AetherCode-Execution-Engine/.coderabbit.yaml at development · stjosephsplacements/AetherCode-Execution-Engine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# CodeRabbit configuration
# Full review on every PR — security, performance, correctness, Go idioms.
# https://docs.coderabbit.ai/getting-started/configure-coderabbit

language: "en-US"
tone_instructions: "Be concise and direct. Lead with the most critical issues. Skip compliments."

early_access: true

reviews:
  review_status: true
  auto_review:
    enabled: true
    # Review PRs targeting ANY branch, including forks and draft PRs.
    base_branches:
      - ".*"
    drafts: true
    # Review every new commit pushed to an open PR, not just on open/reopen.
    auto_incremental_review: true
    ignore_title_keywords:
      - "WIP"
      - "[skip ci]"

  # High-signal file filters — skip generated/lockfiles.
  path_filters:
    - "!**/*.sum"
    - "!**/*.lock"
    - "!**/vendor/**"
    - "!**/testdata/**"
    - "!**/.git/**"

  # Assertive profile — surfaces real issues, not style nits.
  profile: "assertive"

  # Never collapse the walkthrough summary.
  collapse_walkthrough: false

  # Request changes on high-severity findings rather than just commenting.
  request_changes_workflow: true

  # Sequence diagram for complex PR flows.
  sequence_diagrams: true

  poem: false

  # Per-path review instructions — CodeRabbit reads these before reviewing each path.
  path_instructions:
    - path: "internal/auth/**"
      instructions: |
        This is the OIDC JWT validation and user-provisioning layer.
        Review for: JWT claim validation completeness (iss, aud, exp, sub),
        timing-safe comparisons, cache invalidation correctness, SQL injection in
        resolveUser/resolveTenant, token replay attacks, and privilege escalation
        via role claim manipulation.

    - path: "internal/sandbox/**"
      instructions: |
        This builds commands sent to the go-judge sandbox.
        Review for: argument injection via language/source fields, resource limit
        correctness (CPU/mem/proc), file path traversal in CopyIn, missing or
        incorrect output size caps, and any path that could let user code escape
        the sandbox or exfiltrate host data.

    - path: "internal/worker/**"
      instructions: |
        Hot path: processes every code submission.
        Review for: goroutine leaks, context cancellation propagation,
        compile-cache invalidation correctness, race conditions on shared state,
        verdict correctness (especially WA vs TLE edge cases), and any scenario
        where a submission could be silently dropped without a verdict.

    - path: "internal/queue/**"
      instructions: |
        Redis Streams consumer group logic — correctness is critical.
        Review for: XAck reliability (must not ACK before handler succeeds),
        reclaimer delivery-count off-by-one errors, message loss on panic,
        pipeline atomicity in PrepareAndEnqueue, and correct handling of
        Redis Nil errors vs network errors.

    - path: "internal/gateway/**"
      instructions: |
        Public HTTP surface. Review for: input validation completeness,
        CORS misconfiguration, SSE stream isolation (one user must not read
        another's events), rate limit bypass paths, request-body size enforcement,
        and Content-Type enforcement.

    - path: "internal/db/**"
      instructions: |
        All DB interactions. Review for: missing parameterisation (SQLi),
        transactions that should be atomic but aren't, missing index usage,
        N+1 query patterns, and the advisory lock logic in Migrate.

    - path: ".github/workflows/**"
      instructions: |
        CI/CD pipelines. Review for: secret exfiltration via untrusted inputs
        (pull_request_target risks), unpinned action versions, overly broad
        permissions, script injection via ${{ github.event.* }}, and whether
        the promote/auto-merge logic could be gamed to bypass the human gate.

    - path: "**/*_test.go"
      instructions: |
        Review for: missing race-detector coverage, table tests that don't
        cover error paths, tests that pass even when the logic is wrong
        (asserting too little), and any test that requires a live external
        service but doesn't skip gracefully.

  knowledge_base:
    # Learn from past PR discussions to improve future reviews.
    learnings:
      scope: auto
    issues:
      scope: auto
    pull_requests:
      scope: auto
    jira:
      project_keys: []

chat:
  auto_reply: true