ci: add CodeRabbit configuration for template-ui - #98
Conversation
Configure CodeRabbit with assertive profile for correctness-only reviews. Includes ast-grep rules for TypeScript/React patterns (XSS, floating promises, console.log, useEffect deps, any types, direct env access), auto review with draft/bot exclusions, slop detection, post-merge changelog, issue enrichment with auto-labeling, and cross-repo knowledge base linking. Signed-off-by: Soham Dutta <19648293+NP-compete@users.noreply.github.com>
WalkthroughAdds a complete CodeRabbit configuration with review defaults, automation, path-based instructions, lint and security tooling, changelog updates, chat replies, issue enrichment, knowledge sources, and guideline patterns. Adds six TypeScript rules covering explicit 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
🚀 Post-Merge Actions
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.44.1)ast-grep could not parse rule config: /ast-grep-rules/../git/.coderabbit/rules/no-dangerously-set-innerhtml.yml Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.coderabbit.yaml:
- Line 44: Update the dotenv exclusion pattern in the ignore configuration from
the root-only form to a recursive pattern that excludes matching .env files in
all directories, using !**/.env*.
In @.coderabbit/rules/no-console-log.yml:
- Around line 3-10: Remove the access-token logging statement from the client
router around the token log at line 30, rather than replacing console.log with a
structured logger. Preserve the surrounding request and authentication behavior
while ensuring the token value is never logged.
In @.coderabbit/rules/no-unhandled-promise.yml:
- Around line 6-18: Replace the structural AST pattern in the
no-unhandled-promise rule with a type-aware floating-promise check that
identifies calls returning promises without requiring then, catch, or finally
handling. Ensure it covers async arrow callbacks as well as async function
declarations, while excluding intentional void-returning calls such as
logger.info().
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a9926e80-64a1-46ab-a5f5-69334bb62168
📒 Files selected for processing (7)
.coderabbit.yaml.coderabbit/rules/no-any-type-annotation.yml.coderabbit/rules/no-console-log.yml.coderabbit/rules/no-dangerously-set-innerhtml.yml.coderabbit/rules/no-direct-env-access.yml.coderabbit/rules/no-empty-useeffect-deps.yml.coderabbit/rules/no-unhandled-promise.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
redhat-data-and-ai/template-agent(manual)redhat-data-and-ai/template-mcp(manual)
| - "!**/package-lock.json" | ||
| - "!**/.gitignore" | ||
| - "!**/LICENSE" | ||
| - "!.env*" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
npx --yes --package=minimatch node <<'NODE'
const mod = require('minimatch');
const minimatch = mod.minimatch ?? mod;
const path = 'apps/api/.env.production';
console.log(minimatch(path, '.env*'));
console.log(minimatch(path, '**/.env*'));
NODERepository: redhat-data-and-ai/template-ui
Length of output: 491
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- .coderabbit.yaml (relevant section) ---'
nl -ba .coderabbit.yaml | sed -n '1,120p'
echo
echo '--- search for path_filters usage ---'
rg -n 'path_filters|\.env\*|!\*\*/\.env\*|!\.env\*' .coderabbit.yaml . || trueRepository: redhat-data-and-ai/template-ui
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import yaml
p = Path('.coderabbit.yaml')
data = yaml.safe_load(p.read_text())
print(data.get('reviews', {}).get('path_filters'))
PYRepository: redhat-data-and-ai/template-ui
Length of output: 285
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- .coderabbit.yaml lines 1-120 ---'
sed -n '1,120p' .coderabbit.yaml | cat -n
echo
echo '--- exact env-related filters ---'
grep -nE 'env|\*\*/|path_filters' .coderabbit.yaml || trueRepository: redhat-data-and-ai/template-ui
Length of output: 5652
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
text = Path('.coderabbit.yaml').read_text().splitlines()
for i, line in enumerate(text, 1):
if 'path_filters' in line or '.env' in line or '**/' in line:
print(f'{i}: {line}')
PYRepository: redhat-data-and-ai/template-ui
Length of output: 619
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,120p' .coderabbit.yaml | cat -nRepository: redhat-data-and-ai/template-ui
Length of output: 5144
🌐 Web query:
CodeRabbit path_filters glob .env* nested directories minimatch docs
💡 Result:
CodeRabbit supports standard glob patterns for its path_filters configuration to control which files are included in or excluded from reviews [1][2]. These patterns follow minimatch syntax [3]. To specifically address your requirements: 1. Nested Directories: The glob pattern supports matching across any number of directory levels [4]. For example, !/.env* will effectively exclude all files starting with .env (including those in nested directories) from CodeRabbit's review scope [5]. 2. Glob Syntax: - Use the ! prefix to explicitly exclude files (e.g., !/.env*) [6][4]. - Patterns without the ! prefix are used to explicitly include files, which is useful for overriding default exclusions [6][7]. 3. Implementation: You can define these in your.coderabbit.yaml file under the reviews.path_filters section: reviews: path_filters: - "!/.env*" # Excludes all.env files regardless of location CodeRabbit applies these filters to the repository contents, and because it supports standard glob syntax, using the wildcard ensures that your.env* filter will correctly identify and apply to files within nested directories [4][2].
