    usage: auto
    team_keys: []
  pull_requests:
    scope: auto
  mcp:
    usage: auto
    disabled_servers: []
  linked_repositories: []
code_generation:
  docstrings:
    language: en-US
    path_instructions: []
  unit_tests:
    path_instructions: []
issue_enrichment:
  auto_enrich:
    enabled: true
  planning:
    enabled: true
    auto_planning:
      enabled: true
      labels: []
  labeling:
    labeling_instructions: []
    auto_apply_labels: false

[krishvoor]

Do we have any auth n/z or token handling in the codebase?

[MitaliBhalla]

Yes — JWT parsing, OCM tokens, AWS STS AssumeRole, and cloud credentials (AWS/GCP). Around 60+ files touch auth/tokens.
Key areas: pkg/utils/jwt.go, pkg/awsutil/sts.go, pkg/credentials/, pkg/ocm/ocm.go

[krishvoor]

DRAFT
DNM
build(deps)

Variations among above, to allow coderabbit to review PR(s) in ready state

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.