nl2shell-web/.coderabbit.yaml at main · nl2shell/nl2shell-web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

language: "en-US"
tone_instructions: "Be direct and technical. Focus on security, performance, and Next.js best practices."
early_access: false

reviews:
  profile: "assertive"
  request_changes_workflow: true
  high_level_summary: true
  high_level_summary_placeholder: "@coderabbitai summary"
  high_level_summary_instructions: >-
    Summarize in 3-5 bullets. Note any changes to API routes, security headers,
    or client-side behavior. Flag hydration risks.
  auto_title_placeholder: "@coderabbitai"
  auto_title_instructions: "Conventional commit format: type(scope): description"

  review_status: true
  commit_status: true
  sequence_diagrams: true
  poem: false

  suggested_labels: true
  labeling_instructions:
    - label: "security"
      instructions: "Apply when PR touches API routes, rate limiting, CSP, or user input handling."
    - label: "ux"
      instructions: "Apply when PR changes UI components, voice input, or user-facing behavior."

  path_filters:
    - "!node_modules/**"
    - "!.next/**"
    - "!bun.lock"
    - "!**/*.min.js"
    - "!coverage/**"

  path_instructions:
    - path: "app/api/**"
      instructions: >-
        Security focus: validate all inputs. Rate limiting must be in place.
        Gradio client calls must have timeout handling. Check for response
        validation — never trust raw model output. Verify CSP and security headers.
    - path: "components/**"
      instructions: >-
        Check for hydration mismatches — browser-only APIs (Web Speech, window, navigator)
        must be accessed in useEffect or with client-side guards. Verify accessibility
        (aria labels, keyboard navigation). No inline styles — use Tailwind.
    - path: "hooks/**"
      instructions: >-
        Hooks must handle SSR — no window/navigator access during initial render.
        Check cleanup in useEffect return values. Verify error states are handled.
    - path: "lib/safety.ts"
      instructions: >-
        This is the dangerous command detection module. Any changes must maintain
        coverage of all OWASP-relevant shell patterns. Regex must be tested against
        both positive and negative cases.
    - path: "lib/clean-response.ts"
      instructions: >-
        This strips model output artifacts. Changes must not break the cleaning
        pipeline — test with markdown fences, backticks, preambles, and comment lines.

  auto_review:
    enabled: true
    auto_incremental_review: true
    ignore_title_keywords:
      - "WIP"
      - "DRAFT"
    drafts: false

  finishing_touches:
    docstrings:
      enabled: true
    unit_tests:
      enabled: true

  tools:
    eslint:
      enabled: true
    gitleaks:
      enabled: true
    hadolint:
      enabled: true
    markdownlint:
      enabled: true
    ast-grep:
      essential_rules: true

chat:
  auto_reply: true

knowledge_base:
  opt_out: false
  web_search:
    enabled: true
  learnings:
    scope: "local"