Citations:
- 1: https://docs.coderabbit.ai/reference/configuration
- 2: https://dev.to/rahulxsingh/coderabbit-configuration-coderabbityaml-reference-5493
- 3: https://docs.coderabbit.ai/finishing-touches/docstrings
- 4: https://docs.coderabbit.ai/reference/glossary
- 5: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/7913826e88177d47ab5c3fe0afaf2eb1f7c1ab58/plugins/saas-packs/coderabbit-pack/skills/coderabbit-data-handling/SKILL.md
- 6: https://coderabbit.mintlify.app/configuration/path-instructions
- 7: https://docs.coderabbit.ai/configuration/path-instructions
🌐 Web query:
site:docs.coderabbit.ai path_filters .env* nested directories minimatch CodeRabbit
💡 Result:
In CodeRabbit configuration, path_filters use minimatch glob patterns to include or exclude specific files and directories [1][2]. To target.env files across nested directories, you can use the double asterisk glob pattern [1]. 1. Include nested.env files: To ensure.env files are included (or to override default exclusions), use a pattern like /.env*. This matches any file starting with.env in any directory [1][3]. 2. Exclude nested.env files: To exclude them, prefix the pattern with an exclamation mark (!) [1][2]. For example,!/.env* will exclude all.env files regardless of their nesting level [1]. Example usage in your.coderabbit.yaml: reviews: path_filters: - "!/.env*" # Excludes all.env files in any directory - "src/" # Explicitly includes the src directory The double asterisk is a minimatch feature that matches zero or more directories, making it the standard way to handle recursive or nested file paths within CodeRabbit configuration [1][4].
Citations:
- 1: https://docs.coderabbit.ai/configuration/path-instructions
- 2: https://docs.coderabbit.ai/reference/configuration
- 3: https://docs.coderabbit.ai/tools/dotenv
- 4: https://docs.coderabbit.ai/finishing-touches/docstrings
🌐 Web query:
site:docs.coderabbit.ai "path_filters" ".env*" CodeRabbit
💡 Result:
In CodeRabbit, path_filters are used within your configuration file (typically.coderabbit.yaml) to control which files are included in or excluded from AI-powered code reviews [1][2]. To exclude.env files from CodeRabbit reviews using path_filters, you would add a pattern prefixed with an exclamation mark (!) to your configuration [1][3]. For example: reviews: path_filters: - "!/.env*" This pattern uses glob syntax: - The! prefix instructs CodeRabbit to exclude the matching files [1][2]. - The glob matches any directory depth [3]. - The.env* wildcard ensures that all variations of environment files (e.g.,.env,.env.local,.env.development) are captured by the exclusion [4]. Note that this configuration is specific to the general AI code review process. CodeRabbit also includes a separate, automatic "Dotenv Linter" tool that specifically targets.env files; it runs on /.env and /.env.* patterns by default [4]. Configuring path_filters as shown above will prevent the primary AI review from processing those files, while the specialized Dotenv Linter may still operate independently unless otherwise managed [4].
