From 90c51efeb7a442c5f07145aa52e52657f8e3c69e Mon Sep 17 00:00:00 2001
From: Jon Duea <jdueadev@gmail.com>
Date: Thu, 12 Nov 2026 17:08:57 -0600
Subject: [PATCH 1/2] ci: add automated PR reviews (Claude, CodeRabbit, Gemini)

Claude review runs on the owner's Claude subscription via
CLAUDE_CODE_OAUTH_TOKEN. CodeRabbit and Gemini Code Assist configs take
effect once their GitHub Apps are installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .coderabbit.yaml                    | 14 ++++++++
 .gemini/config.yaml                 | 10 ++++++
 .github/workflows/claude-review.yml | 52 +++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 .coderabbit.yaml
 create mode 100644 .gemini/config.yaml
 create mode 100644 .github/workflows/claude-review.yml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..de793fb
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,14 @@
+# CodeRabbit config. Install the app: https://github.com/apps/coderabbitai
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  collapse_walkthrough: true
+  auto_review:
+    enabled: true
+    drafts: false
+chat:
+  auto_reply: true
diff --git a/.gemini/config.yaml b/.gemini/config.yaml
new file mode 100644
index 0000000..f26750a
--- /dev/null
+++ b/.gemini/config.yaml
@@ -0,0 +1,10 @@
+# Gemini Code Assist config. Install the app: https://github.com/apps/gemini-code-assist
+have_fun: false
+code_review:
+  disable: false
+  comment_severity_threshold: MEDIUM
+  max_review_comments: -1
+  pull_request_opened:
+    help: false
+    summary: true
+    code_review: true
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
new file mode 100644
index 0000000..de1a7de
--- /dev/null
+++ b/.github/workflows/claude-review.yml
@@ -0,0 +1,52 @@
+name: Claude PR Review
+
+# Runs on the repo owner's Claude subscription (CLAUDE_CODE_OAUTH_TOKEN from
+# `claude setup-token`), not paid API credits. Triggers are kept narrow to save
+# plan quota: new / ready / reopened PRs, plus the `claude-review` label to re-run.
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, labeled]
+
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Skip drafts, PRs from forks (no secret access), and unrelated label events.
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (github.event.action != 'labeled' || github.event.label.name == 'claude-review')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Review this pull request. Read AGENTS.md / CONTRIBUTING.md first if present
+            and hold the change to the repo's own conventions.
+
+            Focus on, in order: correctness bugs, security problems, broken invariants
+            or contracts, missing tests for changed behavior, and performance regressions.
+            Skip formatting and style nitpicks that linters already catch.
+
+            Leave an inline comment for each concrete issue on the exact line, saying what
+            breaks and how to fix it. Then post one short summary comment with
+            `gh pr comment`. If you find nothing worth flagging, say so in one line.
+          claude_args: |
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Glob,Grep"

From 831eee6880a70a585c1f2e88976a433cb02b376b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 13 Nov 2026 03:39:50 +0000
Subject: [PATCH 2/2] fix: update rustix for RustSec advisory

Co-authored-by: jdueadev <119540897+jdueadev@users.noreply.github.com>
---
 Cargo.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6aa051b..7fb865e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -494,7 +494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1551,15 +1551,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa"
 dependencies = [
  "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1884,7 +1884,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]