chore(review-stack): enroll repository

.coderabbit.yaml

@@ -0,0 +1,7 @@
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+chat:
+  auto_reply: false

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/review-stack-trufflehog.yml

@@ -0,0 +1,13 @@
+name: TruffleHog weekly deep scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 0"
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    uses: madmoneymike5/review-stack-runtime/.github/workflows/trufflehog.yml@v1

.github/workflows/review-stack.yml

@@ -0,0 +1,21 @@
+name: Review Stack
+# review-stack-control: runtime mirror rollout verification
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  review-stack:
+    uses: madmoneymike5/review-stack-runtime/.github/workflows/review-stack.yml@v1
+    with:
+      native-command: >-
+        git diff --check
+      central-ref: v1
+      opengrep-excludes: ""
+      gitleaks-excludes: |-
+

.review-stack/coderabbit-review.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v cr >/dev/null 2>&1; then
+  cli=cr
+elif command -v coderabbit >/dev/null 2>&1; then
+  cli=coderabbit
+else
+  printf '%s\n' 'CodeRabbit CLI missing. Install it through your organization-approved method, then rerun.' >&2
+  exit 127
+fi
+
+if ! git rev-parse --show-toplevel >/dev/null 2>&1; then
+  printf '%s\n' 'Run this command inside a Git repository.' >&2
+  exit 2
+fi
+
+exec "$cli" review --plain --uncommitted --include-untracked "$@"

REVIEW-STACK.md

@@ -0,0 +1,15 @@
+# Review Stack
+
+This repository uses the central review stack at `madmoneymike5/review-stack-control`.
+
+Order:
+
+1. Native type, lint, test, and build gates.
+2. OpenGrep, Gitleaks, and Trivy blocking checks.
+3. Kodus local AI review, advisory.
+4. CodeRabbit CLI or Codex CLI, opt-in and advisory.
+5. Greptile only on request after all earlier checks pass.
+
+Greptile is manual-only to protect the monthly credit budget. Trigger it with `@greptileai` when needed.
+
+The weekly TruffleHog workflow is deliberately separate from normal pull-request checks.

greptile.json

@@ -0,0 +1,3 @@
+{
+  "skipReview": "AUTOMATIC"
+}