Citations:
- 1: https://docs.coderabbit.ai/configuration/path-instructions
- 2: https://docs.coderabbit.ai/reference/configuration
- 3: https://docs.coderabbit.ai/reference/glossary
- 4: https://docs.coderabbit.ai/tools/dotenv
🌐 Web query:
site:docs.coderabbit.ai "path instructions" "path_filters" "minimatch" CodeRabbit
💡 Result:
In CodeRabbit, path_filters and path_instructions are configuration mechanisms used to control which files are reviewed and how they are handled, both of which utilize glob patterns based on the minimatch syntax [1][2]. Path Filters Path filters allow you to define which files should be included in or excluded from an AI code review [3]. This is commonly used to ignore irrelevant files such as lock files, binaries, build artifacts, or generated code to keep reviews focused [3][4]. - Syntax: Uses glob patterns [5]. - Exclusions: Patterns prefixed with "!" will exclude the matching paths from the review (e.g.,!dist/) [3][1]. - Inclusions: Patterns without the "!" prefix explicitly include paths, which can be used to override default exclusions [3]. - Configuration: Defined under the reviews.path_filters key in your.coderabbit.yaml file [3][5]. Path Instructions Path instructions provide targeted, per-path guidance for the AI, allowing you to enforce specific rules or focus areas for different parts of your codebase [3][4]. - Purpose: Useful for applying specific requirements, such as security checks for API controllers, coverage requirements for tests, or documentation standards [3]. - Configuration: Defined as an array of objects under the reviews.path_instructions key, where each object contains a path (glob pattern) and the corresponding instructions [3][5]. - Example: reviews: path_instructions: - path: "src/controllers/" instructions: | - Focus on authentication and input validation. - path: "tests/" instructions: | - Ensure descriptive test names and coverage for edge cases. Both features support standard glob syntax, where "*" matches any filename and "" matches any directory depth [1]. Because they use minimatch syntax, you can target specific directories, file types, or naming conventions with precision [1][2].
Citations:
- 1: https://docs.coderabbit.ai/reference/glossary
- 2: https://docs.coderabbit.ai/finishing-touches/docstrings
- 3: https://docs.coderabbit.ai/configuration/path-instructions
- 4: https://docs.coderabbit.ai/configuration/auto-review
- 5: https://docs.coderabbit.ai/reference/configuration
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
for url in \
'https://docs.coderabbit.ai/reference/configuration' \
'https://docs.coderabbit.ai/configuration/path-instructions' \
'https://docs.coderabbit.ai/reference/glossary' \
'https://docs.coderabbit.ai/tools/dotenv'
do
echo "### $url"
curl -L --silent "$url" | \
grep -nE 'path_filters|path instructions|\.env\*|!/?\.\env|\*\*/|minimatch|dotenv' | \
head -n 40 || true
echo
done
Length of output: 50344
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-id5t7x'
echo '--- path_filters references ---'
rg -n --max-count 40 'path_filters|path instructions|minimatch|\.env\*|dotenv|!/' "$log" || true
echo
echo '--- nearby context for dotenv mentions ---'
rg -n -C 3 --max-count 20 '\.env\*|dotenv' "$log" || true
Length of output: 50344
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import re, urllib.request
urls = [
"https://docs.coderabbit.ai/reference/configuration",
"https://docs.coderabbit.ai/configuration/path-instructions",
"https://docs.coderabbit.ai/reference/glossary",
"https://docs.coderabbit.ai/tools/dotenv",
]
patterns = [r"\.env\*", r"path_filters", r"minimatch", r"dotenv", r"!\./env", r"!\*\*/\.env\*", r"!/\.env\*"]
for url in urls:
print(f"### {url}")
html = urllib.request.urlopen(url, timeout=20).read().decode("utf-8", "ignore")
for pat in patterns:
found = False
for m in re.finditer(pat, html, flags=re.I):
s = max(0, m.start() - 180)
e = min(len(html), m.end() + 260)
snippet = re.sub(r"\s+", " ", html[s:e])
print(f"[{pat}] ...{snippet}...")
found = True
break
if not found:
print(f"[{pat}] <no match>")
print()
PY
Length of output: 2467
Exclude nested dotenv files. !.env* only ignores repo-root matches, so use !**/.env* instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.coderabbit.yaml at line 44, Update the dotenv exclusion pattern in the
ignore configuration from the root-only form to a recursive pattern that
excludes matching .env files in all directories, using !**/.env*.
| message: "Use a structured logger instead of console.log() for observability" | ||
| severity: warning | ||
| rule: | ||
| pattern: console.log($$$) | ||
| not: | ||
| inside: | ||
| kind: function_declaration | ||
| regex: "test|spec|describe|it" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sample="$(mktemp --suffix=.ts)"
cat >"$sample" <<'TS'
function testLogging() { console.log("test"); }
function handler(token: string) { console.log(token); }
TS
npx --yes `@ast-grep/cli` scan --rule .coderabbit/rules/no-console-log.yml "$sample"
rm -f "$sample"Repository: redhat-data-and-ai/template-ui
Length of output: 645
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## rule file\n'
cat -n .coderabbit/rules/no-console-log.yml
printf '\n## client.router.ts matches\n'
rg -n "console\.log|logger|token" src/server/router/client.router.ts src/server/router -S || true
printf '\n## client.router.ts excerpt\n'
sed -n '1,220p' src/server/router/client.router.tsRepository: redhat-data-and-ai/template-ui
Length of output: 3509
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '## coderabbit rules\n'
find .coderabbit/rules -maxdepth 1 -type f | sort | xargs -r -I{} sh -c 'echo; echo "### {}"; cat -n "{}"'
printf '\n## sensitive log patterns\n'
rg -n "token|secret|credential|accessToken|console\.log|logger" .coderabbit/rules src/server -S || trueRepository: redhat-data-and-ai/template-ui
Length of output: 6202
Remove the token log in src/server/router/client.router.ts:30; a structured logger still leaks the access token, so this value should not be logged at all.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.coderabbit/rules/no-console-log.yml around lines 3 - 10, Remove the
access-token logging statement from the client router around the token log at
line 30, rather than replacing console.log with a structured logger. Preserve
the surrounding request and authentication behavior while ensuring the token
value is never logged.
| kind: expression_statement | ||
| has: | ||
| kind: call_expression | ||
| has: | ||
| kind: member_expression | ||
| not: | ||
| has: | ||
| kind: property_identifier | ||
| regex: "^(then|catch|finally)$" | ||
| inside: | ||
| kind: function_declaration | ||
| regex: "^async " | ||
| stopBy: end |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
sample="$(mktemp --suffix=.ts)"
cat >"$sample" <<'TS'
type Service = { save(): Promise<void>; trace(): void };
declare const service: Service;
async function named() { service.trace(); }
const callback = async () => { service.save(); };
TS
npx --yes `@ast-grep/cli` scan --rule .coderabbit/rules/no-unhandled-promise.yml "$sample"
rm -f "$sample"Repository: redhat-data-and-ai/template-ui
Length of output: 645
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .coderabbit/rules/no-unhandled-promise.yml
echo '---'
cat -n .coderabbit/rules/no-unhandled-promise.yml
echo '---'
python3 - <<'PY'
from pathlib import Path
p = Path('.coderabbit/rules/no-unhandled-promise.yml')
print('lines', sum(1 for _ in p.open()))
PYRepository: redhat-data-and-ai/template-ui
Length of output: 786
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "no-unhandled-promise|Floating promise without await" .coderabbit . || trueRepository: redhat-data-and-ai/template-ui
Length of output: 366
Replace this with a type-aware floating-promise check. The current structural rule flags void member calls like logger.info() and misses floating promises in async arrow callbacks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.coderabbit/rules/no-unhandled-promise.yml around lines 6 - 18, Replace the
structural AST pattern in the no-unhandled-promise rule with a type-aware
floating-promise check that identifies calls returning promises without
requiring then, catch, or finally handling. Ensure it covers async arrow
callbacks as well as async function declarations, while excluding intentional
void-returning calls such as logger.info().
1 participant
Summary
.coderabbit.yamlwith assertive profile for correctness-only automated reviewsanytypes, no floating promisesThis PR targets main so CodeRabbit picks up the config from the default branch.
Test plan