[review only] kleinbem-dev/coderabbit full review

.coderabbit.yaml

@@ -0,0 +1,78 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+#
+# Central CodeRabbit config for every repo of its owner. kleinbem/coderabbit is
+# the source; sync-org.yaml copies it to kleinbem-dev/coderabbit. A repo's own
+# .coderabbit.yaml replaces this file unless it sets `inheritance: true`, in
+# which case it merges on top. The web UI settings don't apply while this file
+# exists.
+
+language: en-GB
+tone_instructions: "Short and direct. Lead with the problem and the fix. No praise, no filler."
+early_access: false
+
+reviews:
+  profile: chill
+  # PRs auto-merge once green; reviews inform, they don't block.
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  in_progress_fortune: false
+  sequence_diagrams: false
+  review_status: true
+  # The CodeRabbit check is required: a review that errors must block, not pass.
+  fail_commit_status: true
+  collapse_walkthrough: true
+
+  auto_review:
+    enabled: true
+    # A skipped draft review passes the required check: a draft with auto-merge
+    # armed merges unreviewed the moment it goes ready. no-link: GitHub documents
+    # skipped as passing; nothing upstream to wait on.
+    drafts: true
+    # Never pause on a busy branch: a paused review reports "skipped", which
+    # passes the required check and lets the PR merge unreviewed (kleinbem#21).
+    auto_pause_after_reviewed_commits: 0
+    # Lock bumps, docs syncs and dependency updates: not worth the rate limit.
+    ignore_usernames:
+      - "kleinbem-bot[bot]"
+      - "dependabot[bot]"
+
+  # Generated or vendored files.
+  path_filters:
+    - "!**/flake.lock"
+    - "!**/Cargo.lock"
+    - "!**/package-lock.json"
+    - "!**/INFRASTRUCTURE.yaml"
+    - "!infra/*.json"
+    - "!traffic_data/**"
+    - "!governance-report.json"
+    - "!DASHBOARD.md"
+
+  path_instructions:
+    - path: "**"
+      instructions: |
+        Every workaround or fix for someone else's bug (patch, override, pin, disabled tests, blacklisted module, feature switched off, "drop once …") needs a comment linking the upstream issue or PR it waits on: a URL or owner/repo#123. Flag new or changed workarounds without one, and links that point at a closed or merged report (the workaround may be droppable). A comment that only mentions a workaround may say "no-link: <why>".
+    - path: "**/*.nix"
+      instructions: |
+        NixOS fleet config. Check especially:
+        - sops.secrets for a feature must be gated behind that feature's enable option; a secret for a disabled feature breaks activation.
+        - /var is tmpfs on every host: new service state needs an impermanence/persistence entry.
+        - No plaintext secrets; they belong in kleinbem-secrets (sops).
+        - Prefer upstream nixpkgs options over custom wrappers.
+    - path: "**/*.sh"
+      instructions: "Scripts run under `set -euo pipefail`: flag unbound variables and unquoted expansions."
+    - path: ".github/workflows/**"
+      instructions: "Third-party actions must be pinned by commit SHA. Secrets must not reach pull_request runs from forks; flag pull_request_target and self-hosted runners."
+    - path: "**/*.tf"
+      instructions: "OpenTofu. Watch for changes that force replacement or destroy existing resources, and for secrets in plain variables or outputs."
+    # Agent skills and agents copied from upstream projects (e.g. sveltejs/ai-tools)
+    # stay byte-identical to upstream. no-link: not a bug workaround; doc fixes go upstream.
+    - path: ".agents/skills/**"
+      instructions: |
+        Vendored from upstream projects and kept identical to upstream. Only flag security and permission problems: agent permission modes or tool grants, commands that run code, unpinned installs or downloads, hooks. Skip wording, links, code examples, markdown style and version notes.
+    - path: ".claude/agents/**"
+      instructions: |
+        Vendored from upstream projects and kept identical to upstream. Only flag security and permission problems: agent permission modes or tool grants, commands that run code, unpinned installs or downloads, hooks. Skip wording, links, code examples, markdown style and version notes.
+
+chat:
+  auto_reply: true

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  # One grouped PR a week for pinned actions; the cooldown skips releases
+  # younger than a week.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/fleet-lint.yaml

@@ -0,0 +1,21 @@
+name: fleet-lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+jobs:
+  fleet-lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # gitleaks scans every commit of the PR
+          persist-credentials: false
+      - uses: kleinbem/actions/nix-setup@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1
+      - uses: kleinbem/actions/lint@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1

.github/workflows/validate.yaml

@@ -0,0 +1,21 @@
+name: Validate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Check .coderabbit.yaml against CodeRabbit's schema
+        run: |
+          curl -fsSL https://coderabbit.ai/integrations/schema.v2.json -o /tmp/schema.json
+          pipx run check-jsonschema --schemafile /tmp/schema.json .coderabbit.yaml

README.md

@@ -0,0 +1,15 @@
+# coderabbit
+
+Central [CodeRabbit](https://coderabbit.ai) config for every `kleinbem-dev` repo.
+CodeRabbit reads `.coderabbit.yaml` from this repo for any repo without its own.
+While it exists, the web UI settings don't apply.
+
+A repo that needs something extra adds its own `.coderabbit.yaml` with
+`inheritance: true`, so it merges on top of this one instead of replacing it.
+See [central configuration](https://docs.coderabbit.ai/configuration/central-configuration)
+and [inheritance](https://docs.coderabbit.ai/configuration/configuration-inheritance).
+
+CI checks the file against CodeRabbit's schema on every PR.
+
+The `kleinbem` user account has its own copy in `kleinbem/coderabbit`.
+Keep the two in step.