CodeRabbit: repository review configuration

[mrrobertkent]

Tunes CodeRabbit for a security-sensitive verifier:

• Path instructions for internal/verify (constant-time comparisons, raw-body HMAC, fail-closed checks, no secrets in errors, fuzz coverage), internal/gateway (bounded reads, verified bytes only, header allowlist, retries, shutdown), internal/config, workflows and examples.
• Concise tone, chill profile, no poem or fortune; drafts and Dependabot PRs skipped (Socket covers dependency changes).
• Lockfile, build output and PNG assets filtered out.
• CodeRabbit's golangci-lint run is off; CI runs golangci-lint as a required check.

Validated against https://coderabbit.ai/integrations/schema.v2.json.

Summary by CodeRabbit

• Chores
  • Added automated review settings with tailored checks for security and correctness across key areas of the project.
  • Configured review scope and exclusions to focus feedback on relevant changes. No end-user functionality changed.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: mrrobertkent/hookgate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0bb70164-e23c-438e-8a3f-3643ae2707bc

📥 Commits

Reviewing files that changed from the base of the PR and between aa4dfa4 and 426cac3.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: mrrobertkent/hookgate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7eb36761-a14d-4480-b93c-eca1bb9ac611

📥 Commits

Reviewing files that changed from the base of the PR and between 15577e1 and 9a777af.

📒 Files selected for processing (1)

• .coderabbit.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds .coderabbit.yaml with review settings, path exclusions, and instructions for selected project areas. It also disables the golangci-lint tool.

Changes

CodeRabbit review configuration

Layer / File(s)	Summary
Review settings and guidance .coderabbit.yaml	Sets review language and profile, enables automatic reviews for eligible changes, excludes selected paths, adds path-specific instructions, and disables golangci-lint.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 9a777

The review configuration is mergeable after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 9a777

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .coderabbit.yaml: Adds CodeRabbit review settings, excluded paths, and path-specific instructions for verification, gateway, configuration, workflow, and example changes; disables the golangci-lint tool.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the configuration changes, but it omits the required "What changes for users" section and the complete checklist from the repository template.	Add the required "## What changes for users" section with a one- or two-sentence release note, and include the checklist with accurate completion states for tests, static checks, formatting, and documentation updates.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: adding repository CodeRabbit review configuration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · This review configuration excludes go.sum changes and disables CodeRabbit's linter, which could let relevant issues escape automated review.

Configures CodeRabbit review instructions for security-sensitive paths in the verifier, gateway, and config packages with a concise tone and filtered build artifacts. However, golangci-lint is disabled in CodeRabbit while the CI workflow does not run it either, leaving the security-sensitive verifier without golangci-lint coverage (gosec, errcheck, etc.). Either add a pinned golangci-lint job to the CI workflow as a required check before disabling the CodeRabbit tool, or keep the tool enabled until that job exists.

✅ 1 closed

Closed: Quality: golangci-lint turned off, but CI doesn't run it either

📄 .coderabbit.yaml:41-43
The PR turns off CodeRabbit's golangci-lint because "CI runs golangci-lint as a required check". That isn't true in this repo. .github/workflows/ci.yml runs only gofmt, go vet, tests, fuzzing, example validation, govulncheck and an image build. No workflow mentions golangci, and there's no .golangci.* config. Merging this as-is leaves the security-sensitive verifier with no golangci-lint coverage anywhere (gosec, errcheck, etc. stop running). Either add a pinned golangci-lint job to CI and make it a required check before turning the CodeRabbit tool off, or keep the tool on until that job exists.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud